Customers
Register and verify a customer
Create the person or organisation you will charge, and attach a way to charge them.
A customer is a consumer or an organisation. One creation covers both, the arm you send says which, and the fields differ because the two are genuinely different things: a person has a name, an organisation has a business number and people acting for it.
referenceCustomerId is your own identifier and it is the idempotency key reusing it with a different email is refused rather than silently updating someone. Send it.
Request
curl -X POST "https://api.tst.au.apgpay.dev/bezel/customers" \
-H "Authorization: Bearer $API_SECRET_KEY" \
-H "Content-Type: application/json" \
-d '{
"merchantId": "<useMerchantIdFromSeed>",
"givenName": "Priya",
"middleName": null,
"familyName": "Raman",
"emailAddress": "priya.raman@example.com",
"phoneNumber": "+61412345678",
"referenceCustomerId": "crm-cust-5521",
"isVerified": null,
"type": "CustCmdCreateConsumer"
}'A source is a stored way to pay, a card, or a bank account for direct debit. It belongs to the customer and can be charged again without them present.
Request
curl -X POST "$VAULT_BASE_URL/sources" \
-H "Authorization: Bearer $API_PUBLISHABLE_KEY" \
-H "Content-Type: application/json" \
-d '{
"customerId": "<useCustomerIdFromStep1>",
"card": {
"cardNumber": "4111111111111111",
"cvc": "123",
"expiryMonth": 12,
"expiryYear": 2030,
"cardHolderName": "Priya Raman"
},
"scope": null,
"type": "PsrcCmdCreateCard"
}'A customer's personal details are screened before they reach you: what you can read depends on the credential you called with, so the same customer can legitimately look different to two callers.