Businesses the caller belongs to
Every business this user holds a role in. Requires only a consumer token, because this is how somebody discovers what they can switch into.
Every business this user holds a role in.
Requires only a consumer token, because this is how somebody discovers what they can switch into.
Authorization
OAuth2PasswordBearer In: header
Cookie Parameters
Response Body
application/json
application/json
curl -X GET "https://example.com/api/b/v1/memberships"[ { "business": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "legal_name": "string", "trading_name": "string", "country": "string", "kyb_status": "unverified", "kyb_tier": "tier_0", "created_at": "2019-08-24T14:15:22Z" }, "role": "owner", "status": "string" }]Fetch a charge GET
Scoped to your business and your key's mode. Someone else's charge and a charge that does not exist give the same 404, on purpose — telling them apart tells an attacker which ids are real.
Issue a session token scoped to a business POST
Mint a new token scoped to `business_id`. A new token rather than an amended one: a JWT is signed, so it cannot be re-scoped in place, and issuing a fresh one is what stops the previous scope applying to subsequent calls. Membership is checked here as well as on every later request. Refusing at the point of switching gives the user a clear answer instead of a token that fails on first use.