Unfortunately, this feature is not supported on mobile devices. For the best experience, please use a computer.

All APIs (latest)

Introduction

The Rebilly API is built on HTTP and is RESTful. It has predictable resource URLs and returns HTTP response codes to indicate errors. It also accepts and returns JSON in the HTTP body. Use your favorite HTTP/REST library in your programming language when using this API, or use one of the Rebilly SDKs, which are available in PHP and JavaScript.

Every action in the Rebilly UI is supported by an API which is documented and available for use, so that you may automate any necessary workflows or processes. This API reference documentation contains the most commonly integrated resources.

Authentication

This topic describes the different forms of authentication that are available in the Rebilly API, and how to use them.

Rebilly offers four forms of authentication: secret key, publishable key, JSON Web Tokens, and public signature key.

  • Secret API key: Use to make requests from the server side. Never share these keys. Keep them guarded and secure.
  • Publishable API key: Use in your client-side code to tokenize payment information.
  • JWT: Use to make short-life tokens that expire after a set period of time.

Manage API keys

To create or manage API keys, select one of the following:

For more information on API keys, see API keys.

Errors

Rebilly follows the error response format proposed in RFC 9457, which is also known as Problem Details for HTTP APIs. As with any API responses, your client must be prepared to gracefully handle additional members of the response.

SDKs

Rebilly provides a JavaScript SDK and a PHP SDK to help interact with the Rebilly API. However, no SDK is required to use the API.

Rebilly also provides FramePay, a client-side iFrame-based solution, to help create payment tokens while minimizing PCI DSS compliance burdens and maximizing your customization ability. FramePay interacts with the payment tokens creation operation.

JavaScript SDK

For installation and usage instructions, see SDKs. All JavaScript SDK code examples are included in the API reference documentation.

PHP SDK

For installation and usage instructions, see SDKs. All SDK code examples are included in the API reference documentation. To use them, you must configure the $client as follows:

$client = new Rebilly\Client([
    'apiKey' => 'YourApiKeyHere',
    'baseUrl' => 'https://api.rebilly.com',
]);

Get started

The full Rebilly API has over 500 operations. This is likely more than you may need to implement your use cases. If you would like to implement a particular use case, contact Rebilly for guidance and feedback on the best API operations to use for the task.

To integrate Rebilly, and learn about related resources and concepts, see Get started.

Rate limits

Rebilly enforces rate limits on the API to ensure that no single organization consumes too many resources. Rate limits are applied to the organization, and not to the API key. In sandbox environment, rate limits are enforced for non-GET endpoints and are set at 3000 requests per 10 minutes. You can find the exact number of consumed requests in the X-RateLimit-Limit and X-RateLimit-Remaining headers in the response. If the rate limit is exceeded, the API returns a 429 Too Many Requests response and a X-RateLimit-Retry-After header that includes a UTC timestamp of when the rate limit resets.

Download OpenAPI description
Languages
Servers
Mock server
https://www.rebilly.com/_mock/catalog/all/
Sandbox server
https://api-sandbox.rebilly.com/organizations/{organizationId}/
Live server
https://api.rebilly.com/organizations/{organizationId}/

Allowlists

Use allowlists to exclude specific customer attribute data from risk score checks.

Allowlists are lists of data that are excluded from risk score checks. Allowlists prevent specific data from being added to a blocklist record when a risk score threshold reached.

Operations

AML

Use Anti-Money Laundering (AML) operations to screen customers and help prevent your business from becoming directly or indirectly involved in criminal activity.

Use AML operations during customer creation, and some transaction processing, to help determine if a potential customer (lead), or customer, has political or economic sanctions against them.

AML operations search the following for screening purposes: Politically Exposed Persons (PEPs) lists, sanction lists, and adverse media lists.

OperationsWebhooks

API keys

Use API keys to identify and authenticate applications and users. Always keep your API keys private. When creating API keys, you can restrict them to a given set of permissions. For information on how to create and manage API keys, see API keys.

Operations

Application owners

Use these operations to register applications to the Rebilly Apps Store and manage application instances. An application owner is a person or organization that has submitted an app to the Rebilly App Store. For more information, see Submit an app.

OperationsWebhooks

Application users

Use these operations to install or uninstall apps from the Rebilly App Store to your Rebilly account, and to manage application instances. An application user is a person or organization that uses an app that is installed from the Rebilly App Store. For more information, see Install or uninstall an app.

Operations

Balance transactions

Use these operations to view and manage balance transactions.

Important: These operations are experimental and may change.

OperationsWebhooks

Billing portals

Use these operations to create and manage billing portals. Rebilly hosted billing portals provide secure, Rebilly hosted pages, where customers can: view invoices, cancel subscriptions, update payment instruments, and update their address.

Operations

Blocklists

Use blocklists to prevent fraud and criminal activity.

Blocklists are lists of customer attribute values that are blocked from buying from you. For example, if a customer attempts to make a purchase from you with a credit card that is in a blocklist, the transaction is blocked and is not processed.

Before a new transaction is processed in Rebilly, blocklists are examined to check for attributes related to the entity. If a match is detected, the operation is aborted. A blocklist that expires after a period of time is called a greylist.

Operations

Broadcast messages

Use broadcast messages to notify customers and leads about upcoming promotions, service updates, and events. Broadcast messages are emails that are sent to a specific group of customers, or all customers. For more information, see Create a broadcast message.

Operations

Checkout forms

Use these operations to create and manage checkout forms. Rebilly hosted checkout forms provide secure and compliant checkouts. Checkout forms are customizable, and use fully responsive design, built-in error messaging, validation, and expedited checkout for returning customers.

Operations

Coupons

Use coupons to reward customers, generate sales, or to test new pricing strategies. Coupons enable you to apply different types of discounts to invoices, subscriptions, and pricing plans.

Redeemed coupons are attached to a customer's account. Depending on the coupon restrictions, the redeemed coupons are then applied from the customer's account to subsequent invoices or subscriptions. Redeemed coupons can only be applied to invoices of the same currency.

Once a coupon is redeemed it cannot be modified. You may deactivate a coupon or create a new coupon, but you cannot reuse the same coupon code. If you have a use case where you must reuse the same code, contact Rebilly.

Operations

Credit memos

Use credit memos to provide a customer with store credit. A common use case for using a credit memo is to provide a customer with store credit, rather than a refund, if the customer pays more than they owe or returns a product. For information on the credit memo resource, see Resources.

OperationsWebhooks

Credit memos timeline

Use credit memo timelines to maintain an audit trail of changes and activity for each credit memo. Credit memos are a means of providing a customer with store credit.

Operations

Custom domains

Use custom domains to configure and use your own domain for forms and billing portals, instead of the default Rebilly domain: portal.secure-payments.app. For more information, see Configure a custom domain.

Operations

Custom fields

Use custom fields to extend a resource scheme to include custom data that is not provided as a common field. Depending on the resource on which the custom field is added, it may be available in the Rebilly UI.

Example: A custom field called preferredCommunicationChannel is added to the customer resource. It has two allowed values, which are 'email' and 'phone'.

{
  "customFields": {
      "preferredCommunicationChannel": "email"
  }
}

For detailed information on Rebilly resources, see Resources.

Operations

Customer authentication

Use these operations to validate the identity of users and manage authentication credentials.

Operations

Customers

Use these operations to manage customers. A customer is an entity that purchases goods or services from you (a merchant), and is the payee in any transaction that is credited to you. Customers are associated with payment instruments, subscriptions, invoices, and other related resources.

In other systems, customers may be referred to as accounts, clients, members, patrons, or players. For information on the customer resource, see Resources.

Operations

Customers timeline

Use customer timelines to maintain an audit trail of changes and activity for each customer.

Operations

Data exports

Use data export operations to manage the export of resource data, such as: transactions, customers, subscriptions, invoices, invoice item data, or revenue audit. Common data export use cases are: accounting, data analysis, reporting, or importing into other databases.

For detailed information on Rebilly resources, see Resources.

For information on how manage reconciliation, see Transaction reconciliation.

OperationsWebhooks

Deposits

Create and manage deposit requests and manage strategies that determine the deposit amounts to display on the page. Rebilly hosted deposit form provides a secure and compliant way to deposit funds. Deposit forms are customizable, and use fully responsive design, built-in error messaging and validation.

Important: These operations are experimental and may change.

Operations

Disputes

Use these operations to manage disputes. A dispute occurs when a customer contests a charge to their account. The dispute and related information is made available to the merchant by the bank or credit card company. The merchant then has the option to represent the charge and win the case. This process is called dispute resolution. If the merchant is unable to represent the charge, the card issuer typically reverses the sale and adds fees on top of the charge. This process is called a chargeback.

OperationsWebhooks

Email delivery settings

Use email delivery settings to configure from which email address notifications and broadcast message are sent. In Rebilly, this email address is referred to as a "From address". Supported email service providers are: SMTP, Mailgun, SendGrid, AWS SES, Postmark, and Rebilly.

Operations

Email messages

Use email messages to email customers directly.

Operations

Email notifications

Use email notifications to keep customers informed on events, and to inform them of events that may require action on their end. Email notifications are targeted email messages that can be plain text or HTML.

Email notifications can also be used to notify teammates about new customers, blocklist matches, risk score changes, and more. For more information, see Email notifications.

Operations

External identifiers

Use external identifier operations to associate entities such as customers, invoices, transactions, journal accounts, journal entries, and more with external services.

To use external identifiers, you must use an active service credential.

Operations

Fees

Use fees to reconcile transactions with applicable fees and discount rates. Fees are not applied directly to transaction amounts, they do not modify the transaction amount. Fees help to describe each part of the transaction amount.

Important: These operations are experimental and may change.

Operations

Files

Use the file entity to store files and related metadata. Files can be sorted by size, MIME-type, user-defined tags, and description.

The following methods are available to upload files: multipart/form-data encoded form, RAW POST — by sending the file contents as the POST body, and fetching from URL — by providing the file URL using the 'url' parameter.

Use the attachments entity to link a file to one or multiple objects, such as: customer, dispute, transaction, order, plan, product, invoice, or timeline comment. Attachments enable you to quickly find and use files related to specific entities.

Operations

Gateway accounts

Use these operations to manage payment gateway accounts. A payment gateway is a service which enables merchants to receive payments from their customers to their merchant account. A merchant account is a bank account that enables businesses to receive payments. Use payment gateway accounts to connect payment requests to third party networks and platforms.

Operations

Gateway accounts timeline

Use gateway account timelines to maintain an audit trail of changes and activity for each gateway account.

Operations

Histograms

Use histograms operations to generate transaction histogram reports with cohorts and periods. For information on the invoice resource, see Resources.

Operations

Integrations

Use these operations to manage third-party apps that are integrated to your Rebilly account. For more information on third-party apps, and how to integrate them, see App store.

Operations

Invoices

Use invoices to bill for the goods or services that you provide. If your invoice includes subscription items, it also includes the corresponding service periods and prices.

Operations

Invoices timeline

Use invoice timelines to maintain an audit trail of changes and activity for each invoice.

Operations

Journal

Use journal accounts, entries and records to track and recognize revenue.

Operations

KYC documents

Use Know Your Customer (KYC) documents to verify your customers identity. The KYC document operations generate a signed link to the Rebilly KYC document gatherer.

Document types:

  • identity-proof: Validates a customer's identity.
  • address-proof: Validates a customer's address.
  • purchase-proof: Validates a customer's purchase.
  • funds-proof: Validates that a customer has funds.
  • credit-file-proof: Verifies that there is an existing credit file with two sources that match the customer's name, DOB, and address.

Rebilly parses and analyzes the documents and accepts or rejects them according to a configurable scoring algorithm. When all document types in a KYC request are accepted, the status is fulfilled, and the KYC request fulfilled webhook is sent.

Operations

Lists

Use lists to create and maintain sets of values that may be referenced in rule conditions. Commonly used lists contain values related to conditions that target specific properties such as: customers, transactions, or BINs.

You may grant list edit permissions to members of your team without enabling them to edit rules. This may be useful if your workflow involves frequent updates to value sets that are used in rule or bind conditions. List order may not be maintained and duplicates may be removed.

For more information, see Value lists.

Operations

Memberships

Use these operations to manage user membership within your organizations. Membership describes the relationship between organizations and users. For example, one user could be a member of more than one organization.

Operations

Metadata

Use these operations to retrieve and manage metadata. Metadata is structured information on other data.

Operations

Retrieve payment method metadata

Request

Retrieves payment method metadata.

Query
limitinteger[ 0 .. 1000 ]

Limits the number of collection items to be returned.

offsetinteger[ 0 .. 1000 ]

Specifies the starting point within the collection of items to be returned.

curl -i -X GET \
  'https://www.rebilly.com/_mock/catalog/all/payment-methods?limit=1000&offset=1000'
Experience it firsthand in the API Explorer!

Responses

Payment methods metadata received.

Bodyapplication/jsonArray [
apiNamestring^[\w\. -]+$required

Name of the payment method returned in the API response.

namestring^[\w\. -]+$required

Name of the payment method.

landscapeLogostring or null(uri)

URL for the payment method logo optimized for landscape orientation.

portraitLogostring or null(uri)

URL for the payment method logo optimized for portrait orientation.

summarystringrequired

Short description of the payment method. This field supports Markdown.

descriptionstringrequired

Detailed information about the payment method. This field supports Markdown.

countriesobject(CountriesMetadata)required

Countries metadata.

countries.modestringrequired
Enum"unknown""all"
Discriminator
countries.valuesArray of stringsunique

List of supported countries.

storefrontEnabledboolean
Default false
_linksArray of objects(SelfLink)read-only

Related links.

]
Response
application/json
[ { "apiName": "string", "name": "string", "landscapeLogo": "http://example.com", "portraitLogo": "http://example.com", "summary": "string", "description": "string", "countries": {}, "storefrontEnabled": false, "_links": [] } ]

Retrieve metadata of a payment method

Request

Retrieves the metadata of a payment method with a specified apiName.

Path
apiNamestring^[\w\. -]+$required

Name of the payment method API.

curl -i -X GET \
  'https://www.rebilly.com/_mock/catalog/all/payment-methods/{apiName}'
Experience it firsthand in the API Explorer!

Responses

Payment method metadata received.

Bodyapplication/json
apiNamestring^[\w\. -]+$required

Name of the payment method returned in the API response.

namestring^[\w\. -]+$required

Name of the payment method.

landscapeLogostring or null(uri)

URL for the payment method logo optimized for landscape orientation.

portraitLogostring or null(uri)

URL for the payment method logo optimized for portrait orientation.

summarystringrequired

Short description of the payment method. This field supports Markdown.

descriptionstringrequired

Detailed information about the payment method. This field supports Markdown.

countriesobject(CountriesMetadata)required

Countries metadata.

countries.modestringrequired
Enum"unknown""all"
Discriminator
countries.valuesArray of stringsunique

List of supported countries.

storefrontEnabledboolean
Default false
_linksArray of objects(SelfLink)read-only

Related links.

Response
application/json
{ "apiName": "string", "name": "string", "landscapeLogo": "http://example.com", "portraitLogo": "http://example.com", "summary": "string", "description": "string", "countries": { "mode": "unknown", "values": [] }, "storefrontEnabled": false, "_links": [ {} ] }

Retrieve payment gateway metadata

Request

Retrieves payment gateway metadata.

curl -i -X GET \
  https://www.rebilly.com/_mock/catalog/all/payment-gateways-metadata
Experience it firsthand in the API Explorer!

Responses

Payment gateway metadata received.

Bodyapplication/jsonArray [
apiNamestring^[\w\. -]+$required

Name of the payment gateway returned in the API response.

otherNamesArray of objects

List of former names associated with the payment gateway. Gateways may change their names or may also be known by other names. Tracking this list may help customer support and developers.

logostring(uri)required

URL for the logo of the gateway.

summarystring or null

Short description of the payment gateway. This field supports Markdown.

homepagestring or null(uri)

URL of the payment gateway home page.

externalDocsArray of objects

List of links to the documentation of the payment gateway. For example, online API guides provided by gateways or a link to the documents in Google Drive.

publishedPricingstring or null

Pricing description for the payment gateway, if pricing is published.

setupInstructionsstring or null

Special gateway account set up instructions for merchants. For example: After adding this gateway account, set the IPN to //example.com/ipns/{gateway-name}/{organization-id} by contacting your account rep.

paymentMethodsArray of stringsnon-emptyrequired

Array of supported payment methods. For example, payment-card and bitcoin.

cardBrandsArray of strings(PaymentCardBrand)

Array of supported card-brands. If the payment gateway supports payment cards.

Items Enum"Visa""MasterCard""American Express""Discover""Maestro""Solo""Electron""JCB""Voyager""Diners Club"
merchantCountriesobject(CountriesMetadata)required

Countries metadata.

merchantCountries.modestringrequired
Enum"unknown""all"
Discriminator
merchantCountries.valuesArray of stringsunique

List of supported countries.

currenciesUnrestricted (object) or Subset (object)required

Currencies metadata.

One of:

Currencies metadata.

currencies.modestringrequired

Specifies how the currencies are compared.

Enum"unknown""all"
operationsArray of strings

Array of operations that are supported by the payment gateway.

Items Enum"verify""auth""capture""sale""refund""query""credit""3DS1""3DS2""checkCredentials"
supported3dsServersArray of strings

Array of supported 3DS-servers.

supportedPaymentInstrumentSetupInstructionsArray of strings

Array of set up instructions that are supported by the payment gateway.

Items Enum ValueDescription
authorize

Creates an authorize transaction in the amount or currency of the request. This is used when a gateway account is configured for Strong Customer Authentication (SCA).

authorize-and-void

Creates an authorize transaction in the amount and currency of the request, followed by a void, if the authorize is approved. This is used when a gateway account is configured for Strong Customer Authentication (SCA).

sca

Uses Strong Customer Authentication (SCA) without an authorize transaction. SCA includes 3DS, and specific wallet behavior, such as setting up a billing agreement with PayPal.

do-nothing

Does nothing except return an approved setup transaction. This is the default behavior.

reconciliationSupportboolean

Specifies whether transactions can be reconciled.

Default false
disputeSupportboolean

Specifies whether dispute data entry can be automated with an API or SFTP access. For example, chargeback, retrieval, or TC-40 disputes.

Default false
offsiteboolean

Specifies whether offsite interaction is required. For example, 3DS, PayPal login, or completing something in a store.

Default false
ipnobject or null

Describes the Instant Payment Notification (IPN) that a payment gateway supports. If this value is null, IPN is not supported.

recommendedWaitingApprovalTtlinteger[ 299 .. 16777216 ]

Recommended Time To Live (TTL) before abandoning the transaction.

Default 3600
_linksArray of objects(SelfLink)read-only

Related links.

]
Response
application/json
[ { "apiName": "string", "otherNames": [], "logo": "http://example.com", "summary": "string", "homepage": "http://example.com", "externalDocs": [], "publishedPricing": "string", "setupInstructions": "string", "paymentMethods": [],