Route Map

Every endpoint available to you, grouped by the credential that calls it. Detailed request/response documentation lives in the per-endpoint pages of the API Reference — this page is the bird’s-eye map.

​

How authorization works

• Secret API keys (lid_live_*) carry an explicit list of scopes; a request to an endpoint whose scope the key lacks fails with 403.
• Dashboard sessions carry a role plus per-user team permissions; sensitive actions additionally require a fresh MFA factor (passkey, TOTP code, or emailed code) in the request body.
• Resources are tenant-scoped: another merchant’s resource always reads as 404 — the API never reveals whether a foreign resource exists.

​

Public endpoints (no authentication)

Payer-facing endpoints, safe to call from a browser. They accept only the public invoice id (the last segment of invoiceUrl) and return redacted data.

​

Merchant API (secret API key)

These endpoints accept your secret key (Authorization: Bearer lid_live_...) with the listed scope — and equally a dashboard session with the matching team permission.

​

Dashboard-only endpoints

These require a logged-in dashboard session; API keys are rejected with 401 {"error":"Invalid or expired token"} — the key is not a session token, so it never reaches the role check. Money-moving actions additionally require a fresh MFA factor per request.