API

Appearance

Enterprise workspace ​

A workspace is one company account. These endpoints cover who is in it, its settings and the companies you trade with (counterparties). Member and settings changes are dashboard actions: API keys can read them but get 403 KEY_NOT_ALLOWED on writes. Auth, roles, the workspace header and the shared limits are explained in Enterprise overview.

Endpoints ​

MethodPathEndpointAuth
GET/v1/enterprise/meGet the current workspaceAny signed-in user, dashboard only
POST/v1/enterprise/invites/:memberId/acceptAccept an inviteAny signed-in user, dashboard only
GET/v1/enterprise/membersList membersviewer
POST/v1/enterprise/membersInvite a memberadmin, dashboard only
PATCH/v1/enterprise/members/:idChange a member's roleadmin, dashboard only
DELETE/v1/enterprise/members/:idRemove a memberadmin, dashboard only
PATCH/v1/enterprise/members/me/preferencesUpdate your notification togglesviewer, dashboard only
GET/v1/enterprise/settingsGet workspace settingsviewer
PATCH/v1/enterprise/settingsChange workspace settingsadmin, dashboard only
GET/v1/enterprise/notificationsList workspace notificationsviewer, dashboard only
POST/v1/enterprise/notifications/readMark workspace notifications readviewer, dashboard only
GET/v1/enterprise/counterpartiesList counterpartiesviewer
POST/v1/enterprise/counterpartiesAdd a counterpartyoperator
PATCH/v1/enterprise/counterparties/:idUpdate a counterpartyoperator

Get the current workspace ​

GET/v1/enterprise/me

The workspace picked by X-Enterprise-Account (or the first one you joined), your membership and notification toggles, every workspace you belong to and any pending invites. It works for users with no workspace yet, so it is the right first call after sign-in.

  • Auth: Dashboard session of any signed-in user, no workspace needed. API keys get 403 KEY_NOT_ALLOWED.
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not needed. Reading has no side effects.

Example request ​

bash
curl https://api.rekberpay.com/v1/enterprise/me \
  -b cookies.txt \
  -H "X-Enterprise-Account: $WORKSPACE_ID"
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/me', {
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
    },
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.get(
    "https://api.rekberpay.com/v1/enterprise/me",
    headers={
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/me');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
    ],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "account": {
            "id": "fffffff2-ffff-4fff-8fff-ffffffffffff",
            "display_name": "Northline Trading",
            "legal_name": "PT Northline Trading Indonesia",
            "country_code": "ID",
            "kyb_status": "verified",
            "risk_tier": "standard",
            "is_sandbox": true,
            "settings": {
                "four_eyes_threshold": 100000000,
                "dispute_sla_hours": 24,
                "watchlist": [
                    "Blacklisted Supplier"
                ],
                "account_manager": {
                    "name": "Maya Patel",
                    "email": "[email protected]"
                }
            }
        },
        "membership": {
            "id": "11111113-1111-4111-8111-111111111111",
            "role": "finance",
            "joined_at": "2026-09-29T15:03:06.162Z",
            "notify": {
                "email": true,
                "approvals": true,
                "money": true,
                "reminders": true
            }
        },
        "memberships": [
            {
                "account_id": "fffffff2-ffff-4fff-8fff-ffffffffffff",
                "display_name": "Northline Trading",
                "role": "finance"
            }
        ],
        "invites": []
    }
}
FieldTypeDescription
accountobject | nullThe current workspace, with is_sandbox and settings
membershipobject | nullYour role, joined_at and notify toggles here
membershipsarrayEvery workspace you are an active member of
invitesarrayPending invites: member_id, display_name, role, invited_by_name

Errors ​

StatusCodeCause
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Accept an invite ​

POST/v1/enterprise/invites/:memberId/accept

Accepts a pending invite addressed to you. Take member_id from invites in Get the current workspace. You become an active member with the invited role.

  • Auth: Dashboard session of any signed-in user, no workspace needed. API keys get 403 KEY_NOT_ALLOWED.
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not supported. A retry runs the call again.

Path parameters ​

NameTypeDescription
memberIdUUIDThe member_id of the invite

Example request ​

bash
curl -X POST https://api.rekberpay.com/v1/enterprise/invites/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa/accept \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{}'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/invites/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa/accept', {
    method: 'POST',
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-CSRF-Token': process.env.REKBERPAY_CSRF_TOKEN,
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({}),
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.post(
    "https://api.rekberpay.com/v1/enterprise/invites/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa/accept",
    headers={
        "X-CSRF-Token": os.environ["REKBERPAY_CSRF_TOKEN"],
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    json={},
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/invites/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa/accept');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-CSRF-Token: ' . getenv('REKBERPAY_CSRF_TOKEN'),
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode(new stdClass()),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "member_id": "aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
        "account_id": "fffffff2-ffff-4fff-8fff-ffffffffffff",
        "role": "viewer"
    }
}

Errors ​

StatusCodeCause
404NOT_FOUNDNo pending invite with this ID for you
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

List members ​

GET/v1/enterprise/members

Members of the workspace, owners first. Removed members are left out. status is invited, active or suspended.

  • Auth: A workspace API key (Authorization: Bearer rpe_...), a personal API key or a dashboard session.
  • Role: Any workspace member (viewer and up).
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not needed. Reading has no side effects.

Query parameters ​

NameTypeRequiredDescription
pageintegerNoDefault 1
limitintegerNo1 to 50. Default 20

Example request ​

bash
curl "https://api.rekberpay.com/v1/enterprise/members?limit=2" \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY"
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/members?limit=2', {
    headers: {
        Authorization: `Bearer ${process.env.REKBERPAY_WORKSPACE_KEY}`,
    },
});
const data = await res.json();
python
import os

import requests

resp = requests.get(
    "https://api.rekberpay.com/v1/enterprise/members?limit=2",
    headers={
        "Authorization": f"Bearer {os.environ['REKBERPAY_WORKSPACE_KEY']}",
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/members?limit=2');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('REKBERPAY_WORKSPACE_KEY'),
    ],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": [
        {
            "id": "77777773-7777-4777-8777-777777777777",
            "user": {
                "id": "88888883-8888-4888-8888-888888888888",
                "email": "[email protected]",
                "full_name": "Alex Pratama"
            },
            "role": "owner",
            "status": "active",
            "joined_at": "2026-09-29T13:33:06.162Z",
            "created_at": "2026-09-29T13:33:06.162Z"
        },
        {
            "id": "99999993-9999-4999-8999-999999999999",
            "user": {
                "id": "33333333-3333-4333-8333-333333333333",
                "email": "[email protected]",
                "full_name": "Dimas Hidayat"
            },
            "role": "admin",
            "status": "active",
            "joined_at": "2026-09-29T14:33:06.162Z",
            "created_at": "2026-09-29T14:33:06.162Z"
        }
    ],
    "pagination": {
        "page": 1,
        "limit": 2,
        "total": 5,
        "total_pages": 3
    }
}

Errors ​

StatusCodeCause
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Invite a member ​

POST/v1/enterprise/members

Invites a RekberPay user by email. The answer is always 202 with the same body, whether or not the email has an account, so the call cannot be used to find out who uses RekberPay. The invite is created (and member.invited recorded) only when the email belongs to an active account that is not yours and not already in the workspace. The person accepts it from their own session. Only an owner can invite another owner.

  • Auth: Dashboard session only. API keys, workspace or personal, get 403 KEY_NOT_ALLOWED.
  • Role: admin or owner.
  • Rate limit: 30 a minute per user for this route, plus the shared 300 a minute.
  • Idempotency: Not supported. A retry runs the call again.

Body (JSON) ​

NameTypeRequiredDescription
emailstringYesEmail of a RekberPay account
rolestringYesowner, admin, finance, operator or viewer

Example request ​

bash
curl -X POST https://api.rekberpay.com/v1/enterprise/members \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "role": "viewer"
  }'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/members', {
    method: 'POST',
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-CSRF-Token': process.env.REKBERPAY_CSRF_TOKEN,
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        email: "[email protected]",
        role: "viewer"
    }),
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.post(
    "https://api.rekberpay.com/v1/enterprise/members",
    headers={
        "X-CSRF-Token": os.environ["REKBERPAY_CSRF_TOKEN"],
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    json={
        "email": "[email protected]",
        "role": "viewer",
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/members');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-CSRF-Token: ' . getenv('REKBERPAY_CSRF_TOKEN'),
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'email' => '[email protected]',
        'role' => 'viewer',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

202 Accepted

json
{
    "success": true,
    "message": "If that email has a RekberPay account, they will see the invite in their workspace list.",
    "data": {
        "queued": true,
        "email": "[email protected]"
    }
}

Errors ​

StatusCodeCause
400INVALID_BODYEmail or role missing or not valid
403FORBIDDENOnly an owner can grant the owner role
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403FORBIDDENYour role is below admin
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Change a member's role ​

PATCH/v1/enterprise/members/:id

Sets a new role. Only an owner can change an owner or make someone an owner, and the workspace always keeps at least one active owner.

  • Auth: Dashboard session only. API keys, workspace or personal, get 403 KEY_NOT_ALLOWED.
  • Role: admin or owner.
  • Rate limit: 30 a minute per user for this route, plus the shared 300 a minute.
  • Idempotency: Not supported. A retry runs the call again.

Path parameters ​

NameTypeDescription
idUUIDThe member ID (not the user ID)

Body (JSON) ​

NameTypeRequiredDescription
rolestringYesowner, admin, finance, operator or viewer

Example request ​

bash
curl -X PATCH https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "role": "operator"
  }'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa', {
    method: 'PATCH',
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-CSRF-Token': process.env.REKBERPAY_CSRF_TOKEN,
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        role: "operator"
    }),
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.patch(
    "https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
    headers={
        "X-CSRF-Token": os.environ["REKBERPAY_CSRF_TOKEN"],
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    json={
        "role": "operator",
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-CSRF-Token: ' . getenv('REKBERPAY_CSRF_TOKEN'),
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'role' => 'operator',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "id": "aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
        "role": "operator"
    }
}

Errors ​

StatusCodeCause
400INVALID_BODYRole missing or not valid
403FORBIDDENOnly an owner can change the owner role
404NOT_FOUNDNo member with this ID
409LAST_OWNERThis would leave the workspace without an active owner
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403FORBIDDENYour role is below admin
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

A real FORBIDDEN answer:

403 Forbidden

json
{
    "success": false,
    "error": {
        "code": "FORBIDDEN",
        "message": "Only an owner can change the owner role"
    }
}

Remove a member ​

DELETE/v1/enterprise/members/:id

Removes the member at once. Workspace API keys that the member created stop working.

  • Auth: Dashboard session only. API keys, workspace or personal, get 403 KEY_NOT_ALLOWED.
  • Role: admin or owner.
  • Rate limit: 30 a minute per user for this route, plus the shared 300 a minute.
  • Idempotency: Not supported. A retry runs the call again.

Path parameters ​

NameTypeDescription
idUUIDThe member ID

Example request ​

bash
curl -X DELETE https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID"
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa', {
    method: 'DELETE',
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-CSRF-Token': process.env.REKBERPAY_CSRF_TOKEN,
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
    },
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.delete(
    "https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
    headers={
        "X-CSRF-Token": os.environ["REKBERPAY_CSRF_TOKEN"],
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/members/aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-CSRF-Token: ' . getenv('REKBERPAY_CSRF_TOKEN'),
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
    ],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "id": "aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
        "status": "removed"
    }
}

Errors ​

StatusCodeCause
403FORBIDDENOnly an owner can remove an owner
404NOT_FOUNDNo member with this ID
409LAST_OWNERThis would leave the workspace without an active owner
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403FORBIDDENYour role is below admin
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Update your notification toggles ​

PATCH/v1/enterprise/members/me/preferences

Your own notification toggles in this workspace. Send only the keys you want to change; a key you never set counts as on.

  • Auth: Dashboard session only. API keys, workspace or personal, get 403 KEY_NOT_ALLOWED.
  • Role: Any workspace member (viewer and up).
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not supported. A retry runs the call again.

Body (JSON) ​

NameTypeRequiredDescription
emailbooleanNoEmail copies of workspace notifications
approvalsbooleanNoApproval requests
moneybooleanNoFunding, release and payout updates
remindersbooleanNoDue date and SLA reminders

Example request ​

bash
curl -X PATCH https://api.rekberpay.com/v1/enterprise/members/me/preferences \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "reminders": false
  }'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/members/me/preferences', {
    method: 'PATCH',
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-CSRF-Token': process.env.REKBERPAY_CSRF_TOKEN,
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        reminders: false
    }),
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.patch(
    "https://api.rekberpay.com/v1/enterprise/members/me/preferences",
    headers={
        "X-CSRF-Token": os.environ["REKBERPAY_CSRF_TOKEN"],
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    json={
        "reminders": False,
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/members/me/preferences');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-CSRF-Token: ' . getenv('REKBERPAY_CSRF_TOKEN'),
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'reminders' => false,
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "notify": {
            "email": true,
            "approvals": true,
            "money": true,
            "reminders": false
        }
    }
}

Errors ​

StatusCodeCause
400INVALID_BODYAn unknown key or a value that is not a boolean
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Get workspace settings ​

GET/v1/enterprise/settings

Names, billing email, KYB status, risk tier, sandbox flag, the approval and dispute settings, and the account manager.

  • Auth: A workspace API key (Authorization: Bearer rpe_...), a personal API key or a dashboard session.
  • Role: Any workspace member (viewer and up).
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not needed. Reading has no side effects.

Example request ​

bash
curl https://api.rekberpay.com/v1/enterprise/settings \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY"
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/settings', {
    headers: {
        Authorization: `Bearer ${process.env.REKBERPAY_WORKSPACE_KEY}`,
    },
});
const data = await res.json();
python
import os

import requests

resp = requests.get(
    "https://api.rekberpay.com/v1/enterprise/settings",
    headers={
        "Authorization": f"Bearer {os.environ['REKBERPAY_WORKSPACE_KEY']}",
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/settings');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('REKBERPAY_WORKSPACE_KEY'),
    ],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "display_name": "Northline Trading",
        "legal_name": "PT Northline Trading Indonesia",
        "billing_email": "[email protected]",
        "kyb_status": "verified",
        "risk_tier": "standard",
        "is_sandbox": true,
        "settings": {
            "four_eyes_threshold": 100000000,
            "dispute_sla_hours": 24,
            "watchlist": [
                "Blacklisted Supplier"
            ],
            "account_manager": {
                "name": "Maya Patel",
                "email": "[email protected]"
            }
        }
    }
}
FieldTypeDescription
settings.four_eyes_thresholdintegerMilestones at or above this amount need two approvals
settings.dispute_sla_hoursintegerOpen disputes older than this raise an alert
settings.watchliststring[]Names that raise an alert when a counterparty or account holder matches

Errors ​

StatusCodeCause
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Change workspace settings ​

PATCH/v1/enterprise/settings

Send any of the fields below. The answer holds the names and the merged settings, and settings.updated is recorded in the event feed.

  • Auth: Dashboard session only. API keys, workspace or personal, get 403 KEY_NOT_ALLOWED.
  • Role: admin or owner.
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not supported. A retry runs the call again.

Body (JSON) ​

NameTypeRequiredDescription
display_namestringNo2 to 120 characters
billing_emailstringNoWhere invoices go
four_eyes_thresholdintegerNo1 or more. Milestones at or above it need two approvals
dispute_sla_hoursintegerNo1 to 168
watchliststring[]NoUp to 50 names, each 2 to 120 characters

Example request ​

bash
curl -X PATCH https://api.rekberpay.com/v1/enterprise/settings \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "dispute_sla_hours": 24,
    "four_eyes_threshold": 100000000
  }'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/settings', {
    method: 'PATCH',
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-CSRF-Token': process.env.REKBERPAY_CSRF_TOKEN,
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        dispute_sla_hours: 24,
        four_eyes_threshold: 100000000
    }),
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.patch(
    "https://api.rekberpay.com/v1/enterprise/settings",
    headers={
        "X-CSRF-Token": os.environ["REKBERPAY_CSRF_TOKEN"],
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    json={
        "dispute_sla_hours": 24,
        "four_eyes_threshold": 100000000,
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/settings');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-CSRF-Token: ' . getenv('REKBERPAY_CSRF_TOKEN'),
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'dispute_sla_hours' => 24,
        'four_eyes_threshold' => 100000000,
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "display_name": "Northline Trading",
        "billing_email": "[email protected]",
        "settings": {
            "four_eyes_threshold": 100000000,
            "dispute_sla_hours": 24,
            "watchlist": [
                "Blacklisted Supplier"
            ],
            "account_manager": {
                "name": "Maya Patel",
                "email": "[email protected]"
            }
        }
    }
}

Errors ​

StatusCodeCause
400INVALID_BODYA field failed validation
404NOT_FOUNDThe workspace no longer exists
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403FORBIDDENYour role is below admin
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

A real FORBIDDEN answer:

403 Forbidden

json
{
    "success": false,
    "error": {
        "code": "FORBIDDEN",
        "message": "Your workspace role does not allow this action"
    }
}

List workspace notifications ​

GET/v1/enterprise/notifications

Your 20 newest notifications for this workspace (the dashboard bell) and the unread count, capped at 100. url is the dashboard page to open.

  • Auth: Dashboard session only. API keys, workspace or personal, get 403 KEY_NOT_ALLOWED.
  • Role: Any workspace member (viewer and up).
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not needed. Reading has no side effects.

Example request ​

bash
curl https://api.rekberpay.com/v1/enterprise/notifications \
  -b cookies.txt \
  -H "X-Enterprise-Account: $WORKSPACE_ID"
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/notifications', {
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
    },
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.get(
    "https://api.rekberpay.com/v1/enterprise/notifications",
    headers={
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/notifications');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
    ],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "items": [],
        "unread_count": 0
    }
}

Errors ​

StatusCodeCause
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Mark workspace notifications read ​

POST/v1/enterprise/notifications/read

Marks the listed notifications read, or all of them (up to 1,000) when ids is left out.

  • Auth: Dashboard session only. API keys, workspace or personal, get 403 KEY_NOT_ALLOWED.
  • Role: Any workspace member (viewer and up).
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not supported. A retry runs the call again.

Body (JSON) ​

NameTypeRequiredDescription
idsUUID[]NoUp to 100 notification IDs

Example request ​

bash
curl -X POST https://api.rekberpay.com/v1/enterprise/notifications/read \
  -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H "X-Enterprise-Account: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d '{}'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/notifications/read', {
    method: 'POST',
    headers: {
        Cookie: process.env.REKBERPAY_SESSION_COOKIE, // '__Host-rekber_session=...' from POST /v1/auth/login
        'X-CSRF-Token': process.env.REKBERPAY_CSRF_TOKEN,
        'X-Enterprise-Account': process.env.WORKSPACE_ID,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({}),
});
const data = await res.json();
python
import os

import requests

session = requests.Session()
# The session cookie from POST /v1/auth/login
session.cookies.set("__Host-rekber_session", os.environ["REKBERPAY_SESSION"], domain="api.rekberpay.com")
resp = session.post(
    "https://api.rekberpay.com/v1/enterprise/notifications/read",
    headers={
        "X-CSRF-Token": os.environ["REKBERPAY_CSRF_TOKEN"],
        "X-Enterprise-Account": os.environ["WORKSPACE_ID"],
    },
    json={},
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/notifications/read');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_HTTPHEADER => [
        'X-CSRF-Token: ' . getenv('REKBERPAY_CSRF_TOKEN'),
        'X-Enterprise-Account: ' . getenv('WORKSPACE_ID'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode(new stdClass()),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true
}

Errors ​

StatusCodeCause
400INVALID_BODYids is not a list of UUIDs, or has more than 100
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403KEY_NOT_ALLOWEDCalled with an API key instead of a dashboard session
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

List counterparties ​

GET/v1/enterprise/counterparties

The companies you trade with, newest first.

  • Auth: A workspace API key (Authorization: Bearer rpe_...), a personal API key or a dashboard session.
  • Role: Any workspace member (viewer and up).
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not needed. Reading has no side effects.

Query parameters ​

NameTypeRequiredDescription
qstringNoName contains
kyb_statusstringNonot_started, pending, verified, rejected or suspended
pageintegerNoDefault 1
limitintegerNo1 to 50. Default 20

Example request ​

bash
curl "https://api.rekberpay.com/v1/enterprise/counterparties?limit=2" \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY"
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/counterparties?limit=2', {
    headers: {
        Authorization: `Bearer ${process.env.REKBERPAY_WORKSPACE_KEY}`,
    },
});
const data = await res.json();
python
import os

import requests

resp = requests.get(
    "https://api.rekberpay.com/v1/enterprise/counterparties?limit=2",
    headers={
        "Authorization": f"Bearer {os.environ['REKBERPAY_WORKSPACE_KEY']}",
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/counterparties?limit=2');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('REKBERPAY_WORKSPACE_KEY'),
    ],
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": [
        {
            "id": "bbbbbbb3-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
            "name": "Straits Packaging Co",
            "country_code": "SG",
            "contact_email": "[email protected]",
            "contact_name": "Grace Lim",
            "relationship": "vendor",
            "kyb_status": "not_started",
            "created_at": "2026-09-30T07:03:06.162Z"
        },
        {
            "id": "ccccccc3-cccc-4ccc-8ccc-cccccccccccc",
            "name": "PT Mitra Retail Jaya",
            "country_code": "ID",
            "contact_email": "[email protected]",
            "contact_name": "Yusuf Firmansyah",
            "relationship": "buyer",
            "kyb_status": "pending",
            "created_at": "2026-09-30T04:33:06.162Z"
        }
    ],
    "pagination": {
        "page": 1,
        "limit": 2,
        "total": 6,
        "total_pages": 3
    }
}

Errors ​

StatusCodeCause
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Add a counterparty ​

POST/v1/enterprise/counterparties

kyb_status starts at not_started. RekberPay sets it after checking the company; the workspace cannot.

  • Auth: A workspace API key (Authorization: Bearer rpe_...), a personal API key or a dashboard session.
  • Role: operator, finance, admin or owner.
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not supported. A retry runs the call again.

Body (JSON) ​

NameTypeRequiredDescription
namestringYes2 to 180 characters
relationshipstringYesbuyer, seller, both, vendor or client
country_codestringNoTwo-letter country code
contact_namestringNo1 to 120 characters
contact_emailstringNoContact email

Example request ​

bash
curl -X POST https://api.rekberpay.com/v1/enterprise/counterparties \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Kestrel Freight Pte Ltd",
    "country_code": "SG",
    "relationship": "vendor",
    "contact_name": "Daniel Tan",
    "contact_email": "[email protected]"
  }'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/counterparties', {
    method: 'POST',
    headers: {
        Authorization: `Bearer ${process.env.REKBERPAY_WORKSPACE_KEY}`,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        name: "Kestrel Freight Pte Ltd",
        country_code: "SG",
        relationship: "vendor",
        contact_name: "Daniel Tan",
        contact_email: "[email protected]"
    }),
});
const data = await res.json();
python
import os

import requests

resp = requests.post(
    "https://api.rekberpay.com/v1/enterprise/counterparties",
    headers={
        "Authorization": f"Bearer {os.environ['REKBERPAY_WORKSPACE_KEY']}",
    },
    json={
        "name": "Kestrel Freight Pte Ltd",
        "country_code": "SG",
        "relationship": "vendor",
        "contact_name": "Daniel Tan",
        "contact_email": "[email protected]",
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/counterparties');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('REKBERPAY_WORKSPACE_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'name' => 'Kestrel Freight Pte Ltd',
        'country_code' => 'SG',
        'relationship' => 'vendor',
        'contact_name' => 'Daniel Tan',
        'contact_email' => '[email protected]',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

201 Created

json
{
    "success": true,
    "data": {
        "id": "ddddddd3-dddd-4ddd-8ddd-dddddddddddd",
        "name": "Kestrel Freight Pte Ltd",
        "country_code": "SG",
        "contact_email": "[email protected]",
        "contact_name": "Daniel Tan",
        "relationship": "vendor",
        "kyb_status": "not_started"
    }
}

Errors ​

StatusCodeCause
400INVALID_BODYA field failed validation
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403FORBIDDENYour role is below operator
403SCOPE_REQUIREDThe workspace key only has the read scope
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Update a counterparty ​

PATCH/v1/enterprise/counterparties/:id

Any of the fields from Add a counterparty.

  • Auth: A workspace API key (Authorization: Bearer rpe_...), a personal API key or a dashboard session.
  • Role: operator, finance, admin or owner.
  • Rate limit: 300 requests a minute per user, shared by every route.
  • Idempotency: Not supported. A retry runs the call again.

Path parameters ​

NameTypeDescription
idUUIDThe counterparty ID

Example request ​

bash
curl -X PATCH https://api.rekberpay.com/v1/enterprise/counterparties/ddddddd3-dddd-4ddd-8ddd-dddddddddddd \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "contact_name": "Daniel Tan Wei"
  }'
js
const res = await fetch('https://api.rekberpay.com/v1/enterprise/counterparties/ddddddd3-dddd-4ddd-8ddd-dddddddddddd', {
    method: 'PATCH',
    headers: {
        Authorization: `Bearer ${process.env.REKBERPAY_WORKSPACE_KEY}`,
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({
        contact_name: "Daniel Tan Wei"
    }),
});
const data = await res.json();
python
import os

import requests

resp = requests.patch(
    "https://api.rekberpay.com/v1/enterprise/counterparties/ddddddd3-dddd-4ddd-8ddd-dddddddddddd",
    headers={
        "Authorization": f"Bearer {os.environ['REKBERPAY_WORKSPACE_KEY']}",
    },
    json={
        "contact_name": "Daniel Tan Wei",
    },
    timeout=30,
)
print(resp.status_code, resp.json())
php
<?php

$ch = curl_init('https://api.rekberpay.com/v1/enterprise/counterparties/ddddddd3-dddd-4ddd-8ddd-dddddddddddd');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('REKBERPAY_WORKSPACE_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'contact_name' => 'Daniel Tan Wei',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Example response ​

200 OK

json
{
    "success": true,
    "data": {
        "id": "ddddddd3-dddd-4ddd-8ddd-dddddddddddd",
        "name": "Kestrel Freight Pte Ltd",
        "country_code": "SG",
        "contact_email": "[email protected]",
        "contact_name": "Daniel Tan Wei",
        "relationship": "vendor",
        "kyb_status": "not_started",
        "created_at": "2026-10-13T14:33:16.281Z"
    }
}

Errors ​

StatusCodeCause
400INVALID_BODYA field failed validation, or the body was empty
404NOT_FOUNDNo counterparty with this ID in the workspace
401UNAUTHORIZED, SESSION_EXPIRED, INVALID_TOKENNo session or key, the session expired, or the key is wrong or revoked
400INVALID_ACCOUNTX-Enterprise-Account is not a UUID
403NO_WORKSPACEYou are not an active member of that workspace, or the key belongs to another one
403FORBIDDENYour role is below operator
403SCOPE_REQUIREDThe workspace key only has the read scope
403CSRF_FAILEDSession call without the matching X-CSRF-Token header
429RATE_LIMITEDOver the rate limit. Wait for Retry-After seconds

Escrow, payment services and B2B deals for Indonesian businesses.

© 2026 RekberPay. All rights reserved.