Critical-risk tools in Mcp Ap2
350 of the 1300 tools in Mcp Ap2 are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
authorize_transactionFinancialAuthorize a transaction (reserve funds without capturing) via Braintree GraphQL authorizePaymentMethod. Pass a paymentMethodId obtained from client-side tokenization (Drop-in / ...
-
block_cardFinancialBlock a card temporarily (reversible). Use for lost-card or fraud-suspected flows. Card status goes to BLOCKED — declines all authorizations until unblocked. Different from chan...
-
cancel_all_ordersDestructiveCancel all open orders for the authenticated user
-
cancel_billFinancialCancel a pending bill
-
cancel_boletoDestructiveCancel (baixa) an outstanding boleto before payment.
-
cancel_checkoutDestructiveCancel an ACP checkout session. Releases any held inventory.
-
cancel_collectionFinancialCancel a scheduled collection request
-
cancel_creditFinancialCancel an authorized-but-uncaptured credit payment.
-
cancel_cteDestructiveCancel an authorized CTe
-
cancel_debitFinancialCancel a debit-card payment by Getnet payment_id.
-
cancel_invoiceFinancialCancel/void an authorized invoice (FECancel — limited to certain types/conditions)
-
cancel_mdfeDestructiveCancel a MDF-e (manifesto)
-
cancel_nfceDestructiveCancel an authorized NFCe
-
cancel_nfeDestructiveCancel an authorized NFe (within 24h of emission)
-
cancel_nfseDestructiveCancel an authorized NFSe
-
cancel_orderFinancialCancel an order, optionally restocking and refunding
-
cancel_paymentFinancialAttempt to cancel a payment that has not yet settled. Iniciador endpoint: POST /payments/{id}/cancel.
-
cancel_payment_intentFinancialCancel a payment intent that has not yet been captured. Fails on already-captured intents; use create_refund instead.
-
cancel_payoutFinancialCancel a payout that is still in
-
cancel_pickupDestructiveCancel a pickup/collection request
-
cancel_pix_automaticoFinancialCancel an active Pix Automático recurrence. Future charges stop after BCB confirms the cancellation. Past charges are unaffected.
-
cancel_prepostDestructiveCancel a pre-posting order
-
cancel_recurrenceFinancialCancel an active recurrence. Future charges will stop; already-charged cycles are untouched.
-
cancel_reportDestructiveCancel a report that is IN_QUEUE and has not yet started processing. Reports that are IN_PROGRESS or DONE cannot be cancelled.
-
cancel_saleDestructiveCancel a sale in Conta Azul
-
cancel_scheduled_pixFinancialCancel a previously scheduled PIX transfer
-
cancel_scheduled_sendFinancialCancel or pause a scheduled send by batch_id via POST /user/scheduled_sends. A send_mail call with
-
cancel_shipmentDestructiveCancel a shipment
-
cancel_subscriptionFinancialCancel a subscription by ID
-
cancel_swapFinancialCancel a pending swap before it lands onchain. Endpoint set provisional, expand once docs stabilize.
-
cancel_transactionFinancialCancel a transaction. Only valid while status is
-
clear_cartDestructiveRemove all items from the cart
-
delete_accountDestructiveDelete a Jumio end-user account and every workflow execution under it (GDPR right-to-erasure). Irreversible. For deleting only a single transaction, use delete_transaction instead.
-
delete_applicantDestructiveSoft-delete an applicant. Onfido retains the record for 30 days before permanent deletion; during that window it can be restored via the dashboard.
-
delete_bank_accountDestructiveDelete a stored customer bank account (DELETE /customers/{customer_id}/bankaccounts/{id}).
-
delete_boletoDestructiveCancel an issued boleto (only allowed while unpaid / in
-
delete_bounceDestructiveRemove a bounced address from the bounce suppression list via DELETE /suppression/bounces/{email}. Call this after the recipient confirms the underlying issue (e.g. mailbox full...
-
delete_cardDestructiveDetach a saved card from its customer (DELETE /cards/{id}). The card id becomes unusable as source_id afterwards.
-
delete_card_tokenDestructiveDelete a Cartão Protegido vault token (DELETE /card/{token}). After deletion the token can no longer be used to create sales. Use when the cardholder requests removal or the car...
-
delete_categoryDestructiveDelete a product category by ID
-
delete_checkoutDestructiveDelete a reusable checkout. The hosted URL stops accepting new payments. Existing charges spawned by the checkout are unaffected.
-
delete_contactDestructiveDelete a contact
-
delete_customerDestructiveDelete a customer
-
delete_dict_keyDestructiveDelete a DICT key owned by the merchant. Irreversible — key becomes available for re-registration after BCB lockout window.
-
delete_instanceDestructiveDelete an instance permanently
-
delete_invoiceDestructiveDelete an invoice. Permanently removes the invoice. Requires Id and SyncToken.
-
delete_itemDestructiveDelete a bank connection (revokes credentials, removes accounts/transactions). Pluggy endpoint: DELETE /items/{id}.
-
delete_linkDestructiveDelete a link (and all its associated data) by ID
-
delete_listDestructiveDelete a Marketing Campaigns contact list via DELETE /marketing/lists/{id}. Contacts are NOT deleted by default — set delete_contacts=true to also remove contacts that belong ON...
-
delete_listings_itemDestructiveDelete a listing item for the seller by SKU.
-
delete_mediaDestructiveDelete an uploaded media asset by id.
-
delete_messageDestructiveDelete a message for me or for everyone in a chat
-
delete_paymentDestructiveDelete a payment by ID
-
delete_payment_methodDestructiveDelete a vaulted payment method via deletePaymentMethodFromVault. Irreversible — the token cannot be used for future charges after deletion.
-
delete_payment_sourceDestructiveDelete a payment source from a customer
-
delete_paywallDestructiveRemove a x402 paywall from an endpoint
-
delete_pix_keyDestructiveDelete a DICT key owned by the merchant. Irreversible — the key becomes available for re-registration by any PSP after the BCB lockout window.
-
delete_planDestructiveDelete a subscription plan. Fails if the plan has active subscriptions.
-
delete_productDestructiveDelete a product by ID
-
delete_recipientDestructiveRemove a registered recipient. Will fail if the recipient is currently attached to in-flight payments.
-
delete_serviceDestructiveDelete a service in Conta Azul
-
delete_subscriptionDestructiveDelete a webhook subscription by ID
-
delete_templateDestructiveDelete a message template from the WABA by name. Optionally scope by hsm_id when two templates share a name across languages.
-
delete_tokenDestructiveDelete a stored card token.
-
delete_transactionDestructiveDelete a workflow execution (GDPR right-to-erasure). Removes captured images, extracted data, and decision audit trail for this transaction on Jumio
-
delete_webhookDestructiveDelete a webhook by ID
-
oneclick_delete_inscriptionDestructiveDelete (revoke) a stored OneClick Mall card for a user.
-
remove_from_allowlistDestructiveRemove a value from the Konduto allowlist. Future orders matching the value will once again undergo full ML scoring.
-
remove_from_blocklistDestructiveRemove a value from the Konduto blocklist.
-
remove_from_reviewlistDestructiveRemove a value from the Konduto reviewlist. Future orders matching the value will be scored normally instead of being forced into review.
-
remove_group_participantDestructiveRemove a participant from a WhatsApp group
-
revoke_agentDestructiveRevoke an agent
-
revoke_consentDestructiveRevoke a payment consent before it is exercised. Iniciador endpoint: DELETE /consents/{id}.
-
revoke_tokenDestructiveRevoke an issued access_token or refresh_token at POST /v1/token/revoke. Use to terminate a recurrence mandate or after card-token deletion. Form-encoded; expects a signed JWT c...
-
unlabel_userDestructiveRemove any existing label on a user (DELETE /v205/users/{user_id}/labels). Optionally scope by abuse_type.
-
unsubscribeFinancialCancel a subscription
-
unsubscribe_webhookDestructiveRemove a previously registered webhook
-
vault_payment_methodFinancialPermanently store a tokenized payment method in the Braintree vault via vaultPaymentMethod. The input paymentMethodId must be a single-use nonce; the mutation returns a permanen...
-
void_invoiceDestructiveVoid/cancel an invoice
-
void_saleFinancialVoid / cancel a sale (PUT /sales/{paymentId}/void). Supports full void (omit amount) or partial void.
-
authorize_paymentFinancialRequest payment authorization with scoped limits. Returns an authorization token that can be used to execute the payment.
-
execute_paymentFinancialExecute an authorized payment. Requires a valid authorization token.
-
initiate_transactionFinancialStart a new KYC workflow execution on an existing account. Returns a
-
sign_buy_urlFinancialBuild and HMAC-SHA256 sign a MoonPay buy widget URL (buy.moonpay.com). Returns a ready-to-redirect URL with the merchant
-
sign_sell_urlFinancialBuild and HMAC-SHA256 sign a MoonPay sell widget URL (sell.moonpay.com). Returns a ready-to-redirect URL with apiKey + signature appended. Requires MOONPAY_PUBLISHABLE_KEY and M...
-
arrecadacao_payFinancialPay a utility, tax, or concessionária bill via Bradesco Arrecadação. Works with barcode (código de barras) or linha digitável.
-
authorize_recurring_chargeFinancialAuthorize a recurring charge agreement against a Nequi user
-
cancel_chargeFinancialCancel a charge that has not yet been paid. Only charges in NEW status can be cancelled; once pending or completed the call will fail.
-
cancel_transferFinancialCancel a pending SPEI orden by clave_rastreo (only works while orden is pending)
-
capture_chargeFinancialCapture a pre-authorized order (pre_authorized → paid)
-
charge_billFinancialRetry charging a pending bill (runs the billing workflow)
-
charge_transactionFinancialAuthorize and capture a transaction atomically via Braintree GraphQL chargePaymentMethod. Use for one-step sales. For auth-now-capture-later split, use authorize_transaction + c...
-
create_b2p_transferFinancialCreate a Business-to-Person (B2P) transfer: push funds from the merchant wallet to a PicPay user identified by CPF/CNPJ. Useful for payouts, cashbacks, rewards and marketplace s...
-
create_boleto_issueFinancialIssue a boleto receivable (generates barcode/digitable line to collect payment)
-
create_card_chargeFinancialCharge a credit or debit card (Stone acquiring)
-
create_chargeFinancialCreate a crypto charge — a one-time merchant invoice priced in local fiat that a buyer can settle in BTC, ETH, USDC, and other supported assets. Returns a hosted_url the buyer c...
-
create_chargeback_notificationFinancialReport a confirmed chargeback back to ClearSale. Critical for model tuning: unreported chargebacks degrade future decision quality for similar buyers.
-
create_paymentFinancialRecord a payment against an invoice
-
create_payment_consentFinancialCreate payment-initiation consent (e.g., PIX) via Open Finance
-
create_payment_intentFinancialCreate a payment intent for Pluggy Payments (PISP). Pluggy endpoint: POST /payments/intents.
-
create_payment_linkFinancialCreate a payment link
-
create_payment_mandateFinancialCreate an AP2 payment mandate — the final Verifiable Credential authorizing settlement against a cart mandate.
-
create_payment_methodFinancialAttach a payment method (credit card token) to a customer. Endpoint: POST /customers/:customer_id/payment_methods
-
create_payment_profileFinancialCreate a payment profile (tokenized card / saved payment method) for a customer
-
create_payment_requestFinancialCreate a payment request for approval workflow
-
create_payment_sourceFinancialCreate a reusable payment source (CARD/NEQUI/PSE) linked to a customer email
-
create_payment_source_using_tokenFinancialAttach a payment source to a customer using a gateway token (e.g. from Chargebee JS / Stripe.js / Adyen tokenization)
-
create_payment_tokenFinancialTokenize a credit card server-side. Endpoint: POST /payment_token. WARNING: using this from your server subjects you to PCI audits — prefer iugu.js client-side tokenization in p...
-
create_pix_chargeFinancialCreate a Pix charge (QR Code / cob) to receive a payment
-
create_pix_charge_dueFinancialCreate a due-dated Pix charge (BCB /cobv — Pix com Vencimento). Boleto-style charge with due date, late fee (multa), interest (juros), and discount fields. Returns txid + QR pay...
-
create_pix_charge_dynamicFinancialCreate a dynamic Pix charge (single-use QR with expiration). Returns txid, EMV copy-paste, and QR image. Preferred for e-commerce checkouts and invoices.
-
create_pix_charge_staticFinancialCreate a static Pix charge (reusable QR code tied to a merchant Pix key). Returns EMV copy-paste payload and QR code image. Use for points-of-sale or donations where the same QR...
-
create_pix_depositFinancialCreate a Pix instant deposit (BRL). Returns Pix QR code / copy-paste payload.
-
create_pix_due_chargeFinancialCreate a Pix charge with a due date (cobv) — commonly used for installments and scheduled invoices. Returns txid, location URL, and EMV payload.
-
create_refundFinancialCreate a refund for a transaction
-
create_transferFinancialCreate a bank transfer (Pix or TED)
-
finalize_disputeFinancialFinalize a dispute via finalizeDispute — submits previously added evidence to the card network for review. After finalization, no further evidence can be added.
-
finalize_invoiceFinancialFinalize a draft Invoice. Moves status draft → open and makes it payable. Required before send/pay when auto_advance=false.
-
fund_transferFinancialFund a Wise transfer from a multi-currency balance. Equivalent to clicking
-
internal_transferFinancialBook a transfer between two accounts both held on Matera (TED-interno / transferência interna). Settles instantly without touching SPI/Pix rails — no endToEndId, no DICT lookup....
-
oneclick_refundFinancialRefund a OneClick Mall charge. Parent buy_order identifies the mall transaction; detail_buy_order + commerce_code pinpoint the child to refund.
-
partial_refundFinancialRefund a portion of a charge (explicit partial refund; returns amount in cents).
-
pay_account_payableFinancialSettle / record payment (baixa) for an AP title in Omie ERP
-
pay_billFinancialPay a bill (boleto bancário or concessionária) by barcode / digitable line
-
pay_boletoFinancialPay a boleto from a linked account
-
pay_credit_card_billFinancialPay a credit card bill from a linked account
-
pay_invoiceFinancialAttempt to collect payment on an open Invoice. Charges the customer
-
pay_orderFinancialPay an existing order (attach a charge/payment to an order in CREATED state)
-
pay_plinFinancialInitiate a Plin direct payment. Plin is the inter-bank wallet (Interbank, BBVA, Scotiabank, BanBif). The payer authorizes in-app; this call sends the payment request to their ph...
-
pay_requestFinancialPay for a 402-protected resource. Sends USDC payment via x402 protocol and returns the resource content. The agent automatically handles the 402 handshake.
-
pay_tax_darfFinancialPay a federal tax (DARF) or union fee (GRU) via Bradesco Arrecadação. Distinct product surface from utility arrecadação because DARF/GRU require tax-code fields (código de recei...
-
pay_tributeFinancialPay a federal tribute (DARF, GPS, GRU) or other guia de arrecadação via Caixa. Input is the full 44/47-digit barcode or linha digitável plus debit account. Requires arrecadação ...
-
pay_yapeFinancialInitiate a Yape direct payment. Yape is BCP
-
refundFinancialRefund a payment (full or partial)
-
refund_captureFinancialRefund a captured payment via POST /v2/payments/captures/{id}/refund. Pass an amount object for partial refunds, or omit for a full refund. Idempotent via PayPal-Request-Id.
-
refund_chargeFinancialRefund a charge
-
refund_creditFinancialRefund a captured credit payment. Pass amount for a partial refund; omit for full.
-
refund_invoiceFinancialRefund a paid invoice (full or partial). Endpoint: POST /invoices/:id/refund
-
refund_paymentFinancialRefund a captured payment (full or partial).
-
refund_pixFinancialRefund (devolução) a previously received Pix. Must reference the original endToEndId and a merchant-side refund id.
-
refund_pix_paymentFinancialRefund (devolução) a Pix payment. Supports full or partial amount. Use reason codes per BCB MED catalog.
-
refund_sell_transactionFinancialRequest a refund on an off-ramp (sell) transaction. Used when the destination bank rejects payout or the user disputes the trade. Reason codes are MoonPay-defined.
-
refund_transactionFinancialRefund a settled transaction via refundTransaction. Amount defaults to the full settled amount when omitted. For partial refunds, pass a smaller amount.
-
request_withdrawFinancialRequest a bank withdrawal (saque) from a sub-account. Endpoint: POST /accounts/:id/request_withdraw
-
resolve_chargeFinancialManually resolve a charge as paid. Used for out-of-band settlement (e.g. underpayment you accept, delayed confirmation you want to honour).
-
transferFinancialSend a transfer from a wallet to a destination address. Returns the tx hash + initial status. Endpoint set provisional.
-
transfer_between_accountsFinancialTAA — transfer between two Itaú accounts (owned by the merchant or a counterparty). Instant settlement, no BCB fee.
-
transfer_between_walletsFinancialMove funds between two Rapyd ewallets (source_ewallet → destination_ewallet). Used for marketplace settlement (buyer wallet → seller wallet), creator payouts, internal rebalanci...
-
transfer_internalFinancialTransfer between two Santander accounts (TEF / mesma instituição). Settles instantly and is fee-free for most covenants.
-
transfer_tedFinancialExecute a TED (or TEF when intra-Bradesco) transfer from the merchant
-
update_pix_chargeFinancialUpdate (PATCH) a Pix immediate charge (cob) — e.g. change amount before payment, adjust expiration, or mark as REMOVIDA_PELO_USUARIO_RECEBEDOR.
-
update_pix_due_chargeFinancialPatch a Pix due charge (cobv) — revise amount, due date, discount, or debtor before payment.
-
webpay_mall_refund_transactionFinancialRefund one child seller of a Webpay Mall transaction. Must specify which child (commerce_code + buy_order) to refund.
-
webpay_refund_transactionFinancialRefund a committed Webpay Plus transaction. Full refund if amount equals original; partial otherwise.
-
withdrawFinancialCreate a withdrawal request
-
accept_disputeFinancialAccept a dispute — forfeit the funds and close the case (Dispute Service v30).
-
accept_dispute_claimFinancialAccept liability for a dispute claim via POST /v1/customer/disputes/{id}/accept-claim. The disputed amount is refunded to the buyer. Terminal action.
-
accept_return_offerFinancialAccept the buyer
-
authenticate_3dsFinancialComplete a 3-D Secure challenge. Call after the payer finishes the issuer challenge (redirected back to return_url) with the authenticator response (cres / PaRes). Returns the a...
-
authorize_debitFinancialAuthorize a debit card transaction on Rede. Requires a prior 3DS authentication — pass threeDSecure.embedded=true and a valid threeDSecure reference, or use authorize_with_3ds a...
-
authorize_orderFinancialAuthorize payment for an approved order via POST /v2/checkout/orders/{id}/authorize. Use after the buyer approves an order with intent=AUTHORIZE. Returns the created authorizati...
-
authorize_with_3dsFinancialAuthorize a transaction after a successful 3DS authentication, attaching the 3DS reference for liability shift. Works for both credit and debit.
-
buy_label_rangeFinancialRequest a range of SIGEP tracking labels (etiquetas) for a service
-
buy_phone_numberFinancialProvision a new phone number. Supply either a specific
-
capture_creditFinancialCapture a previously authorized credit payment (when delayed=true was used).
-
capture_orderFinancialCapture payment for an approved order via POST /v2/checkout/orders/{id}/capture. Use after the buyer approves an order with intent=CAPTURE. Returns the captured payment details.
-
capture_paymentFinancialCapture an authorized payment (for delayed-capture flows).
-
capture_payment_intentFinancialCapture a previously-authorized payment intent (two-step auth + capture flow). Use this after confirm_payment_intent on intents created with capture_method=manual. Amount may be...
-
capture_saleFinancialCapture a pre-authorized sale (PUT /sales/{paymentId}/capture). Supports partial capture via amount, and optional serviceTaxAmount (airline / travel merchants).
-
capture_transactionFinancialCapture a previously authorized transaction via captureTransaction. Amount defaults to full authorized amount when omitted (partial captures allowed up to the authorized total).
-
confirm_orderFinancialConfirm an unpaid order (POST /orders/{id}/confirm). Moves the order to a confirmed state ready to be paid by the customer via Yape / PagoEfectivo.
-
confirm_paymentFinancialManually confirm a Khipu payment. Use when the merchant has opted into manual confirmation and the backend has validated the underlying transfer.
-
confirm_payment_intentFinancialConfirm a previously-created payment intent with a payment method. For card intents this triggers authorization; for APM intents this returns a next_action (redirect, QR, etc).
-
confirm_payoutFinancialSecond step of Rapyd
-
confirm_returnFinancialConfirm (accept) a buyer-initiated return request by return_sn.
-
deactivate_recurrentFinancialDeactivate (pause) a recurrent payment so it stops charging
-
defend_disputeFinancialDefend a dispute using one of the applicable defense reason codes (Dispute Service v30).
-
email_invoiceFinancialEmail an AUTHORISED invoice to the contact
-
freeze_accountFinancialFreeze (block) a Dock account. Pix outflows and card spend are halted but balance is preserved. Used for fraud holds, KYC re-verification, or judicial blocks.
-
get_pix_qrcodeFinancialGet Pix QR code for a payment (returns payload and image)
-
initiate_pixFinancialInitiate a PIX transfer
-
invoice_orderFinancialIssue a fiscal invoice (nota fiscal) for an order
-
invoice_sales_orderFinancialGenerate an invoice (NF) from an existing sales order in Omie ERP
-
notify_unregistered_paymentFinancialNotify a non-Nequi recipient with instructions to claim a payment
-
oneclick_authorizeFinancialCharge a stored OneClick Mall card across one or more mall merchant codes. Each details entry is a separate child charge with its own commerce_code, buy_order, amount, and insta...
-
oneclick_captureFinancialCapture a previously authorized OneClick Mall charge (deferred-capture flow). One capture per child detail.
-
payment_detailsFinancialSubmit additional details for a payment (3DS challenge response, redirect returnUrl payload, etc).
-
reactivate_recurrentFinancialReactivate a previously deactivated recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Reactivate). Resumes future scheduled charges from the next configured date.
-
reactivate_subscriptionFinancialReactivate a cancelled or paused subscription
-
redact_inquiryDestructiveRedact an inquiry (GDPR right-to-erasure). Scrubs PII, captured images, and verification detail for this inquiry on Persona
-
redeem_from_fundFinancialRedeem (resgatar) from a fund. Total or partial. Settlement follows the fund
-
report_chargebackFinancialReport a confirmed chargeback for an order. Convenience wrapper around update_order_status with status=
-
request_returnFinancialRequest a return or refund for a delivered order
-
retry_transactionFinancialRetry a failed, expired, or rejected workflow execution. Creates a new workflow execution on the same account, optionally re-using the original workflow definition and customer ...
-
reverse_paymentFinancialReverse a completed payment
-
reverse_transactionFinancialReverse any Nequi transaction by transaction ID (refund flow)
-
simulate_paymentFinancialSimulate the response of a payment in sandbox without persisting it (useful for integration testing).
-
subscribe_to_fundFinancialSubscribe (aplicar) to a fund on BTG
-
tokenize_cardFinancialTokenize a card into the Braspag vault / Cartão Protegido (POST /card). Returns a reusable token that can substitute CardNumber on future sales — reduces PCI scope and enables c...
-
track_paymentFinancialNotify Legiti of a payment-method-level event (authorization attempt, capture, refund, void). Distinct from track_sale, which is order-level. Use this when you process payments ...
-
verify_payment_methodFinancialRun a credit-card verification (zero-auth or $1 auth) on a tokenized payment method via verifyPaymentMethod. Returns a CreditCardVerification with status and processor response....
-
void_authorizationFinancialVoid (release) an unsettled authorization via POST /v2/payments/authorizations/{id}/void. Use when funds were authorized but will not be captured. Returns 204 No Content on succ...
-
void_paymentFinancialVoid/annul a payment
-
void_transactionFinancialVoid a transaction
-
webpay_capture_transactionFinancialDeferred-capture for a previously authorized Webpay Plus transaction. Uses the official PUT /capture endpoint — prefer this over webpay_increase_amount for standard deferred-cap...
-
webpay_increase_amountFinancialCapture a previously authorized Webpay Plus transaction (partial-capture / deferred-capture flow).
-
webpay_mall_capture_transactionFinancialDeferred-capture for one child seller inside a Webpay Mall transaction.
-
zero_authFinancialZero-dollar authorization to validate a card without charging (card or CardToken)
-
activate_subscriptionFinancialReactivate a suspended subscription. Endpoint: POST /subscriptions/:id/activate
-
add_to_blocklistDestructiveAdd a value to the Konduto blocklist. Any future order matching the value is auto-declined. Useful for known-bad emails, IPs, tax IDs, or card BIN+last4 pairs observed in confir...
-
apply_paymentFinancialApply a payment method to the checkout session. Supports card, AP2 token, or x402.
-
authorize_creditFinancialAuthorize a credit-card payment on Getnet. Set delayed=false to authorize+capture atomically; delayed=true to authorize only (use capture_credit later).
-
capture_authorizationFinancialCapture a previously authorized payment via POST /v2/payments/authorizations/{id}/capture. Pass an amount object for partial captures, or omit to capture the full authorized amo...
-
checkout_cartFinancialCheckout all items in the cart and pay
-
complete_checkoutFinancialComplete an ACP checkout by submitting a payment token. Finalizes the order with the seller. The checkout must be in
-
complete_draft_orderFinancialConvert a draft order into a real order. Optionally mark as paid or send invoice.
-
create_accountFinancialCreate a digital account for an end user (CPF holder) on Dock. Returns the account id, agency, and account number. Account holds funds that can be moved via Pix or spent via iss...
-
create_account_payableFinancialCreate an account payable (conta a pagar)
-
create_account_receivableFinancialCreate an account receivable (conta a receber)
-
create_advanced_paymentFinancialCreate a marketplace split payment with per-recipient disbursements (application_fee, money_release_days, collector_id per seller)
-
create_anticipationFinancialRequest anticipation of receivables for a recipient (antecipação)
-
create_automatic_paymentFinancialCreate a Khipu automatic payment (recurring / subscription charge against a previously enrolled subscription_id). The payer must have completed the subscription enrollment at th...
-
create_balance_accountFinancialOpen a new currency balance account on a profile (e.g. open a EUR balance to hold euros).
-
create_bank_accountFinancialStore a customer bank account (POST /customers/{customer_id}/bankaccounts). Required before you can run destination_id-based payouts to that customer
-
create_bank_transactionFinancialCreate a bank transaction (SPEND = money out, RECEIVE = money in) directly on a bank account — for transactions without a matching invoice/bill (fees, transfers, one-off expenses).
-
create_batch_paymentFinancialSubmit a batch of B2P transfers in a single request. Each item is an independent transfer to a PicPay user; PicPay processes them asynchronously and notifies per-item via callback.
-
create_batch_payoutFinancialCreate a batch payout via POST /v1/payments/payouts. sender_batch_header carries metadata; items is an array of payout_item objects each with recipient_type, amount { currency, ...
-
create_beneficiaryFinancialCreate a transfer beneficiary (recipient) with bank details. Required before sending cross-border payouts via create_transfer. Entity type, bank details fields, and required IDs...
-
create_billFinancialCreate a bill (AP / money owed to a vendor). VendorRef and at least one Line (AccountBasedExpenseLineDetail or ItemBasedExpenseLineDetail) are required.
-
create_boletoFinancialIssue a boleto via Bradesco Cobrança. Returns nosso_numero, linha_digitável, barcode, and PDF URL.
-
create_boleto_saleFinancialConvenience wrapper to create a Boleto sale (POST /sales with Payment.Type=Boleto). Returns BarCodeNumber, DigitableLine, ExpirationDate, and Url for the rendered boleto. Provid...
-
create_brcode_paymentFinancialPay a BR Code (Pix QR code / copia-e-cola)
-
create_buy_transactionFinancialCreate a buy transaction (fiat -> crypto). The returned object contains status plus — depending on method — redirect URL for hosted checkout, Pix QR data, or card auth next steps.
-
create_cardFinancialRegister card data for on-ramp payments
-
create_card_tokenFinancialTokenize a card for use in DIRECT-flow create_payment. Use the returned token in the card.token field instead of raw PAN. Required for PCI scope reduction.
-
create_cart_mandateFinancialCreate an AP2 cart mandate — a signed, locked-cart commitment from a merchant binding line items, totals, and merchant attestation.
-
create_cash_entryFinancialCreate a bank account ledger entry (lançamento de conta corrente) in Omie ERP
-
create_checkoutFinancialCreate a reusable hosted checkout — think product-page-style link that can be paid multiple times. Good for evergreen SKUs and donation pages.
-
create_checkout_pageFinancialCreate a Rapyd hosted checkout page. Returns a redirect_url the payer opens in a browser. Rapyd renders the appropriate local methods (cards, cash pickup, bank transfer, wallets...
-
create_checkout_sessionFinancialCreate a hosted Checkout Session. Returns a url the customer completes payment on. Use mode=
-
create_cobFinancialCreate an immediate Pix charge (cobranca imediata)
-
create_cobvFinancialCreate a Pix due charge (cobranca com vencimento). If txid omitted, server-generated.
-
create_consentFinancialCreate a payment consent that the payer will authorize at their bank. Iniciador endpoint: POST /consents.
-
create_conversionFinancialExecute an FX conversion between wallet currencies (e.g. swap USD received into BRL before settling locally). Pass quote_id for a locked quoted rate, or omit for a market rate.
-
create_credit_noteFinancialIssue a credit note (Nota de Crédito A/B/C: types 3, 8, 13) referencing an original invoice
-
create_crypto_withdrawalFinancialCreate a crypto withdrawal to an external wallet address
-
create_debitFinancialCreate a debit card sale in Cielo (requires 3DS authentication)
-
create_debit_noteFinancialIssue a debit note (Nota de Débito A/B/C: types 2, 7, 12) referencing an original invoice
-
create_devolucaoFinancialRequest a Pix devolution (refund) on a received Pix transaction
-
create_donationFinancialCreate a round-up donation linked to an original payment (Adyen Giving).
-
create_estimateFinancialCreate an estimate (quote). CustomerRef and Line items required. Estimates can later be converted to invoices.
-
create_ewalletFinancialCreate a digital wallet payment (Google Pay, Samsung Pay, Apple Pay)
-
create_external_accountFinancialRegister a fiat receiver account (BRL Pix, USD wire, EUR SEPA, MXN SPEI). Skippable for BRL Pix payouts — pass pix_key + document directly on /payout instead.
-
create_giftcardFinancialCreate a gift card for a customer (GiftCard Hub)
-
create_installment_planFinancialCreate a Peruvian cuotas (installment) plan on a charge. Enables splitting a card payment into N monthly installments, with or without interest, per the issuer
-
create_intent_mandateFinancialCreate an AP2 intent mandate — a Verifiable Credential expressing the user
-
create_invoiceFinancialCreate an electronic invoice (Factura Electrónica) via AFIP
-
create_invoice_batchFinancialCreate a batch of invoices in a single CAE request (FECAESolicitar, up to 250)
-
create_linkFinancialCreate a link to a financial institution
-
create_mass_payoutFinancialCreate a mass payout — multiple payouts in a single batch request.
-
create_nfceFinancialCreate and emit an NFCe (nota fiscal do consumidor eletronica)
-
create_nfeFinancialCreate and emit an NFe (nota fiscal eletronica)
-
create_nfseFinancialCreate and emit an NFSe (nota fiscal de servico)
-
create_numtokenFinancialCreate a numtoken (Getnet card-on-file PAN-level token). Use for recurring or one-click-checkout flows where the merchant stores the numtoken and later hydrates it via tokenize_...
-
create_openfinance_consentFinancialCreate an Open Finance consent (BACEN-regulated) for data access or payment initiation against a third-party
-
create_orderFinancialCreate a buy or sell order
-
create_payoutFinancialCreate a payout from Circle (USDC to fiat)
-
create_paywallFinancialCreate a x402 paywall configuration for an endpoint. When requests hit this endpoint, they receive HTTP 402 with payment instructions.
-
create_pixFinancialCreate a Pix payment in Cielo (generates QR code)
-
create_pix_automaticoFinancialRegister a Pix Automático recurrence (BCB 2025 recurring Pix product, /rec). The payer authorizes the merchant to pull recurring amounts on a schedule. Matera is one of the few ...
-
create_pix_cobFinancialCreate an immediate Pix charge (cob) with QR code. Returns txid, EMV copy-paste payload, and location URL. BACEN Pix v2 standard.
-
create_pix_cobvFinancialCreate a Pix charge with due date (cobv) — used for boleto-like Pix where the payer can pay at or after a due date with optional fine/interest. Returns txid, copy-paste EMV payl...
-
create_pix_devolucaoFinancialRefund (devolução) a previously received Pix. Must reference the original endToEndId and a merchant-side refund id.
-
create_pix_devolutionFinancialCreate a Pix devolução (refund) — refund a received Pix transaction
-
create_pix_evpFinancialCreate a random Pix key (EVP/alias)
-
create_pix_keyFinancialRegister a Pix key (CPF/CNPJ, email, phone, or EVP/random)
-
create_pix_paymentFinancialInitiate an outbound Pix transfer (ordem de pagamento). Moves money from a debtor account held on Matera to any Pix key in BR. Returns endToEndId once the BCB SPI confirms.
-
create_pix_qrFinancialCreate a dynamic Pix charge with QR code (cob). Returns the txid, copy-paste EMV payload, and location URL.
-
create_pix_qr_dynamicFinancialCreate a dynamic Pix QR (single-use, expiring). Returns txid, EMV payload, and QR image. Preferred for e-commerce checkouts and invoices.
-
create_pix_qr_staticFinancialCreate a static Pix QR (reusable, tied to a merchant Pix key). Returns EMV copy-paste payload and QR image. Use for points-of-sale or donations where the same QR is shown to man...
-
create_pix_qrcodeFinancialGenerate a static PIX QR code for receiving payments
-
create_pix_requestFinancialCreate a Pix payment request
-
create_pix_saleFinancialConvenience wrapper to create a Pix sale (POST /sales with Payment.Type=Pix). Returns a QrCodeBase64Image and QrCodeString (Pix copia e cola) that the merchant can display. Bras...
-
create_pix_withdrawalFinancialCreate a Pix withdrawal (BRL) to a Pix key
-
create_preauth_paymentFinancialCreate a NuPay payment using a pre-authorized Bearer access_token (pre-auth / recurrence flow). Same body as create_payment, but auth is Bearer instead of merchant-key. Use afte...
-
create_preferenceFinancialCreate a checkout preference for Checkout Pro
-
create_purchaseFinancialCreate a purchase document
-
create_purchase_orderFinancialCreate a purchase order (pedido de compra) in Bling
-
create_push_paymentFinancialSend a push payment notification to a Nequi user
-
create_qr_paymentFinancialGenerate a QR code for payment
-
create_quoteFinancialLock an FX + fee quote for a 5-minute TTL. Same endpoint for both on_ramp (fiat → stablecoin) and off_ramp (stablecoin → fiat). Pass amount on EITHER sender or receiver, not bot...
-
create_recurrenceFinancialCreate a native Rede recurrence (subscription). Rede handles retries and cardholder updates automatically.
-
create_recurrentFinancialCreate a recurrent payment schedule (POST /recurrentPayments). Used for subscriptions and any schedule where Braspag (not the merchant) drives the recurrence.
-
create_saleFinancialCreate a sale in Conta Azul
-
create_sale_3dsFinancialCreate a 3DS-authenticated credit sale (POST /sales). Same endpoint as create_sale but the CreditCard object carries ExternalAuthentication (Cavv, Xid/Eci, Version, ReferenceId)...
-
create_sale_with_3dsFinancialCreate a credit card sale using 3DS 2.0 authentication data (from 3DS flow)
-
create_sale_with_tokenFinancialCreate a credit card sale using a previously stored CardToken (avoids re-entering card data)
-
create_sales_receiptFinancialCreate a sales receipt (paid-on-the-spot sale — combines invoice + payment). CustomerRef and Line items required.
-
create_sell_transactionFinancialCreate a sell transaction (crypto -> fiat). Used for agents that need to pay out in local fiat after receiving crypto.
-
create_settlement_reportFinancialManually generate a settlement (account money) report for a date range. Returns 202; poll the report list endpoint to download when ready.
-
create_splitFinancialConfigure a marketplace split rule that routes part of a payment to a subseller. Values are cents; percentages are integers 0-100.
-
create_split_captureFinancialCapture a previously authorized split sale with overridden per-sub-merchant amounts (PUT /sales/{paymentId}/capture with a SplitPayments body). Use when the original split mix n...
-
create_split_ruleFinancialConfigure split distribution for an existing charge. Each rule routes a portion of the charge to a receiver (onboard receivers via the Portal first).
-
create_split_saleFinancialCreate a sale with marketplace split rules (POST /sales with Payment.SplitPayments). Same endpoint as create_sale, but exposes the split array shape explicitly: each element has...
-
create_static_qrFinancialGenerate a static (reusable) Nequi QR code for a merchant
-
create_subaccountFinancialCreate a subaccount for payment splitting
-
create_swapFinancialCreate an onchain swap between two assets. Endpoint set provisional, expand once docs stabilize.
-
create_tax_paymentFinancialPay a tax (DARF, GPS, GRU, etc.) by barcode / digitable line
-
create_terminal_sessionFinancialCreate a Khipu terminal session for in-person / POS bank-transfer checkout. Returns a QR/URL the payer scans at the point of sale to pay from their bank app.
-
create_tokenFinancialTokenize a card (POST /tokens). Returns a token id like tkn_xxx. Tokenization is typically done client-side via culqi.js or mobile SDKs; this tool is primarily for test scripts ...
-
create_token_cardFinancialTokenize a credit card for secure payments
-
create_tokenized_cardFinancialTokenize a credit/debit card
-
create_tokenized_nequiFinancialTokenize a Nequi wallet (start async tokenization by phone number)
-
create_topupFinancialCreate a mobile/service top-up (recarga) via Celcoin
-
create_transactionFinancialCreate a payment transaction
-
create_utility_paymentFinancialPay a utility bill (e.g. water, electricity) by barcode / digitable line
-
create_walletFinancialCreate a new Circle business-account wallet
-
create_withdrawalFinancialCreate a withdrawal request (crypto or fiat)
-
create_zero_authFinancialZero-dollar authorization / card validation (POST /zeroauth). Braspag routes a $0 (or minimum-amount) authorization through the acquirer to confirm the card is live and not bloc...
-
disable_recurrenceFinancialDisable (cancel) an active recurrence. Stops all future billings.
-
disable_recurrentFinancialDeactivate a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Deactivate). Stops future charges; does not refund historical ones.
-
disable_stored_payment_methodDestructiveDelete a stored payment method (shopper opt-out).
-
generate_dynamic_qrcodeFinancialGenerate a dynamic PicPay Pay QR code with a fixed amount and optional expiration. Each QR is single-purpose. Returns qrcode content + base64 image and a paymentUrl.
-
initiate_checkoutFinancialStart the checkout process for a cart. Returns a checkout session with payment options.
-
issue_cardFinancialIssue a card (debit / credit / prepaid / virtual) against a Dock account. Card issuing is Dock
-
mark_order_fraudulentFinancialReport a confirmed chargeback / fraud outcome back to Legiti. This is Legiti
-
oneclick_create_inscriptionFinancialStart a OneClick Mall card-enrollment flow. Returns { token, url_webpay } — redirect the user to complete enrollment. After return to response_url, call oneclick_finish_inscript...
-
register_beneficiaryFinancialRegister a beneficiary account
-
register_boletoFinancialIssue a boleto via BB Cobranças. Returns nosso_numero, linha digitável, barcode, and PDF URL.
-
resolve_key_claimFinancialResolve a pending DICT key claim (confirm or cancel) — POST /dict/keys/claims/{id}/resolve
-
schedule_paymentFinancialSchedule a future-dated payment (Pix, boleto, arrecadação, or TED). Itaú executes the debit on the scheduled date at D+0 cut-off.
-
schedule_pixFinancialSchedule a future-dated PIX transfer
-
send_chargebackFinancialSend a $chargeback event to Sift
-
send_pixFinancialInitiate an outbound Pix payment from the merchant
-
send_tedFinancialSend a TED transfer to an account at another bank. Same-day settlement within banking hours; otherwise queued.
-
submit_for_settlementFinancialSubmit a previously authorized transaction for settlement via submitTransactionForSettlement. Unlike capture_transaction (captureTransaction), this marks the transaction for the...
-
suspend_subscriptionFinancialSuspend a subscription. Endpoint: POST /subscriptions/:id/suspend
-
update_amountFinancialUpdate the authorized amount of an unsettled payment (common in tips / hotel incidentals).
-
update_payment_linkFinancialUpdate a payment link
-
update_quoteFinancialUpdate a Wise quote (e.g. attach a recipient via targetAccount, or change payOut). Returns the updated quote with refreshed paymentOptions.
-
update_recurrenceFinancialUpdate an existing recurrence — change amount, card (storageCard), end date, or pause/resume. Pass only the fields you want to change.
-
update_recurrent_amountFinancialUpdate the charged amount on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Amount). Body carries the new amount in cents.
-
update_recurrent_next_dateFinancialUpdate the next charge date of an existing recurrent payment
-
update_recurrent_next_paymentFinancialUpdate the NextPaymentDate on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/NextPaymentDate). Useful to skip a cycle or realign billing dates. Body carries th...
-
update_recurrent_paymentFinancialUpdate the Payment (CreditCard + Customer) on a recurrent schedule (PUT /recurrentPayments/{recurrentPaymentId}/Payment). Used when the card on file expires or the customer upda...
-
update_subscriptionFinancialUpdate a subscription. Accepts any Chargebee subscription fields (plan_id, plan_quantity, coupon_ids, addons, billing_cycles, etc.)
-
webpay_commit_transactionFinancialCommit a Webpay Plus transaction after the user has returned from the Webpay flow. Must be called to actually charge the card.
-
webpay_create_transactionFinancialCreate a Webpay Plus transaction. Returns { token, url } — redirect the user to url?token_ws=<token> to complete payment. After the user returns to return_url, call webpay_commi...
-
webpay_mall_commit_transactionFinancialCommit a Webpay Mall transaction after the user has returned. Charges all child commerce codes at once.
-
webpay_mall_create_transactionFinancialCreate a Webpay Mall transaction — one parent buy_order split across several seller commerce codes. Returns { token, url } exactly like Webpay Plus. Each details entry is a chil...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.