DRAFTThe sandbox is not live yet. Every example here was returned by the platform's code in a test run on 2026-10-28, priced with example fees: no fee amount in them is an SMP price. Paths and fields can change before launch. Live keys are issued only after our bank program is approved.Sandbox not live yet · examples from a test run on 2026-10-28 · example fees

Reference · 15 operations

Partner program

Applications, sign-in and referral links for partners and their agents.

Partnershttps://partners.socialmatterspay.com
GET /v1/partners/application-fee

The application fee in force, shown before checkout (not refundable), with the program terms the application page states

No auth

Host https://partners.socialmatterspay.com

Responses

StatusMeaning
200OK

Fields of the response (200)

FieldNotes
objectstring = "partner_application_fee"—
requiredbooleanWhether an application fee is in force.
amount_centsintegerThe fee; 0 when none is in force.
currencystring = "USD"—
refundableboolean = false—
program_termsobject
3 child fields
pool_bpsinteger—
window_monthsinteger—
payoutsstring—
Example

The partner application fee and whether it's refundable

GET /v1/partners/application-fee
curl https://partners.socialmatterspay.com/v1/partners/application-fee
Response · 200
HTTP 200
Cache-Control: no-store

{
  "object": "partner_application_fee",
  "required": true,
  "amount_cents": 29900,
  "currency": "USD",
  "refundable": false,
  "program_terms": {
    "pool_bps": 2500,
    "window_months": 24,
    "payouts": "monthly on the 1st for the prior calendar month"
  }
}
POST /v1/partners/apply

Apply to become a partner (owner login is created with the application)

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
legal_name requiredstring—
display_namestring—
entity_type requiredenumone of individual, business
contact_name requiredstring—
email requiredstring (email)—
password requiredstring—
phonestring—
website_urlstring—
acquisition_descriptionstring—
tax_idstring—
fee_debit_account requiredobjectThe account SMP may debit for partner fees commissions don't cover (sealed on arrival)
4 child fields
account_number requiredstring—
routing_number requiredstring—
account_type requiredenumone of checking, savings
account_holder_name requiredstring—
fee_debit_authorization requiredobjectAcceptance of the exact words from POST /v1/partners/fee-debit-authorization/preview (CCD for a business, PPD for an individual)
4 child fields
accepted requiredboolean = true—
signer_name requiredstring—
signer_titlestring—
text_sha256 requiredstring—

Responses

StatusMeaning
201Pending: reviewed once the $299 application fee is paid on the checkout_url (Finix or Whop)
400Error — error shape and codes
409Error — error shape and codes
503Error — error shape and codes

Fields of the response (201)

FieldNotes
partner_idstring—
statusstring = "pending"—
application_feeobject | null
6 child fields
providerenumone of whop, finix
amount_centsinteger—
currencystring—
statusenumone of awaiting_payment, paid
checkout_urlstring | nullWhere the applicant pays by card (Finix or Whop); SMP never sees the card
paid_atstring | null (date-time)—
fee_debit_authorizationobjectThe authorization the application accepted, by its words' SHA-256
3 child fields
entry_codeenumone of CCD, PPD
account_last4string—
text_sha256string—
Example

Apply as a partner

POST /v1/partners/apply
curl -X POST https://partners.socialmatterspay.com/v1/partners/apply \
  -H 'Content-Type: application/json' \
  -d '{
  "legal_name": "Ridgeline Advisory LLC",
  "display_name": "Ridgeline",
  "entity_type": "business",
  "contact_name": "Morgan Ellis",
  "email": "morgan@ridgeline.example",
  "password": "correct horse battery staple",
  "website_url": "https://ridgeline.example",
  "acquisition_description": "Bookkeeping clients that bill by invoice",
  "fee_debit_account": {
    "account_number": "000222333444",
    "routing_number": "110000000",
    "account_type": "checking",
    "account_holder_name": "Ridgeline Advisory LLC"
  },
  "fee_debit_authorization": {
    "accepted": true,
    "signer_name": "Morgan Ellis",
    "signer_title": "Managing member",
    "text_sha256": "e34143589ec46d06db50db75854f9699b7e796f6db518f607ed6da17da6aa42f"
  }
}'
Response · 201
HTTP 201
Cache-Control: no-store

{
  "partner_id": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
  "status": "pending",
  "application_fee": {
    "provider": "whop",
    "amount_cents": 29900,
    "currency": "USD",
    "status": "awaiting_payment",
    "checkout_url": "https://whop.com/checkout/ch_e2e000001",
    "paid_at": null
  },
  "fee_debit_authorization": {
    "entry_code": "CCD",
    "account_last4": "3444",
    "text_sha256": "e34143589ec46d06db50db75854f9699b7e796f6db518f607ed6da17da6aa42f"
  }
}
POST /v1/partners/fee-debit-authorization/preview

The exact authorization words for an account (show them; send their text_sha256 back with the acceptance)

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
entity_type requiredenumone of individual, business
account_holder_name requiredstring—
account_last4 requiredstringpattern ^\d{4}$

Responses

StatusMeaning
200entry_code, authorization_text and text_sha256
400Error — error shape and codes

Fields of the response (200)

FieldNotes
entry_codeenumPPD for an individual partner, CCD for a business. one of CCD, PPD
authorization_textstringThe exact words the signer is shown and accepts.
text_sha256stringThe SHA-256 of authorization_text, sent back with the acceptance to prove which text was shown.
Example

The words an applicant accepts

POST /v1/partners/fee-debit-authorization/preview
curl -X POST https://partners.socialmatterspay.com/v1/partners/fee-debit-authorization/preview \
  -H 'Content-Type: application/json' \
  -d '{
  "entity_type": "business",
  "account_holder_name": "Ridgeline Advisory LLC",
  "account_last4": "3444"
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "entry_code": "CCD",
  "authorization_text": "Ridgeline Advisory LLC authorizes Social Matter Payments LLC to initiate ACH debit entries (CCD) to the business bank account ending in 3444 for fees and other amounts Ridgeline Advisory LLC owes Social Matter Payments LLC under the partner agreement that its commission payouts from Social Matter Payments LLC do not cover. The amount of each debit appears on Ridgeline Advisory LLC's statement before the debit is made. This authorization stays in effect until Social Matter Payments LLC receives written notice of revocation at work@socialmatters.pro in time to act on it. Revoking it does not cancel amounts already owed.",
  "text_sha256": "e34143589ec46d06db50db75854f9699b7e796f6db518f607ed6da17da6aa42f"
}
POST /webhooks/whop

Whop payment.succeeded for an application fee (Standard Webhooks signature; the payment is read back from Whop)

No auth

Host https://partners.socialmatterspay.com

Responses

StatusMeaning
200Received (a repeat delivery answers duplicate true and does nothing)
401Error — error shape and codes
503Error — error shape and codes

Fields of the response (200)

FieldNotes
receivedboolean = true—
confirmedintegerHow many application fee payments this event confirmed. Absent on a repeat of an event already handled.
duplicateboolean = truePresent only on a repeat of an event already handled.
Example

Whop confirms the application fee was paid

POST /webhooks/whop
curl -X POST https://partners.socialmatterspay.com/webhooks/whop \
  -H 'webhook-id: msg_example0001' \
  -H 'webhook-timestamp: 1793146957' \
  -H 'webhook-signature: v1,W91vY9SBykVSPcYxzEaNNkLw1oORzuTwYRP4R41ldY0=' \
  -H 'Content-Type: application/json' \
  -d '{
  "type": "payment.succeeded",
  "api_version": "v1",
  "data": {
    "id": "pay_example0001"
  }
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "received": true,
  "confirmed": 1
}
POST /webhooks/finix

Finix transfer_attempt event for the application-fee payment link (Finix-Signature; the attempt is read back from Finix)

No auth

Host https://partners.socialmatterspay.com

Responses

StatusMeaning
200Received (a repeat delivery answers duplicate true and does nothing)
401Error — error shape and codes
503Error — error shape and codes

Fields of the response (200)

FieldNotes
receivedboolean = true—
confirmedintegerHow many application fee payments this event confirmed. Absent on a repeat of an event already handled.
duplicateboolean = truePresent only on a repeat of an event already handled.
Example

Finix reports a payment on the application-fee link

POST /webhooks/finix
curl -X POST https://partners.socialmatterspay.com/webhooks/finix \
  -H 'Finix-Signature: timestamp=1793146958, sig=d9bb260b9f14fffb1c74f6b8920fefe47876c3c921f94c34b781a4902e847049' \
  -H 'Content-Type: application/json' \
  -d '{
  "id": "event_example1",
  "type": "created",
  "entity": "transfer_attempt",
  "occurred_at": "2026-10-28T00:22:38.515Z",
  "_embedded": {
    "transfer_attempts": [
      {
        "id": "transfer_attempt_example1"
      }
    ]
  }
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "received": true,
  "confirmed": 1
}
POST /v1/partners/login

Step 1 of signing in as a partner owner or agent: a right password returns a two-step challenge; five failures in a row lock the login for 15 minutes

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
email requiredstring (email)—
password requiredstring—

Responses

StatusMeaning
200OK
400Error — error shape and codes

Fields of the response (200)

FieldNotes
objectstring = "sign_in_challenge"—
challengestringThe one-time token to send back with the code. It expires at expires_at.
stepenumenroll for a login that has not set up its authenticator yet (it carries secret and otpauth_uri); verify once it has. one of enroll, verify
expires_atstring (date-time)—
secretstringThe new authenticator secret, present only when step is enroll.
otpauth_uristringThe otpauth link for the authenticator app, present only when step is enroll.
roleenumWhether the login is the partner's owner or one of its agents. one of owner, agent
Example

Partner sign-in, step 1: the password (the first time, an authenticator is enrolled)

POST /v1/partners/login
curl -X POST https://partners.socialmatterspay.com/v1/partners/login \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "morgan@ridgeline.example",
  "password": "correct horse battery staple"
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "object": "sign_in_challenge",
  "challenge": "sign_in_challenge",
  "step": "enroll",
  "expires_at": "2026-10-28T00:32:38.030Z",
  "secret": "authenticator_secret",
  "otpauth_uri": "otpauth://totp/Social%20Matter%20Payments%3Amorgan%40ridgeline.example?secret=authenticator_secret&issuer=Social%20Matter%20Payments&algorithm=SHA1&digits=6&period=30",
  "role": "owner"
}
POST /v1/partners/logout

Revoke the bearer session

Partner session

Host https://partners.socialmatterspay.com

Responses

StatusMeaning
200OK
401Error — error shape and codes

Fields of the response (200)

FieldNotes
logged_outboolean = true—
Example

Sign out

POST /v1/partners/logout
curl -X POST https://partners.socialmatterspay.com/v1/partners/logout \
  -H 'Authorization: Bearer partner_session_token'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "logged_out": true
}
GET /v1/partners/session

The signed-in partner owner

Partner session

Host https://partners.socialmatterspay.com

Responses

StatusMeaning
200OK
401Error — error shape and codes

Fields of the response (200)

FieldNotes
userobject
5 child fields
userIdstring—
roleenumone of owner, agent
partnerIdstring—
agentIdstring | nullThe agent's id; null for the partner's owner.
emailstring—
Example

Who is signed in

GET /v1/partners/session
curl https://partners.socialmatterspay.com/v1/partners/session \
  -H 'Authorization: Bearer partner_session_token'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "user": {
    "userId": "1e0cc508-9983-4120-8228-3fcea3caf9b2",
    "role": "owner",
    "partnerId": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
    "agentId": null,
    "email": "morgan@ridgeline.example"
  }
}
GET /v1/agents/session

The signed-in agent

Agent session

Host https://partners.socialmatterspay.com

Responses

StatusMeaning
200OK
401Error — error shape and codes

Fields of the response (200)

FieldNotes
userobject
5 child fields
userIdstring—
roleenumone of owner, agent
partnerIdstring—
agentIdstring | nullThe agent's id; null for the partner's owner.
emailstring—
Example

Agent session

GET /v1/agents/session
curl https://partners.socialmatterspay.com/v1/agents/session \
  -H 'Authorization: Bearer agent_session_token'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "user": {
    "userId": "1c9fbf65-7fbb-4262-89d9-bb7ab50525a6",
    "role": "agent",
    "partnerId": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
    "agentId": "62a14022-b94b-4d55-b7d7-bd0eb19611c2",
    "email": "sam@ridgeline.example"
  }
}
POST /v1/agents/accept-invite

An invited agent sets a password and becomes active

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
token requiredstring—
password requiredstring—

Responses

StatusMeaning
200OK
400Error — error shape and codes

Fields of the response (200)

FieldNotes
agent_idstring—
statusstring = "active"—
sign_inobjectThe second sign-in step, opened after a right password (or a password just set). Enter the authenticator code, or a backup code, at the verify-login operation with this challenge.
7 child fields
objectstring = "sign_in_challenge"—
challengestringThe one-time token to send back with the code. It expires at expires_at.
stepenumenroll for a login that has not set up its authenticator yet (it carries secret and otpauth_uri); verify once it has. one of enroll, verify
expires_atstring (date-time)—
secretstringThe new authenticator secret, present only when step is enroll.
otpauth_uristringThe otpauth link for the authenticator app, present only when step is enroll.
roleenumWhether the login is the partner's owner or one of its agents. one of owner, agent
Example

The agent sets a password (the answer enrols an authenticator)

POST /v1/agents/accept-invite
curl -X POST https://partners.socialmatterspay.com/v1/agents/accept-invite \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "agent_invite_token",
  "password": "correct horse battery staple"
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "agent_id": "62a14022-b94b-4d55-b7d7-bd0eb19611c2",
  "status": "active",
  "sign_in": {
    "object": "sign_in_challenge",
    "challenge": "sign_in_challenge",
    "step": "enroll",
    "expires_at": "2026-10-28T00:32:38.090Z",
    "secret": "authenticator_secret",
    "otpauth_uri": "otpauth://totp/Social%20Matter%20Payments%3Asam%40ridgeline.example?secret=authenticator_secret&issuer=Social%20Matter%20Payments&algorithm=SHA1&digits=6&period=30",
    "role": "agent"
  }
}
POST /v1/partners/login/verify

Step 2 of signing in: an authenticator code (or a backup code); enrolment returns 10 backup codes once

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
challenge requiredstring—
codestringpattern ^[0-9]{6}$
backup_codestring—

Responses

StatusMeaning
200OK
400Error — error shape and codes
401Error — error shape and codes
429Error — error shape and codes

Fields of the response (200)

FieldNotes
tokenstringThe session bearer token. Shown once; only its hash is kept.
expires_atstring (date-time)—
roleenumone of owner, agent
partner_idstring—
agent_idstring | nullThe agent's id; null for the partner's owner.
backup_codesarray of stringTen one-time backup codes, shown once. Present only on the sign-in that enrolled the authenticator.
Example

Partner sign-in, step 2: the authenticator code

POST /v1/partners/login/verify
curl -X POST https://partners.socialmatterspay.com/v1/partners/login/verify \
  -H 'Content-Type: application/json' \
  -d '{
  "challenge": "sign_in_challenge",
  "code": "123456"
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "token": "partner_session_token",
  "expires_at": "2026-10-28T12:22:38.033Z",
  "role": "owner",
  "partner_id": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
  "agent_id": null,
  "backup_codes": [
    "backup_code_11",
    "backup_code_12",
    … 8 more
  ]
}
POST /v1/partners/password/set

Choose a password from a one-time link, then go on to the second step

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
token requiredstring—
password requiredstringat least 12 characters

Responses

StatusMeaning
200OK
400Error — error shape and codes
410Error — error shape and codes

Fields of the response (200)

FieldNotes
objectstring = "sign_in_challenge"—
challengestringThe one-time token to send back with the code. It expires at expires_at.
stepenumenroll for a login that has not set up its authenticator yet (it carries secret and otpauth_uri); verify once it has. one of enroll, verify
expires_atstring (date-time)—
secretstringThe new authenticator secret, present only when step is enroll.
otpauth_uristringThe otpauth link for the authenticator app, present only when step is enroll.
roleenumWhether the login is the partner's owner or one of its agents. one of owner, agent
Example

Set the password from the link; the answer enrols an authenticator

POST /v1/partners/password/set
curl -X POST https://partners.socialmatterspay.com/v1/partners/password/set \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "one_time_link_token",
  "password": "the agent password, set again"
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "object": "sign_in_challenge",
  "challenge": "sign_in_challenge",
  "step": "enroll",
  "expires_at": "2026-10-28T00:32:38.433Z",
  "secret": "authenticator_secret",
  "otpauth_uri": "otpauth://totp/Social%20Matter%20Payments%3Asam%40ridgeline.example?secret=authenticator_secret&issuer=Social%20Matter%20Payments&algorithm=SHA1&digits=6&period=30",
  "role": "agent"
}
POST /v1/partners/password/forgot

Email a reset link (60 minutes); the same answer whether or not the email has a login

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
email requiredstring (email)—

Responses

StatusMeaning
202OK
400Error — error shape and codes

Fields of the response (202)

FieldNotes
sent_if_knownboolean = trueAlways true, whether or not the email belongs to a login, so the answer does not reveal which emails exist.
Example

Forgot the password: a reset link by email (the same answer for any address)

POST /v1/partners/password/forgot
curl -X POST https://partners.socialmatterspay.com/v1/partners/password/forgot \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "sam@ridgeline.example"
}'
Response · 202
HTTP 202
Cache-Control: no-store

{
  "sent_if_known": true
}
POST /v1/partners/password/reset

Set a new password from a reset link; every session of the login ends

No auth

Host https://partners.socialmatterspay.com

Request body

FieldNotes
token requiredstring—
password requiredstringat least 12 characters

Responses

StatusMeaning
200OK
400Error — error shape and codes
410Error — error shape and codes

Fields of the response (200)

FieldNotes
password_resetboolean = true—
nextstring = "sign_in"—
Example

Set a new password from the reset link (the login’s sessions end)

POST /v1/partners/password/reset
curl -X POST https://partners.socialmatterspay.com/v1/partners/password/reset \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "one_time_link_token",
  "password": "a new long agent password"
}'
Response · 200
HTTP 200
Cache-Control: no-store

{
  "password_reset": true,
  "next": "sign_in"
}