Rinne API Documentation

Create an API key for a merchant

curl --request POST \
  --url https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Production backend",
  "expires_at": "2027-01-01T00:00:00Z",
  "permissions": [
    "transaction.list",
    "ledger.list"
  ]
}
'

import requests

url = "https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys"

payload = {
    "name": "Production backend",
    "expires_at": "2027-01-01T00:00:00Z",
    "permissions": ["transaction.list", "ledger.list"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Production backend',
    expires_at: '2027-01-01T00:00:00Z',
    permissions: ['transaction.list', 'ledger.list']
  })
};

fetch('https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Production backend',
    'expires_at' => '2027-01-01T00:00:00Z',
    'permissions' => [
        'transaction.list',
        'ledger.list'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys"

	payload := strings.NewReader("{\n  \"name\": \"Production backend\",\n  \"expires_at\": \"2027-01-01T00:00:00Z\",\n  \"permissions\": [\n    \"transaction.list\",\n    \"ledger.list\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Production backend\",\n  \"expires_at\": \"2027-01-01T00:00:00Z\",\n  \"permissions\": [\n    \"transaction.list\",\n    \"ledger.list\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Production backend\",\n  \"expires_at\": \"2027-01-01T00:00:00Z\",\n  \"permissions\": [\n    \"transaction.list\",\n    \"ledger.list\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "name": "Production backend",
  "prefix": "ak_Ab12",
  "last4": "x9Zk",
  "permissions": [
    "*.*"
  ],
  "last_used_at": "2026-07-20T12:00:00Z",
  "expires_at": null,
  "revoked_at": null,
  "created_at": "2026-07-01T00:00:00Z",
  "key": "ak_Ab12Cd34Ef56Gh78Ij90Kl12Mn34Op56Qr78x9Zk"
}

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Validation error",
    "status": 400,
    "details": {
      "issues": [
        {
          "field": "email",
          "type": "REQUIRED",
          "message": "Field 'email' is required",
          "value": "invalid_value",
          "constraints": {
            "min": 18,
            "max": 120
          }
        }
      ]
    },
    "path": "/companies",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Authentication required to access this resource",
    "status": 401,
    "details": {
      "reason": "Invalid API key"
    },
    "path": "/companies/me",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "AUTHORIZATION_ERROR",
    "message": "You need 'admin' permissions to access this resource",
    "status": 403,
    "path": "/companies",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "RESOURCE_NOT_FOUND",
    "message": "Company with ID '123' not found",
    "status": 404,
    "path": "/companies/me",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "INTERNAL_SERVER_ERROR",
    "message": "An unexpected error occurred",
    "status": 500,
    "path": "/companies",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

POST

merchants

{merchantId}

api-keys

Create an API key for a merchant

curl --request POST \
  --url https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Production backend",
  "expires_at": "2027-01-01T00:00:00Z",
  "permissions": [
    "transaction.list",
    "ledger.list"
  ]
}
'

import requests

url = "https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys"

payload = {
    "name": "Production backend",
    "expires_at": "2027-01-01T00:00:00Z",
    "permissions": ["transaction.list", "ledger.list"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Production backend',
    expires_at: '2027-01-01T00:00:00Z',
    permissions: ['transaction.list', 'ledger.list']
  })
};

fetch('https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Production backend',
    'expires_at' => '2027-01-01T00:00:00Z',
    'permissions' => [
        'transaction.list',
        'ledger.list'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys"

	payload := strings.NewReader("{\n  \"name\": \"Production backend\",\n  \"expires_at\": \"2027-01-01T00:00:00Z\",\n  \"permissions\": [\n    \"transaction.list\",\n    \"ledger.list\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Production backend\",\n  \"expires_at\": \"2027-01-01T00:00:00Z\",\n  \"permissions\": [\n    \"transaction.list\",\n    \"ledger.list\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.rinne.com.br/core/v1/merchants/{merchantId}/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Production backend\",\n  \"expires_at\": \"2027-01-01T00:00:00Z\",\n  \"permissions\": [\n    \"transaction.list\",\n    \"ledger.list\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "name": "Production backend",
  "prefix": "ak_Ab12",
  "last4": "x9Zk",
  "permissions": [
    "*.*"
  ],
  "last_used_at": "2026-07-20T12:00:00Z",
  "expires_at": null,
  "revoked_at": null,
  "created_at": "2026-07-01T00:00:00Z",
  "key": "ak_Ab12Cd34Ef56Gh78Ij90Kl12Mn34Op56Qr78x9Zk"
}

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Validation error",
    "status": 400,
    "details": {
      "issues": [
        {
          "field": "email",
          "type": "REQUIRED",
          "message": "Field 'email' is required",
          "value": "invalid_value",
          "constraints": {
            "min": 18,
            "max": 120
          }
        }
      ]
    },
    "path": "/companies",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Authentication required to access this resource",
    "status": 401,
    "details": {
      "reason": "Invalid API key"
    },
    "path": "/companies/me",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "AUTHORIZATION_ERROR",
    "message": "You need 'admin' permissions to access this resource",
    "status": 403,
    "path": "/companies",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "RESOURCE_NOT_FOUND",
    "message": "Company with ID '123' not found",
    "status": 404,
    "path": "/companies/me",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

{
  "error": {
    "code": "INTERNAL_SERVER_ERROR",
    "message": "An unexpected error occurred",
    "status": 500,
    "path": "/companies",
    "timestamp": "2023-12-01T10:00:00.000Z",
    "requestId": "req_123456789"
  }
}

Authorizations

Authorization

string

header

required

JWT token for user authentication

Path Parameters

merchantId

string

required

The merchant ID

Body

application/json

name

string

required

Client-chosen label to identify the key

Maximum string length: 100

Example:

"Production backend"

expires_at

string<date-time>

Future datetime when the key stops authenticating; omit for a non-expiring key

Example:

"2027-01-01T00:00:00Z"

permissions

string[]

Permission strings granted to the key (see GET /v1/permissions); omit for full access

Minimum array length: 1

Example:

["transaction.list", "ledger.list"]

Response

The created API key, including the full key (shown once)

string

required

Example:

"123e4567-e89b-12d3-a456-426614174000"

name

string

required

Example:

"Production backend"

prefix

string

required

First 7 characters of the key, for masked display

Example:

"ak_Ab12"

last4

string

required

Last 4 characters of the key, for masked display

Example:

"x9Zk"

permissions

string[]

required

Example:

["*.*"]

last_used_at

string<date-time> | null

required

Last authentication with this key (updated at most every 5 minutes)

Example:

"2026-07-20T12:00:00Z"

expires_at

string<date-time> | null

required

When the key stops authenticating; null means it never expires

Example:

null

revoked_at

string<date-time> | null

required

When the key was revoked; null means it is active

Example:

null

created_at

string<date-time>

required

Example:

"2026-07-01T00:00:00Z"

key

string

required

The full API key. Shown only in this response — store it securely; it cannot be retrieved again.

Example:

"ak_Ab12Cd34Ef56Gh78Ij90Kl12Mn34Op56Qr78x9Zk"

⌘I

Introduction

Merchants

Pricing

Webhooks

Organization Management

User Management

System

Create an API key for a merchant

Authorizations

Path Parameters

Body

Response