Skip to main content
On this page

Use this catalog to find the operations carried forward from the previous DEUNA API reference. The migration matrix keeps each published method and path represented once while excluding other API Gateway routes.

Published endpoint inventory#

This inventory is generated from the effective API Gateway configuration and restricted by the reviewed migration matrix. Use the filters to identify who should call an operation, which service owns it, what authorization it supports, and which headers the gateway accepts or forwards.

The catalog includes only merchant-backend and customer-application operations already present in the previous public API reference. Internal Admin, management, partner, provider-callback, and other gateway operations are excluded.

Routes below /transactions/webhooks/ receive processor events inside DEUNA and are not merchant integration endpoints. When a provider requires merchant-side callback configuration, the URL and setup steps live in that provider's connection guide—for example, the Stripe OXXO payment-status callback. Use DEUNA webhooks for notifications delivered to your own backend.

Verified published API inventory56 published operations

Generated from effective API Gateway operations mapped from the previous public API reference.

Merchant backend · server to server 42Customer application · user to server 14
Showing 56 of 56 operations
Merchant backend · server to serverUse from a trusted merchant backend for orders, payments and operational workflows.42
GET/cards/bin/{bin}
Cards and vaultMerchant backend · server to server

Retrieve Bin

Domain
Cards and vault
Owning service
Card metadata
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
X-Api-KeyX-Merchant-Id
Try it
cURL example
GET/merchants/checkout/themes
CheckoutMerchant backend · server to server

List or retrieve Themes

Domain
Checkout
Owning service
Checkout configuration
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
X-Api-Key
Try it
cURL example
POST/merchants/checkout/themes
CheckoutMerchant backend · server to server

Create Themes

Domain
Checkout
Owning service
Checkout configuration
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
X-Api-Key
Try it
cURL example
DELETE/merchants/checkout/themes/{theme_id}
CheckoutMerchant backend · server to server

Delete Themes

Domain
Checkout
Owning service
Checkout configuration
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
X-Api-Key
Try it
cURL example
PATCH/merchants/checkout/themes/{theme_id}
CheckoutMerchant backend · server to server

Update Themes

Domain
Checkout
Owning service
Checkout configuration
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
X-Api-Key
Try it
cURL example
GET/merchants/orders
OrdersMerchant backend · server to server

List or retrieve Orders

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
POST/merchants/orders
OrdersMerchant backend · server to server

Create Orders

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
AuthorizationX-Api-KeyX-Idempotency-KeyX-Prediction-Id
Try it
cURL example
GET/merchants/orders/{order_token}
OrdersMerchant backend · server to server

Retrieve Orders

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
AuthorizationX-Api-Keyx-merchant-id
Try it
cURL example
PATCH/merchants/orders/{order_token}
OrdersMerchant backend · server to server

Update Orders

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
X-Api-Key
Try it
cURL example
POST/merchants/orders/{order_token}/expire
OrdersMerchant backend · server to server

Run Expire for Orders

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
X-Api-Key
Try it
cURL example
GET/merchants/orders/{order_token}/payments-methods
OrdersMerchant backend · server to server

List or retrieve Payments Methods

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key or Bearer token, according to the flow
Accepted or forwarded headers
AuthorizationX-Api-KeyX-Store-Code
Try it
cURL example
POST/merchants/orders/{order_token}/transactions/verify
OrdersMerchant backend · server to server

Run Verify for Transactions

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key or Bearer token, according to the flow
Accepted or forwarded headers
AuthorizationX-Api-KeyX-Merchant-IDX-Store-Code
Try it
cURL example
POST/merchants/orders/{order_token}/void
OrdersMerchant backend · server to server

Run Void for Orders

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
*
Try it
cURL example
GET/merchants/transactions/orders/{order_token}/installments
OrdersMerchant backend · server to server

List or retrieve Installments

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key or Bearer token, according to the flow
Accepted or forwarded headers
AuthorizationX-Api-KeyX-Merchant-IDX-Prediction-Id
Try it
cURL example
POST/v2/merchants/orders/{order_token}/capture
OrdersMerchant backend · server to server

Capture Payment

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
POST/v2/merchants/orders/{order_token}/refund
OrdersMerchant backend · server to server

Create Refund

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
POST/v2/merchants/orders/purchase
OrdersMerchant backend · server to server

Create Payment

Domain
Orders
Owning service
Orders and checkout
Intended for
Merchant backend · server to server
Supported authorization
Private API key validated; user Bearer header forwarded when present
Accepted or forwarded headers
AuthorizationCookieUser-AgentX-Api-KeyX-Device-IdX-Merchant-IDX-Prediction-IdX-Session-IdX-Store-Code
Try it
cURL example
POST/merchants/payment-links
Payment linksMerchant backend · server to server

Create Payment Links

Domain
Payment links
Owning service
Payment links
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
GET/merchants/payment-links/{payment_link_id}
Payment linksMerchant backend · server to server

Retrieve Payment Links

Domain
Payment links
Owning service
Payment links
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
GET/merchants/payment-links/{payment_link_id}/orders
Payment linksMerchant backend · server to server

List or retrieve Orders

Domain
Payment links
Owning service
Payment links
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
GET/merchants/payment-links/all
Payment linksMerchant backend · server to server

List or retrieve All

Domain
Payment links
Owning service
Payment links
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
GET/merchants/stores/payments-methods
PaymentsMerchant backend · server to server

List or retrieve Payments Methods

Domain
Payments
Owning service
Payments
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
X-Idempotency-KeyX-Merchant-IdX-Prediction-IdX-Store-Code
Try it
cURL example
GET/transactions/payments-methods
PaymentsMerchant backend · server to server

List or retrieve Payments Methods

Domain
Payments
Owning service
Payments
Intended for
Merchant backend · server to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
*
Try it
cURL example
GET/merchants/installments/plans/{installment_plan_option_id}
SubscriptionsMerchant backend · server to server

Retrieve Plans

Domain
Subscriptions
Owning service
Installments
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
X-Api-Key
Try it
cURL example
GET/subscriptions
SubscriptionsMerchant backend · server to server

List or retrieve Subscriptions

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
POST/subscriptions
SubscriptionsMerchant backend · server to server

Create Subscriptions

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
GET/subscriptions/{id}
SubscriptionsMerchant backend · server to server

Retrieve Subscriptions

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
PATCH/subscriptions/{id}
SubscriptionsMerchant backend · server to server

Update Subscriptions

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
POST/subscriptions/{id}/cancel
SubscriptionsMerchant backend · server to server

Run Cancel for Subscriptions

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
PATCH/subscriptions/{id}/cards
SubscriptionsMerchant backend · server to server

Update Cards

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
POST/subscriptions/{id}/external-settlement
SubscriptionsMerchant backend · server to server

Create External Settlement

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
GET/subscriptions/{id}/history
SubscriptionsMerchant backend · server to server

List or retrieve History

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
POST/subscriptions/{id}/pause
SubscriptionsMerchant backend · server to server

Run Pause for Subscriptions

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
POST/subscriptions/{id}/resume
SubscriptionsMerchant backend · server to server

Run Resume for Subscriptions

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
GET/subscriptions/plans
SubscriptionsMerchant backend · server to server

List or retrieve Plans

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
POST/subscriptions/plans
SubscriptionsMerchant backend · server to server

Create Plans

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
GET/subscriptions/plans/{id}
SubscriptionsMerchant backend · server to server

Retrieve Plans

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
PATCH/subscriptions/plans/{id}
SubscriptionsMerchant backend · server to server

Update Plans

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
GET/subscriptions/plans/statuses
SubscriptionsMerchant backend · server to server

List or retrieve Statuses

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
*
Try it
cURL example
GET/subscriptions/statuses
SubscriptionsMerchant backend · server to server

List or retrieve Statuses

Domain
Subscriptions
Owning service
Subscriptions
Intended for
Merchant backend · server to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
Authorizationx-Api-KeyX-Merchant-ID
Try it
cURL example
POST/users/authorize
Users and identityMerchant backend · server to server

Run Authorize for Users

Domain
Users and identity
Owning service
Merchant management
Intended for
Merchant backend · server to server
Supported authorization
Private API key (`X-Api-Key`)
Accepted or forwarded headers
X-Api-KeyX-Merchant-Id
Try it
cURL example
POST/users/external-authorize
Users and identityMerchant backend · server to server

Create External Authorize

Domain
Users and identity
Owning service
Merchant management
Intended for
Merchant backend · server to server
Supported authorization
Private API key validated; user Bearer header forwarded when present
Accepted or forwarded headers
AuthorizationX-Api-KeyX-Auth-MessageX-Device-IdX-Merchant-Id
Try it
cURL example
Customer application · user to serverUse from customer-facing web or mobile flows with the user identity and device context shown.14
GET/users/{user_id}/cards
Cards and vaultCustomer application · user to server

List or retrieve Cards

Domain
Cards and vault
Owning service
Payments
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Merchant-ID
Try it
cURL example
DELETE/users/{user_id}/cards/{card_id}
Cards and vaultCustomer application · user to server

Delete Cards

Domain
Cards and vault
Owning service
Payments
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
Authorization
Try it
cURL example
GET/users/{user_id}/cards/{card_id}
Cards and vaultCustomer application · user to server

Retrieve Cards

Domain
Cards and vault
Owning service
Payments
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
Authorization
Try it
cURL example
PATCH/users/{user_id}/cards/{card_id}/set-as-default
Cards and vaultCustomer application · user to server

Set card as default

Domain
Cards and vault
Owning service
Payments
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Merchant-ID
Try it
cURL example
POST/v2/users/{user_id}/cards
Cards and vaultCustomer application · user to server

Create Cards

Domain
Cards and vault
Owning service
Payments
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Merchant-ID
Try it
cURL example
GET/users/{user_id}/addresses
Users and identityCustomer application · user to server

List or retrieve Addresses

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Device-IdX-Merchant-Id
Try it
cURL example
POST/users/{user_id}/addresses
Users and identityCustomer application · user to server

Create Addresses

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Device-IdX-Merchant-Id
Try it
cURL example
DELETE/users/{user_id}/addresses/{address_id}
Users and identityCustomer application · user to server

Delete Addresses

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Device-IdX-Merchant-Id
Try it
cURL example
PATCH/users/{user_id}/addresses/{address_id}
Users and identityCustomer application · user to server

Update Addresses

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Device-IdX-Merchant-Id
Try it
cURL example
POST/users/login
Users and identityCustomer application · user to server

Run Login for Users

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Public credential flow with validated merchant application context
Accepted or forwarded headers
AuthorizationX-Api-KeyX-Device-IdX-Merchant-IdX-Qa-Api-KeyX-Recaptcha-TokenX-Session-ID
Try it
cURL example
POST/users/logout
Users and identityCustomer application · user to server

Run Logout for Users

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
No Gateway credential validator declared; access depends on the owning service or network policy
Accepted or forwarded headers
AuthorizationX-Device-IDX-Session-ID
Try it
cURL example
GET/users/me
Users and identityCustomer application · user to server

List or retrieve Me

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Authenticated user Bearer token
Accepted or forwarded headers
AuthorizationX-Device-IdX-Merchant-Id
Try it
cURL example
POST/users/register
Users and identityCustomer application · user to server

Run Register for Users

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Private API key or Bearer token, according to the flow
Accepted or forwarded headers
X-Api-KeyX-Merchant-Id
Try it
cURL example
POST/users/request-code
Users and identityCustomer application · user to server

Run Request Code for Users

Domain
Users and identity
Owning service
Merchant management
Intended for
Customer application · user to server
Supported authorization
Public credential flow with validated merchant application context
Accepted or forwarded headers
AuthorizationX-Api-KeyX-Device-IdX-Merchant-Id
Try it
cURL example

Core integration endpoints#

The operations below retain stable anchors used by integration guides and provide additional context for the most common merchant workflows.

Orders API#

Create an order

POST /merchants/orders

Optionally creates an order before payment and returns the order_token used by DEUNA widgets and payment operations. New direct integrations can instead send the order inline to Purchase V2.

The required object varies by order type: Checkout and Subscriptions orders require the items array, while Airline orders require airline information. The base contract does not mark an individual item property as universally required. See the item field reference and vertical field guide.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/merchants/orders' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Idempotency-Key: IDEMPOTENCY_KEY' \
  --header 'X-Prediction-Id: PREDICTION_ID_VALUE' \
  --header 'Content-Type: application/json' \
  --data @request.json

Get an order

GET /merchants/orders/{order_token}

Retrieves the current order, payment, and processing state for an order token.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/merchants/orders/{order_token}' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'x-merchant-id: MERCHANT_ID'

Get payment methods for an order

GET /merchants/orders/{order_token}/payments-methods

Returns the payment methods available to a specific order and merchant configuration.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/merchants/orders/{order_token}/payments-methods' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Store-Code: STORE_CODE'

Payments API#

Create a payment

POST /v2/merchants/orders/purchase

Creates and processes an inline order in the recommended one-call flow, or processes an existing order_token when the order was created separately. See the detailed payment request guide.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/v2/merchants/orders/purchase' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'Cookie: COOKIE_VALUE' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-ID: MERCHANT_ID' \
  --header 'X-Prediction-Id: PREDICTION_ID_VALUE' \
  --header 'X-Session-Id: SESSION_ID' \
  --header 'X-Store-Code: STORE_CODE' \
  --header 'Content-Type: application/json' \
  --data @request.json

Capture a payment

POST /v2/merchants/orders/{order_token}/capture

Captures all or part of an authorized payment. Call it from the merchant backend only when the connection supports separate authorization and capture.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/v2/merchants/orders/{order_token}/capture' \
  --header 'Content-Type: application/json' \
  --data @request.json

Void an authorization

POST /merchants/orders/{order_token}/void

Releases an eligible authorization before capture. A successful synchronous request returns HTTP 204 No Content; asynchronous processor flows must still be tracked to their final payment status.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/merchants/orders/{order_token}/void' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'Content-Type: application/json' \
  --data @request.json

Refund a payment

POST /v2/merchants/orders/{order_token}/refund

Creates a full or partial refund for a processed payment.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/v2/merchants/orders/{order_token}/refund' \
  --header 'Content-Type: application/json' \
  --data @request.json

User Network API#

These optional operations support customer identity, reusable addresses, and securely stored payment instruments. They are not deprecated, but they are not prerequisites for Purchase V2. Browser and mobile applications use customer authorization. Trusted merchant backends use the authorization shown for each route in the inventory above.

Authentication

Register a user

POST /users/register

Optionally creates a user that can authenticate and securely reuse customer data and stored payment methods.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/users/register' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Merchant-Id: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

Request an OTP

POST /users/request-code

Sends the one-time code used by the passwordless authentication flow.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/users/request-code' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-Id: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

Log in with an OTP

POST /users/login

Exchanges a valid one-time code for a user authorization token.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/users/login' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-Id: MERCHANT_ID' \
  --header 'X-Qa-Api-Key: QA_API_KEY_VALUE' \
  --header 'X-Recaptcha-Token: RECAPTCHA_TOKEN_VALUE' \
  --header 'X-Session-ID: SESSION_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

External authorization

POST /users/external-authorize

Authenticates a user through a merchant-managed identity flow.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/users/external-authorize' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Auth-Message: AUTH_MESSAGE_VALUE' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-Id: MERCHANT_ID'

Users

GET /users/me

Returns the authenticated user profile when the integration uses optional customer accounts.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/users/me' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-Id: MERCHANT_ID'

Addresses

GET /users/{user_id}/addresses

Lists reusable addresses associated with a user. This optional operation is not required before Purchase V2.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/users/{user_id}/addresses' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-Id: MERCHANT_ID'

POST /users/{user_id}/addresses

Optionally saves an address for reuse by an authenticated user. An address can instead be supplied inline in a payment request.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/users/{user_id}/addresses' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-Id: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

PATCH /users/{user_id}/addresses/{address_id}

Updates an existing reusable address. The inventory shows the Bearer authorization and merchant context required by these optional routes.

cURL example
curl --request PATCH \
  --url 'https://api.sandbox.deuna.io/users/{user_id}/addresses/{address_id}' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Device-Id: DEVICE_ID' \
  --header 'X-Merchant-Id: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

Cards

Store a card

POST /v2/users/{user_id}/cards

Tokenizes and stores one or more cards for later use. The request body is a JSON array, including when it contains only one card. Call this customer-authorized endpoint with the user's Bearer token and the merchant context shown in the generated inventory.

Raw card data must not pass through merchant servers unless the merchant has the required PCI scope. See the Cards API vaulting flow for the request shape, security boundary, success response, and retry guidance.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/v2/users/{user_id}/cards' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Merchant-ID: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

Which card POST route should I use?

Only POST /v2/users/{user_id}/cards is part of the current external Cards API contract. The other POST routes that can appear in Gateway inventories serve different compatibility or platform purposes; they are not three interchangeable ways to create a card.

RouteWhat it actually doesExternal integration guidance
POST /v2/users/{user_id}/cardsTokenizes and stores one or more customer cards. Its request body is an array, even when it contains one card, and the response returns reusable DEUNA card_id values.Use this route for new customer-authorized Cards API integrations.
POST /users/{user_id}/cardsPreserves the legacy v1 single-card request contract for existing integrations.Compatibility route; it is intentionally excluded from the current external API catalog. Do not start a new integration with it unless DEUNA explicitly directs you to do so.
POST /users/{user_id}/cards/{card_id}/tokensAdds a processor-specific token or verification result to a card that already exists. It does not create a customer card or replace the /v2 vaulting operation.Platform-managed operation; it is intentionally excluded from external documentation and must not be called directly unless DEUNA approves the flow and contract.

:::info Why a route can exist without appearing here The API Gateway inventory includes compatibility and platform-operated routes as well as public merchant contracts. Presence in the Gateway does not by itself make an operation a supported external API. The catalog publishes only operations that are already part of the external reference or have explicit approval from the owning team. :::

List stored cards

GET /users/{user_id}/cards

Returns the cards associated with the authenticated user.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/users/{user_id}/cards' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Merchant-ID: MERCHANT_ID'

Retrieve a stored card

GET /users/{user_id}/cards/{card_id}

Returns one card associated with the authenticated user.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/users/{user_id}/cards/{card_id}' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN'

Set a card as default

PATCH /users/{user_id}/cards/{card_id}/set-as-default

Sets or removes the selected stored card as the authenticated user's default. When a card becomes the default, DEUNA removes the default status from the user's other cards. See Set a card as default for the optional request body, response, and verification steps.

cURL example
curl --request PATCH \
  --url 'https://api.sandbox.deuna.io/users/{user_id}/cards/{card_id}/set-as-default' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'X-Merchant-ID: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

Get card BIN information

GET /cards/bin/{bin}

Returns card network, issuer, and type metadata for a six-digit BIN.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/cards/bin/{bin}' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Merchant-Id: MERCHANT_ID'

Merchant API#

Themes API

The Themes API is supported and is not deprecated. It manages named, merchant-scoped JSON configurations that can be applied to DEUNA Checkout and Widget experiences. Call these operations only from a trusted merchant backend with the private X-Api-Key; the Checkout Configuration service derives the merchant scope from that credential.

Theme resource

FieldReturnedCreateUpdateDescription
idYesGeneratedPath parameterTheme UUID generated by DEUNA. Use it as theme_id for update and delete.
nameYesRequiredOptional when config is suppliedMerchant-unique name containing letters, numbers, or underscores.
configYesRequiredOptional when name is suppliedJSON object containing the theme configuration consumed by the Checkout or Widget experience.

The create operation rejects duplicate names and enforces the Checkout Configuration service's maximum theme count. Update and delete return an error when theme_id does not belong to an existing theme in the merchant configuration.

curl --request POST \
  --url 'https://api.sandbox.deuna.io/merchants/checkout/themes' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "checkout_default",
    "config": {
      "theme": {
        "mainColor": "#1479A8",
        "secondaryColor": "#111827",
        "backgroundColor": "#FFFFFF"
      }
    }
  }'
ThemeJSON
{
  "id": "bfcabe59-48c9-4c36-b041-71597478689c",
  "name": "checkout_default",
  "config": {
    "theme": {
      "mainColor": "#1479A8",
      "secondaryColor": "#111827",
      "backgroundColor": "#FFFFFF"
    }
  }
}

The list operation returns the same resource shape in data[]. Create and update return the affected theme. Delete succeeds with an empty response.

:::note Theme configuration schema The service validates that config is a JSON object but does not validate its nested keys. Use the configuration shape supported by the Checkout or Widget version that will consume the theme. Do not assume that a Themes API config object and an SDK CustomStyle object are interchangeable. :::

Payment methods

GET /merchants/stores/payments-methods

Returns the payment methods enabled for a store. Pass the store code in the required X-Store-Code header.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/merchants/stores/payments-methods' \
  --header 'X-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Idempotency-Key: IDEMPOTENCY_KEY' \
  --header 'X-Merchant-Id: MERCHANT_ID' \
  --header 'X-Prediction-Id: PREDICTION_ID_VALUE' \
  --header 'X-Store-Code: STORE_CODE'

POST /merchants/payment-links

Creates a payment link from a trusted merchant backend.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/merchants/payment-links' \
  --header 'Content-Type: application/json' \
  --data @request.json

GET /merchants/payment-links/{payment_link_id}

Retrieves a payment link and its current state.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/merchants/payment-links/{payment_link_id}'

GET /merchants/payment-links/all

Lists the payment links associated with the authenticated merchant store.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/merchants/payment-links/all'

GET /merchants/payment-links/{payment_link_id}/orders

Lists the orders associated with a payment link.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/merchants/payment-links/{payment_link_id}/orders'

See the Payment Links integration guide for the end-to-end flow.

Subscriptions API#

Plans

GET /subscriptions/plans

Lists subscription plans available to the authenticated merchant.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/subscriptions/plans' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'x-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Merchant-ID: MERCHANT_ID'

POST /subscriptions/plans

Creates a subscription plan.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/subscriptions/plans' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'x-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Merchant-ID: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

Subscriptions

List subscriptions

GET /subscriptions

Returns subscriptions available to the authenticated merchant.

cURL example
curl --request GET \
  --url 'https://api.sandbox.deuna.io/subscriptions' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'x-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Merchant-ID: MERCHANT_ID'

Create a subscription

POST /subscriptions

Creates a subscription using an existing plan and payment method.

cURL example
curl --request POST \
  --url 'https://api.sandbox.deuna.io/subscriptions' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'x-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Merchant-ID: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json

Update a subscription

PATCH /subscriptions/{id}

Updates an active subscription’s supported attributes.

cURL example
curl --request PATCH \
  --url 'https://api.sandbox.deuna.io/subscriptions/{id}' \
  --header 'Authorization: Bearer USER_ACCESS_TOKEN' \
  --header 'x-Api-Key: YOUR_PRIVATE_API_KEY' \
  --header 'X-Merchant-ID: MERCHANT_ID' \
  --header 'Content-Type: application/json' \
  --data @request.json