Skerry/ Reference/ Universal Commerce Protocol: what a customer sets
Replace the customer's settings
put/customers/{id}/ucp/settings
Replace the customer's settings: the platforms it accepts, its profile id at the card processor, the card brands and links it publishes, which wording the handler's environment uses, whether the AP2 mandates extension is on, and (sandbox only) whether unsigned requests are taken. A member left out goes back to its default. The signing key is made on the first save and kept sealed; a deployment with no sealing key answers 503 platform_unavailable.
Before you call
- Credential
Authorization: Bearer $KEY- Scope
agentic:write- Moves money
no- Idempotency
none
Parameters
- idstringrequiredIn the path
Request bodyapplication/json, required
object
Responses
- 200Success.
- 202requires_approval — Not an error: the operation is held for a person. The body names the approval.
- 400price_below_minimum — The price is below the smallest single payment for a method (
detail.method,detail.minimum), or has a part of a cent. Setcredit_only, raise the price, or drop the method. - 401dpop_invalid — The token is bound to a key and the DPoP proof was missing, wrong for this request, or already used.
- 402payment_failed — The payer's bank or card refused.
detail.reasonsays why in plain terms. - 403agent_payment_over_max — The merchant asks for more than
max_amount. Nothing was signed.detail.asked_minoris the lowest price asked, in US cents. - 404not_found — No such object in this project — including one that belongs to somebody else.
- 409token_not_issued — A delegated payment token could not be issued ready to use, for instance because the payer would have to act. Nothing was sent to the merchant.
- 429too_many_waiters — This key already has as many requests waiting (
?wait=) as it may. Let one finish, or read without wait. - 500internal_error — Ours. Quote the
request_idand we can find the call. - 502platform_error — A provider failed. Safe to retry with the same Idempotency-Key.
- 503oauth_unavailable — The authorisation server's keys could not be read, so tokens cannot be checked. API keys still work.