> ## Documentation Index > Fetch the complete documentation index at: https://docs.yativo.com/llms.txt > Use this file to discover all available pages before exploring further. # Request access > Ask for Card Checkout to be enabled on your account Until access is approved, every other Card Checkout endpoint returns `403` with `code: card_checkout_not_enabled`. ``` POST https://api.yativo.com/api/v1/card-checkout/account/request-access ``` `note` is optional (up to 1,000 characters): tell us what your customers sell and to whom. Sending the request again while it is open changes nothing. See [Card Checkout](https://docs.yativo.com/yativo-fiat/card-checkout.md#request-access). ```bash cURL theme={null} curl -X POST 'https://api.yativo.com/api/v1/card-checkout/account/request-access' \ -H 'X-Api-Key: YOUR_API_KEY' \ -H 'X-Api-Secret: YOUR_API_SECRET' \ -H 'Idempotency-Key: 7b0f3c52-1e4d-4f7a-9a51-2f6c8d0e4b13' \ -H 'Content-Type: application/json' \ -d '{ "note": "We sell online courses to customers in the US and EU." }' ``` ## OpenAPI ````yaml openapi-fiat.yaml POST /card-checkout/account/request-access openapi: 3.0.3 info: title: Yativo Fiat API description: > The Yativo Fiat API enables businesses to manage customers, run KYC/KYB, send and receive cross-border payments, issue virtual accounts and virtual cards, accept card payments through Card Checkout, manage beneficiaries, and more. **Base URLs** | Environment | URL | |---|---| | Production | `https://api.yativo.com/api/v1` | | Sandbox | `https://smtp.yativo.com/api/v1` | **Authentication** Send `X-Api-Key` and `X-Api-Secret` on every request. Create keys in the dashboard under **Developers → API Keys**. Each key only works from the server IPs listed on it (enforced since 14 October 2026). Keys don't expire and there's no login call or token refresh. Login tokens (`POST /auth/login` with an Account ID and App Secret, and `Authorization: Bearer`) have been discontinued and don't work for API requests. Endpoints that change how a person signs in (passkeys, two-factor authentication, PIN) or delete the account can't be called with an API key. Use the dashboard for those. API keys and IP whitelists can only be managed in the dashboard. **Rate limits** Per business account: 20 writes (`POST`, `PUT`, `PATCH`, `DELETE`) and 50 reads (`GET`) a second. Some plans set their own limit. Enterprise plans have no general limit. **Idempotency** Send an `Idempotency-Key` header on every `POST`, `PUT`, `PATCH` and `DELETE` request. Use a new key for each distinct operation. Reusing a key for a completed request within 60 minutes returns `409`. Reusing a key with a different body also returns `409`. **KYC endpoints** are hosted on a separate platform at `https://kyc.yativo.com`. They are documented here for completeness but use that base URL, not the main API base. version: 1.0.0 contact: name: Yativo Support url: https://yativo.com servers: - url: https://api.yativo.com/api/v1 description: Production - url: https://smtp.yativo.com/api/v1 description: Sandbox security: - apiKey: [] apiSecret: [] tags: - name: Customers description: Create and manage customer profiles. - name: KYC / KYB description: > Identity verification for individual customers (KYC) and business customers (KYB). Submission endpoints are on `https://kyc.yativo.com/api`. - name: KYC Lookups description: > Lists your KYC and KYB forms need: countries, subdivisions, postal code formats, ID types, occupations, industries and allowed values. Served from `https://kyc.yativo.com/api`. - name: Payments & Transfers description: Exchange rates, quotes, payout methods, and wallet payouts. - name: Card Checkout description: >- Let your customers sell by debit and credit card on a Yativo-hosted checkout page. - name: Deposits description: Initiate and retrieve payin deposits. - name: Virtual Accounts description: Issue and manage virtual bank accounts for customers. - name: Wallets description: View balances, create wallets, and list wallet payouts. - name: Beneficiaries description: >- Save recipients' account details as beneficiaries and reuse them in payouts. - name: Transactions description: List, retrieve, track, and download receipts for all transaction types. - name: Virtual Cards description: >- Issue, manage, and terminate prepaid virtual cards. Every card request works only on your own cards. Any other card ID returns `404` with `Card not found`. - name: Payouts description: Single payouts to beneficiaries. - name: Currency Swap description: Swap balance between your own currency wallets. - name: IP Whitelist description: Check whether your server's IP can use your API key. - name: Corporate Cards description: >- Employees, their KYC, cards, card balances, memos and the USDC funding address. By invitation only. - name: Corporate Card Transactions description: Card activity on your corporate cards, with disputes, notes and invoices. - name: Corporate Card Links description: >- Each corporate card's employee-only page for card details and PIN, employee card sign-in, and branding. - name: Webhooks description: Register and manage webhook endpoints for real-time event notifications. - name: Sandbox description: Endpoints that exist only on the sandbox host. Production refuses them. - name: Developer description: Webhook event inspection. - name: RFIs description: >- Compliance requests for information; save draft answers via API (not auto-submitted upstream). paths: /card-checkout/account/request-access: post: tags: - Card Checkout summary: Request Card Checkout access description: > Ask for Card Checkout to be enabled on your account. `note` is optional (max 1,000 characters): tell us what your customers sell and to whom. The response is your account with `access_status: "requested"` (`202`). Sending the request again while it is open changes nothing. If access is already enabled you get `200` with `access_status: "enabled"`. See [Card Checkout](/yativo-fiat/card-checkout#request-access). parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: false content: application/json: schema: type: object properties: note: type: string maxLength: 1000 example: We sell online courses to customers in the US and EU. responses: '200': description: Already enabled content: application/json: schema: type: object properties: status: type: string example: success status_code: type: integer example: 200 message: type: string example: Card checkout is already enabled data: $ref: '#/components/schemas/CardCheckoutAccount' '202': description: Access requested content: application/json: schema: type: object properties: status: type: string example: success status_code: type: integer example: 202 message: type: string example: Access requested data: $ref: '#/components/schemas/CardCheckoutAccount' components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: true schema: type: string description: A unique string per request to ensure idempotent processing. schemas: CardCheckoutAccount: type: object properties: enabled: type: boolean description: Whether Card Checkout is enabled for your account. access_status: type: string enum: - requested - enabled - declined - disabled description: > `requested` — waiting for review. `enabled` — approved. `declined` — not approved; send a new request. `disabled` — access was turned off. currencies: type: array items: type: string example: - USD description: Currencies you can charge. Only `USD` is enabled today. payment_methods: type: array items: type: string example: - card - apple_pay - google_pay description: >- Methods you can offer on checkout. Pass a subset as `payment_methods` when you create an order. pricing: type: object properties: fee_percent: type: number example: 3.5 fee_fixed: type: string example: '0.30' description: Fixed fee in major units. reserve_percent: type: number example: 0 clearing_business_days: type: integer example: 3 description: US business days before `net_amount` becomes `available`. retention_days: type: integer example: 0 description: Days the reserve stays `on_hold`. settlement_delay_days: type: integer example: 3 description: Same value as `clearing_business_days`. balance: $ref: '#/components/schemas/CardCheckoutBalance' balance_by_customer: type: array description: >- The same split by the customer whose sales it came from. `customer_id` is `null` for amounts not tied to a customer. items: allOf: - $ref: '#/components/schemas/CardCheckoutBalance' - type: object properties: customer_id: type: string nullable: true example: 4f0c1e1a-8d2b-4c7e-9b1a-3e5f6a7b8c9d CardCheckoutBalance: type: object properties: currency: type: string example: USD available: type: string example: '120.50' description: >- Settled. Past the clearing and reserve periods. Negative when a refund or dispute is owed. on_hold: type: string example: '35.00' description: Still clearing or held in reserve. Not withdrawable. total: type: string example: '155.50' description: '`available` plus `on_hold`.' securitySchemes: apiKey: type: apiKey in: header name: X-Api-Key description: >- Your API key (`yativo_pk_...`) from Developers → API Keys. Send together with X-Api-Secret. apiSecret: type: apiKey in: header name: X-Api-Secret description: Your API secret (`yativo_sk_...`), shown once when the key is created. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.