affiliations

Version 0.1.09 operations

Affiliations of the organisation with masked credentials

GET/organisations/{organisationId}/affiliationsAPI key

Parameters

organisationIdstringpathrequired

Responses

200
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required

Code samples

curl -X GET "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations" \
  -H "x-api-key: $KONNECT_API_KEY"

Example: 200

[
  {
    "id": "id",
    "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
    "provider": "clictopay",
    "providerName": "ClicToPay",
    "label": "default",
    "environment": "sandbox",
    "status": "draft",
    "publicIdentifier": "publicIdentifier",
    "credentials": {},
    "credentialVersion": 1,
    "verifiedAt": "2026-10-01T09:30:00.000Z",
    "lastUsedAt": "2026-10-01T09:30:00.000Z",
    "lastVerificationError": "lastVerificationError",
    "revokedAt": "2026-10-01T09:30:00.000Z",
    "paymentAccounts": [
      {
        "id": "id",
        "name": "name",
        "status": "active"
      }
    ],
    "createdAt": "2026-10-01T09:30:00.000Z",
    "updatedAt": "2026-10-01T09:30:00.000Z"
  }
]

Add provider credentials: validated, encrypted, then verified through the connector

POST/organisations/{organisationId}/affiliationsAPI key

Ends active with a publicIdentifier when the provider accepts the credentials, stays verifying with a readable lastVerificationError otherwise. Sessions need a re-authentication in the last 10 minutes (403 reauth_required).

Parameters

organisationIdstringpathrequired

Request body application/json

providerstringrequired
- enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
labelstring
Lowercase letters, digits, - and _; unique per organisation and provider
environmentstringrequired
- enum: "sandbox", "production"
credentialsobjectrequired
One value per field of the provider credentialSchema (GET /providers/:code)

Responses

201
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required
400invalid_credentials (with the field names) or provider_not_available
403reauth_required or permission_denied
409affiliation_label_taken

Code samples

curl -X POST "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations" \
  -H "x-api-key: $KONNECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "provider": "clictopay",
  "label": "default",
  "environment": "sandbox",
  "credentials": {}
}'

Example: request body

{
  "provider": "clictopay",
  "label": "default",
  "environment": "sandbox",
  "credentials": {}
}

Example: 201

{
  "id": "id",
  "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
  "provider": "clictopay",
  "providerName": "ClicToPay",
  "label": "default",
  "environment": "sandbox",
  "status": "draft",
  "publicIdentifier": "publicIdentifier",
  "credentials": {},
  "credentialVersion": 1,
  "verifiedAt": "2026-10-01T09:30:00.000Z",
  "lastUsedAt": "2026-10-01T09:30:00.000Z",
  "lastVerificationError": "lastVerificationError",
  "revokedAt": "2026-10-01T09:30:00.000Z",
  "paymentAccounts": [
    {
      "id": "id",
      "name": "name",
      "status": "active"
    }
  ],
  "createdAt": "2026-10-01T09:30:00.000Z",
  "updatedAt": "2026-10-01T09:30:00.000Z"
}

One affiliation with masked credentials

GET/organisations/{organisationId}/affiliations/{affiliationId}API key

Parameters

organisationIdstringpathrequired
affiliationIdstringpathrequired

Responses

200
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required

Code samples

curl -X GET "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations/affiliationId" \
  -H "x-api-key: $KONNECT_API_KEY"

Example: 200

{
  "id": "id",
  "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
  "provider": "clictopay",
  "providerName": "ClicToPay",
  "label": "default",
  "environment": "sandbox",
  "status": "draft",
  "publicIdentifier": "publicIdentifier",
  "credentials": {},
  "credentialVersion": 1,
  "verifiedAt": "2026-10-01T09:30:00.000Z",
  "lastUsedAt": "2026-10-01T09:30:00.000Z",
  "lastVerificationError": "lastVerificationError",
  "revokedAt": "2026-10-01T09:30:00.000Z",
  "paymentAccounts": [
    {
      "id": "id",
      "name": "name",
      "status": "active"
    }
  ],
  "createdAt": "2026-10-01T09:30:00.000Z",
  "updatedAt": "2026-10-01T09:30:00.000Z"
}

Run the credential check again

POST/organisations/{organisationId}/affiliations/{affiliationId}/verifyAPI key

Parameters

organisationIdstringpathrequired
affiliationIdstringpathrequired

Responses

200
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required
409affiliation_revoked or invalid_transition

Code samples

curl -X POST "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations/affiliationId/verify" \
  -H "x-api-key: $KONNECT_API_KEY"

Example: 200

{
  "id": "id",
  "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
  "provider": "clictopay",
  "providerName": "ClicToPay",
  "label": "default",
  "environment": "sandbox",
  "status": "draft",
  "publicIdentifier": "publicIdentifier",
  "credentials": {},
  "credentialVersion": 1,
  "verifiedAt": "2026-10-01T09:30:00.000Z",
  "lastUsedAt": "2026-10-01T09:30:00.000Z",
  "lastVerificationError": "lastVerificationError",
  "revokedAt": "2026-10-01T09:30:00.000Z",
  "paymentAccounts": [
    {
      "id": "id",
      "name": "name",
      "status": "active"
    }
  ],
  "createdAt": "2026-10-01T09:30:00.000Z",
  "updatedAt": "2026-10-01T09:30:00.000Z"
}

Replace the credentials (rotation): the previous version stays until the new one verifies

PUT/organisations/{organisationId}/affiliations/{affiliationId}/credentialsAPI key

Parameters

organisationIdstringpathrequired
affiliationIdstringpathrequired

Request body application/json

credentialsobjectrequired
The replacement credentials, one value per field of the credentialSchema

Responses

200
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required
403reauth_required or permission_denied
422credentials_rejected: the provider refused the new credentials, the current ones stay
- errorstringrequired
- reasonstringrequired
  Readable reason from the connector, never a secret

Code samples

curl -X PUT "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations/affiliationId/credentials" \
  -H "x-api-key: $KONNECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "credentials": {}
}'

Example: request body

{
  "credentials": {}
}

Example: 200

{
  "id": "id",
  "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
  "provider": "clictopay",
  "providerName": "ClicToPay",
  "label": "default",
  "environment": "sandbox",
  "status": "draft",
  "publicIdentifier": "publicIdentifier",
  "credentials": {},
  "credentialVersion": 1,
  "verifiedAt": "2026-10-01T09:30:00.000Z",
  "lastUsedAt": "2026-10-01T09:30:00.000Z",
  "lastVerificationError": "lastVerificationError",
  "revokedAt": "2026-10-01T09:30:00.000Z",
  "paymentAccounts": [
    {
      "id": "id",
      "name": "name",
      "status": "active"
    }
  ],
  "createdAt": "2026-10-01T09:30:00.000Z",
  "updatedAt": "2026-10-01T09:30:00.000Z"
}

Example: 422

{
  "error": "credentials_rejected",
  "reason": "reason"
}

Suspend an active affiliation

POST/organisations/{organisationId}/affiliations/{affiliationId}/suspendAPI key

Parameters

organisationIdstringpathrequired
affiliationIdstringpathrequired

Responses

200
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required
409invalid_transition

Code samples

curl -X POST "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations/affiliationId/suspend" \
  -H "x-api-key: $KONNECT_API_KEY"

Example: 200

{
  "id": "id",
  "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
  "provider": "clictopay",
  "providerName": "ClicToPay",
  "label": "default",
  "environment": "sandbox",
  "status": "draft",
  "publicIdentifier": "publicIdentifier",
  "credentials": {},
  "credentialVersion": 1,
  "verifiedAt": "2026-10-01T09:30:00.000Z",
  "lastUsedAt": "2026-10-01T09:30:00.000Z",
  "lastVerificationError": "lastVerificationError",
  "revokedAt": "2026-10-01T09:30:00.000Z",
  "paymentAccounts": [
    {
      "id": "id",
      "name": "name",
      "status": "active"
    }
  ],
  "createdAt": "2026-10-01T09:30:00.000Z",
  "updatedAt": "2026-10-01T09:30:00.000Z"
}

Resume a suspended affiliation

POST/organisations/{organisationId}/affiliations/{affiliationId}/resumeAPI key

Parameters

organisationIdstringpathrequired
affiliationIdstringpathrequired

Responses

200
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required
409invalid_transition

Code samples

curl -X POST "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations/affiliationId/resume" \
  -H "x-api-key: $KONNECT_API_KEY"

Example: 200

{
  "id": "id",
  "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
  "provider": "clictopay",
  "providerName": "ClicToPay",
  "label": "default",
  "environment": "sandbox",
  "status": "draft",
  "publicIdentifier": "publicIdentifier",
  "credentials": {},
  "credentialVersion": 1,
  "verifiedAt": "2026-10-01T09:30:00.000Z",
  "lastUsedAt": "2026-10-01T09:30:00.000Z",
  "lastVerificationError": "lastVerificationError",
  "revokedAt": "2026-10-01T09:30:00.000Z",
  "paymentAccounts": [
    {
      "id": "id",
      "name": "name",
      "status": "active"
    }
  ],
  "createdAt": "2026-10-01T09:30:00.000Z",
  "updatedAt": "2026-10-01T09:30:00.000Z"
}

Revoke (terminal): the row stays, the credentials and their data keys are destroyed

POST/organisations/{organisationId}/affiliations/{affiliationId}/revokeAPI key

Parameters

organisationIdstringpathrequired
affiliationIdstringpathrequired

Responses

200
- idstring (uuid)required
- organisationIdstring (uuid)required
- providerstringrequired
  - enum: "clictopay", "flouci", "izi", "mpgs_poste", "pluxee", "kashy", "enda_tao"
- providerNamestringrequired
- labelstringrequired
- environmentstringrequired
  - enum: "sandbox", "production"
- statusstringrequired
  - enum: "draft", "verifying", "active", "suspended", "revoked"
- publicIdentifierstring | nullrequired
  Never a secret
- credentialsobjectrequired
  Non-secret fields in full, secret fields as **** plus their last four characters; never a value usable at the provider
- credentialVersionnumberrequired
  Current credential version, 1 for the first credentials
- verifiedAtstring (date-time) | nullrequired
- lastUsedAtstring (date-time) | nullrequired
- lastVerificationErrorstring | nullrequired
  Readable, never a secret
- revokedAtstring (date-time) | nullrequired
- paymentAccountsRoutedPaymentAccountDto[]required
  Payment accounts whose routing uses this affiliation; they lose it on revoke
  - idstring (uuid)required
  - namestringrequired
  - statusstringrequired
    - enum: "active", "paused", "archived"
- createdAtstring (date-time)required
- updatedAtstring (date-time)required
409affiliation_revoked

Code samples

curl -X POST "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations/affiliationId/revoke" \
  -H "x-api-key: $KONNECT_API_KEY"

Example: 200

{
  "id": "id",
  "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
  "provider": "clictopay",
  "providerName": "ClicToPay",
  "label": "default",
  "environment": "sandbox",
  "status": "draft",
  "publicIdentifier": "publicIdentifier",
  "credentials": {},
  "credentialVersion": 1,
  "verifiedAt": "2026-10-01T09:30:00.000Z",
  "lastUsedAt": "2026-10-01T09:30:00.000Z",
  "lastVerificationError": "lastVerificationError",
  "revokedAt": "2026-10-01T09:30:00.000Z",
  "paymentAccounts": [
    {
      "id": "id",
      "name": "name",
      "status": "active"
    }
  ],
  "createdAt": "2026-10-01T09:30:00.000Z",
  "updatedAt": "2026-10-01T09:30:00.000Z"
}

Audit events of one affiliation, newest first (the owner and Konnect support)

GET/organisations/{organisationId}/affiliations/{affiliationId}/auditDashboard session

Parameters

organisationIdstringpathrequired
affiliationIdstringpathrequired
cursoranyquery
limitintegerquery
- max: 200
- default: 50
actionanyquery

Responses

200
- itemsAffiliationAuditEventDto[]required
  - idstring (uuid)required
  - actorUserIdstring (uuid) | null
  - organisationIdstring (uuid) | null
  - affiliationIdstring (uuid) | null
  - actionstringrequired
  - ipstring | null
  - detailsobjectrequired
  - createdAtstring (date-time)required
- nextCursorstring | nullrequired

Code samples

curl -X GET "$KONNECT_API_URL/organisations/org_01J9Z3K4EXAMPLE0000000000/affiliations/affiliationId/audit" \
  -H "Cookie: konnect_session=$KONNECT_SESSION"

Example: 200

{
  "items": [
    {
      "id": "id",
      "actorUserId": "actorUserId",
      "organisationId": "org_01J9Z3K4EXAMPLE0000000000",
      "affiliationId": "affiliationId",
      "action": "affiliation.credentials_read",
      "ip": "ip",
      "details": {},
      "createdAt": "2026-10-01T09:30:00.000Z"
    }
  ],
  "nextCursor": "nextCursor"
}