Cowdidocs
API ReferenceMerchant members

List pending invitations through an organization

Deprecated

GET
/v1/organizations/{organizationId}/merchants/{merchantId}/invitations

Deprecated. Use GET /v1/merchants/{id}/invitations. Requires merchant:members:read on the merchant. The organization must match the caller and the merchant.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

organizationId*string

The organization slug.

merchantId*string

The merchant ID from the sales app.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/organizations/greenwheels/merchants/550e8400-e29b-41d4-a716-446655440001/invitations"
[  {    "id": "550e8400-e29b-41d4-a716-446655440002",    "merchant_id": "550e8400-e29b-41d4-a716-446655440001",    "organization_id": "greenwheels",    "email": "jane@example.com",    "role": "merchant-financing-admin",    "status": "PENDING",    "created_at": "2026-03-15T10:00:00Z",    "resource_id": "string"  }]
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
[  {    "id": "550e8400-e29b-41d4-a716-446655440002",    "merchant_id": "550e8400-e29b-41d4-a716-446655440001",    "organization_id": "greenwheels",    "email": "jane@example.com",    "role": "merchant-financing-admin",    "status": "PENDING",    "created_at": "2026-03-15T10:00:00Z",    "resource_id": "string"  }]
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Change direct merchant roles PATCH

Add and remove the person's direct roles on this merchant. Group and inherited roles do not change. Requires `org:merchants:write` and `org:access.roles:write`. Each role applies on its own, so the request repeats safely. A request that fails part way keeps the roles it already applied. Read the access again to see the result. Removing every direct role preserves membership and inherited access.

Invite a merchant member through an organization POST

Deprecated. Use `POST /v1/merchants/{id}/invitations`. Requires `merchant:members:write` on the merchant. The organization must match the caller and the merchant.