Get started with Enterprise

An Enterprise workspace is where your company runs B2B milestone deals: funding, evidence, approvals and payouts, with your whole team in one place. This guide takes you from nothing to a working workspace in Sandbox with your team invited. It takes about ten minutes.

You need:

• an email address for the first owner of the workspace
• the legal name of the company and its NIB (13 digits, from OSS). A foreign company uses its home registration number and its country instead

1. Create an account and verify the email

In the dashboard

1. Open enterprise.rekberpay.com/register. You can also use rekberpay.com/enterprise/register.
2. Signed out, the page is the normal RekberPay sign-up. Create the account with the email you want to own the workspace. If you already have a RekberPay account, sign in instead.
3. Open the verification link RekberPay sends to that email. Until you do, the dashboard shows a banner asking you to verify, and creating a workspace or accepting an invite is refused with 403 EMAIL_NOT_VERIFIED.
4. No email? Use the resend button on the banner (Kirim ulang email). You can send it again after 60 seconds.

Only accounts created by email sign-up need this step. An account that signed in another way has nothing to verify.

2. Create the workspace

In the dashboard

1. Signed in and verified, the register page shows Company details.
2. Fill in the form:

Field	What to enter
Legal name	The name on the deed or registration certificate
Workspace name	The name your team sees. Leave it empty to use the legal name without PT, CV and similar
Type of business	PT, PT Perorangan, CV, Firma, Koperasi, UD or sole proprietor, or Foreign company
NIB	13 digits from OSS. A foreign company enters its company registration number and the country it is registered in

3. Complete the security check if one is shown, then create the workspace.

You land on Verify your business and you are the workspace owner. The workspace opens in Sandbox, and Live stays locked until your business is verified. Nothing else is needed to start testing.

With the API

Creating a workspace needs a dashboard session. A personal or workspace API key is refused with 403 KEY_NOT_ALLOWED.

curl -X POST https://api.rekberpay.com/v1/enterprise/register \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "legal_name": "PT Sinar Laut Logistik",
    "display_name": "Sinar Laut Logistik",
    "entity_type": "pt",
    "nib": "1234567890123",
    "country_code": "ID"
  }'

201 Created

{
    "success": true,
    "data": {
        "account": {
            "id": "2f6c1d7a-5b1e-4c3a-9d0e-7a8b9c0d1e2f",
            "legal_name": "PT Sinar Laut Logistik",
            "display_name": "Sinar Laut Logistik",
            "country_code": "ID",
            "kyb_status": "not_started",
            "risk_tier": "standard",
            "is_sandbox": true
        },
        "membership": {
            "id": "3a7d2e8b-6c2f-4d4b-8e1f-8b9c0d1e2f3a",
            "role": "owner"
        },
        "kyb_application": {
            "id": "4b8e3f9c-7d3a-4e5c-9f2a-9c0d1e2f3a4b",
            "version": 1,
            "status": "draft"
        }
    }
}

Limits to know:

• One person can own up to 3 workspaces. The next one answers 409 WORKSPACE_LIMIT. Contact RekberPay if you need more.
• A foreign company needs country_code other than ID. An Indonesian entity must use ID.
• When the security check is switched on, the body also carries the check's token as turnstile_token. Without it the call answers 403 TURNSTILE_FAILED.
• Sign-ups are rate limited per IP and per user. A 429 carries Retry-After.

Every later call carries the workspace. With a workspace API key it is fixed by the key. With a session or a personal key, send the workspace ID in the X-Enterprise-Account header, or leave it out to use the first workspace you joined.

3. Know what Sandbox and Live do

Every workspace has two modes: Sandbox with test money and Live with real money. Sandbox is a full copy of the workflow. Use it to learn the screens and to build your integration before anything is real.

In Sandbox	What it means
Funding	You record funding yourself with Record funding. No bank or gateway is involved
Payouts	A release settles on the spot as test data. Nothing reaches RekberPay operations
Payout instructions	Verified at once, but only usable for test payouts
Deals	Every deal you create is a test deal and keeps the Test deal label forever
Invites	Sent as in Live, in the dashboard and by email
Other emails	Go to workspace members only, tagged [Sandbox]. A counterparty never gets a test email
API keys and webhooks	Each mode has its own: rpe_test_ keys and Sandbox endpoints. Webhook deliveries carry livemode: false
Linking a partner	A link serves both modes. In Sandbox you see and act on test deals only
Fees	Shown as in Live. No real fee is collected

The Sandbox and Live switch sits next to the workspace name in the top bar. Settings, Workspace status shows whether Live is unlocked.

Live opens when RekberPay approves your business verification. Nothing in Sandbox is cancelled or removed: your test deals, keys and webhook endpoints stay, and you switch between the two modes whenever you like. Members, counterparties, templates and settings are shared by both modes; deals, balances, API keys and webhooks belong to one. Verify your business explains the review and how to prepare for Live.

4. Invite your team

Approvals work best with more than one person. Invite at least one colleague who can approve evidence and release money.

The person you invite needs a RekberPay account with a verified email. They do not need to be in any workspace yet. The invite also arrives by email, before Live is unlocked too.

In the dashboard

1. Open Team and choose Invite member.
2. Enter their email and choose a role (see the table below).
3. Choose Send invite.
4. RekberPay always answers the same way: "If that email has a RekberPay account, they will see the invite in their workspace list." It does not confirm whether the email has an account.
5. The invitee opens enterprise.rekberpay.com. The invite shows in the workspace menu in the top bar under Invitations, with an Accept button. A person with no workspace sees it on the welcome page, with Accept invite.
6. After they accept, the member shows in the Team table with their join date. Until then the invite sits in the Pending invites card under the table, with the role and the date it was sent. The table lists only people who have joined.

If the invite does not arrive. The form gives the same answer for every address, so it never tells you whether the email has an account. If nothing shows up for the person, check three things: the address is the one on their RekberPay account, they verified that email, and they are not already a member. Then choose Resend on the invite in Pending invites. The notice goes out again, with an email, and a message says "Invite sent again to" their address. An invite can be sent again once every 10 minutes. Only an owner can resend an owner invite.

To change a role, use the role selector on the member's row. To remove someone, choose Remove. To withdraw an invite that was not accepted, choose Cancel invite on it in Pending invites. Removing a member also revokes the workspace API keys they created, for good: inviting them again does not bring those keys back.

With the API

Members are managed from a dashboard session. A workspace API key can list members but cannot change them.

curl -X POST https://api.rekberpay.com/v1/enterprise/members \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "role": "finance" }'

202 Accepted

{
    "success": true,
    "message": "If that email has a RekberPay account, they will see the invite in their workspace list.",
    "data": {
        "queued": true,
        "email": "[email protected]"
    }
}

List members with GET /v1/enterprise/members, change a role with PATCH /v1/enterprise/members/:id and a body of { "role": "admin" }, and remove a member with DELETE /v1/enterprise/members/:id. All of these need the admin role. An invited member has status: "invited" in the list.

Send a pending invite again with POST /v1/enterprise/members/:id/resend-invite, from a dashboard session as an admin. It sends the email before it answers { "id": "...", "status": "invited", "email_sent": true }. These cases are refused:

Status	Code	Cause
404	NOT_FOUND	The invite was accepted or cancelled
403	FORBIDDEN	An owner invite resent by someone who is not an owner
429	RESEND_TOO_SOON	The invite was sent in the last 10 minutes. Retry-After gives the seconds left
502	EMAIL_NOT_SENT	The mail relay did not take the email. The 10 minute wait is cleared, so resend at once

Rules the API enforces:

• Only an owner can grant, change or remove the owner role (403 FORBIDDEN).
• A workspace always keeps at least one active owner. Removing or demoting the last one answers 409 LAST_OWNER.
• An admin can give any role except owner.

5. Choose roles

Each role includes everything the roles below it can do.

Role	Can do	Typical person
viewer	Read deals, approvals, payouts, documents and the activity feed. Change nothing	Auditor, management
operator	Create and edit deals, milestones, counterparties, documents, notes and templates. Deliver a milestone. Open disputes	Procurement, project manager
finance	Fund (sandbox) or pay (live) milestones, approve or reject evidence, release money, manage payout instructions, accept or counter a fee split, export reports	Finance staff
admin	Invite and remove members, change settings and the approval policy, submit the business verification, manage API keys and webhooks, link and unlink partner workspaces	Head of finance, IT
owner	Everything an admin can, plus granting the owner role and setting the default fee split	Director

Two rules to remember:

• The person who delivered the milestone can never approve it, and two different people approve a large milestone. See Four-eyes approvals.
• A workspace API key acts as the admin who created it, so one key counts as one person. Give each approver their own login.

Next steps

1. Verify your business so Live unlocks.
2. Run a deal in Sandbox, then in Live.
3. Link a partner workspace if the other company also uses RekberPay Enterprise.
4. Enterprise quickstart for the same flow as one API script.
5. Running a marketplace? Ask for Platform mode (PaaS): your buyers and sellers get RekberPay accounts through the API and pay through a RekberPay checkout. Sandbox has it before business verification. Not sure whether you need it? See Which part do I use?. To try it, the sandbox walkthrough pays, ships, releases and withdraws with test money using four sandbox shortcuts.