Cowdidocs
API ReferenceMerchant members

Get merchant access

GET
/v1/merchants/{id}/access

Inspect one user's direct, group, and inherited assignments with provider-evaluated effective permissions. Requires org:merchants:read. The user_id filter is required. The response contains at most one person and has no pagination links. Organization members remain visible with no merchant roles.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

id*string

The merchant ID from the sales app.

Formatuuid

Query Parameters

user_id*string

The application user ID to inspect. This filter is required.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/merchants/550e8400-e29b-41d4-a716-446655440001/access?user_id=660e8400-e29b-41d4-a716-446655440111"
{  "organization_id": "cowdi",  "merchant_id": "550e8400-e29b-41d4-a716-446655440001",  "can_manage": true,  "data": [    {      "user_id": "660e8400-e29b-41d4-a716-446655440111",      "name": "Jane Wanjiru",      "email": "jane@example.com",      "assignments": [        {          "role_slug": "organization-financing-admin",          "source": {            "resource_type": "merchant",            "resource_id": "cowdi",            "resource_name": "Acme Traders"          }        }      ],      "direct_roles": [        "organization-financing-admin"      ],      "effective_permissions": [        "string"      ]    }  ],  "links": {    "next": "/v1/payees?after=eyJpZCI6MX0",    "prev": "/v1/payees?before=eyJpZCI6MX0"  }}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}

List the caller's merchants GET

List the merchants the caller is an active member of, within the caller's organization. Requires an authenticated user token. Returns every match; the response is not paginated.

List pending invitations GET

List the merchant's pending member invitations. Core resolves the merchant's organization before authorization. Requires `merchant:members:read` on the merchant, from direct or inherited roles. Returns every match. The response is not paginated.