GET /v1/partners/application-fee
The application fee in force, shown before checkout (not refundable), with the program terms the application page states
Host https://partners.socialmatterspay.com
Responses
| Status | Meaning |
|---|---|
200 | OK |
Fields of the response (200)
| Field | Notes | ||||||
|---|---|---|---|---|---|---|---|
objectstring = "partner_application_fee" | — | ||||||
requiredboolean | Whether an application fee is in force. | ||||||
amount_centsinteger | The fee; 0 when none is in force. | ||||||
currencystring = "USD" | — | ||||||
refundableboolean = false | — | ||||||
program_termsobject | 3 child fields
|
Example
The partner application fee and whether it's refundable
curl https://partners.socialmatterspay.com/v1/partners/application-fee
HTTP 200
Cache-Control: no-store
{
"object": "partner_application_fee",
"required": true,
"amount_cents": 29900,
"currency": "USD",
"refundable": false,
"program_terms": {
"pool_bps": 2500,
"window_months": 24,
"payouts": "monthly on the 1st for the prior calendar month"
}
}
POST /v1/partners/apply
Apply to become a partner (owner login is created with the application)
Host https://partners.socialmatterspay.com
Request body
| Field | Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|
legal_name requiredstring | — | ||||||||
display_namestring | — | ||||||||
entity_type requiredenum | one of individual, business | ||||||||
contact_name requiredstring | — | ||||||||
email requiredstring (email) | — | ||||||||
password requiredstring | — | ||||||||
phonestring | — | ||||||||
website_urlstring | — | ||||||||
acquisition_descriptionstring | — | ||||||||
tax_idstring | — | ||||||||
fee_debit_account requiredobject | The account SMP may debit for partner fees commissions don't cover (sealed on arrival)4 child fields
| ||||||||
fee_debit_authorization requiredobject | Acceptance of the exact words from POST /v1/partners/fee-debit-authorization/preview (CCD for a business, PPD for an individual)4 child fields
|
Responses
| Status | Meaning |
|---|---|
201 | Pending: reviewed once the $299 application fee is paid on the checkout_url (Finix or Whop) |
400 | Error — error shape and codes |
409 | Error — error shape and codes |
503 | Error — error shape and codes |
Fields of the response (201)
| Field | Notes | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
partner_idstring | — | ||||||||||||
statusstring = "pending" | — | ||||||||||||
application_feeobject | null | 6 child fields
| ||||||||||||
fee_debit_authorizationobject | The authorization the application accepted, by its words' SHA-2563 child fields
|
Example
Apply as a partner
curl -X POST https://partners.socialmatterspay.com/v1/partners/apply \
-H 'Content-Type: application/json' \
-d '{
"legal_name": "Ridgeline Advisory LLC",
"display_name": "Ridgeline",
"entity_type": "business",
"contact_name": "Morgan Ellis",
"email": "morgan@ridgeline.example",
"password": "correct horse battery staple",
"website_url": "https://ridgeline.example",
"acquisition_description": "Bookkeeping clients that bill by invoice",
"fee_debit_account": {
"account_number": "000222333444",
"routing_number": "110000000",
"account_type": "checking",
"account_holder_name": "Ridgeline Advisory LLC"
},
"fee_debit_authorization": {
"accepted": true,
"signer_name": "Morgan Ellis",
"signer_title": "Managing member",
"text_sha256": "e34143589ec46d06db50db75854f9699b7e796f6db518f607ed6da17da6aa42f"
}
}'
HTTP 201
Cache-Control: no-store
{
"partner_id": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
"status": "pending",
"application_fee": {
"provider": "whop",
"amount_cents": 29900,
"currency": "USD",
"status": "awaiting_payment",
"checkout_url": "https://whop.com/checkout/ch_e2e000001",
"paid_at": null
},
"fee_debit_authorization": {
"entry_code": "CCD",
"account_last4": "3444",
"text_sha256": "e34143589ec46d06db50db75854f9699b7e796f6db518f607ed6da17da6aa42f"
}
}
POST /v1/partners/fee-debit-authorization/preview
The exact authorization words for an account (show them; send their text_sha256 back with the acceptance)
Host https://partners.socialmatterspay.com
Request body
| Field | Notes |
|---|---|
entity_type requiredenum | one of individual, business |
account_holder_name requiredstring | — |
account_last4 requiredstring | pattern ^\d{4}$ |
Responses
| Status | Meaning |
|---|---|
200 | entry_code, authorization_text and text_sha256 |
400 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
entry_codeenum | PPD for an individual partner, CCD for a business. one of CCD, PPD |
authorization_textstring | The exact words the signer is shown and accepts. |
text_sha256string | The SHA-256 of authorization_text, sent back with the acceptance to prove which text was shown. |
Example
The words an applicant accepts
curl -X POST https://partners.socialmatterspay.com/v1/partners/fee-debit-authorization/preview \
-H 'Content-Type: application/json' \
-d '{
"entity_type": "business",
"account_holder_name": "Ridgeline Advisory LLC",
"account_last4": "3444"
}'
HTTP 200
Cache-Control: no-store
{
"entry_code": "CCD",
"authorization_text": "Ridgeline Advisory LLC authorizes Social Matter Payments LLC to initiate ACH debit entries (CCD) to the business bank account ending in 3444 for fees and other amounts Ridgeline Advisory LLC owes Social Matter Payments LLC under the partner agreement that its commission payouts from Social Matter Payments LLC do not cover. The amount of each debit appears on Ridgeline Advisory LLC's statement before the debit is made. This authorization stays in effect until Social Matter Payments LLC receives written notice of revocation at work@socialmatters.pro in time to act on it. Revoking it does not cancel amounts already owed.",
"text_sha256": "e34143589ec46d06db50db75854f9699b7e796f6db518f607ed6da17da6aa42f"
}
POST /webhooks/whop
Whop payment.succeeded for an application fee (Standard Webhooks signature; the payment is read back from Whop)
Host https://partners.socialmatterspay.com
Responses
| Status | Meaning |
|---|---|
200 | Received (a repeat delivery answers duplicate true and does nothing) |
401 | Error — error shape and codes |
503 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
receivedboolean = true | — |
confirmedinteger | How many application fee payments this event confirmed. Absent on a repeat of an event already handled. |
duplicateboolean = true | Present only on a repeat of an event already handled. |
Example
Whop confirms the application fee was paid
curl -X POST https://partners.socialmatterspay.com/webhooks/whop \
-H 'webhook-id: msg_example0001' \
-H 'webhook-timestamp: 1793146957' \
-H 'webhook-signature: v1,W91vY9SBykVSPcYxzEaNNkLw1oORzuTwYRP4R41ldY0=' \
-H 'Content-Type: application/json' \
-d '{
"type": "payment.succeeded",
"api_version": "v1",
"data": {
"id": "pay_example0001"
}
}'
HTTP 200
Cache-Control: no-store
{
"received": true,
"confirmed": 1
}
POST /webhooks/finix
Finix transfer_attempt event for the application-fee payment link (Finix-Signature; the attempt is read back from Finix)
Host https://partners.socialmatterspay.com
Responses
| Status | Meaning |
|---|---|
200 | Received (a repeat delivery answers duplicate true and does nothing) |
401 | Error — error shape and codes |
503 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
receivedboolean = true | — |
confirmedinteger | How many application fee payments this event confirmed. Absent on a repeat of an event already handled. |
duplicateboolean = true | Present only on a repeat of an event already handled. |
Example
Finix reports a payment on the application-fee link
curl -X POST https://partners.socialmatterspay.com/webhooks/finix \
-H 'Finix-Signature: timestamp=1793146958, sig=d9bb260b9f14fffb1c74f6b8920fefe47876c3c921f94c34b781a4902e847049' \
-H 'Content-Type: application/json' \
-d '{
"id": "event_example1",
"type": "created",
"entity": "transfer_attempt",
"occurred_at": "2026-10-28T00:22:38.515Z",
"_embedded": {
"transfer_attempts": [
{
"id": "transfer_attempt_example1"
}
]
}
}'
HTTP 200
Cache-Control: no-store
{
"received": true,
"confirmed": 1
}
POST /v1/partners/login
Step 1 of signing in as a partner owner or agent: a right password returns a two-step challenge; five failures in a row lock the login for 15 minutes
Host https://partners.socialmatterspay.com
Request body
| Field | Notes |
|---|---|
email requiredstring (email) | — |
password requiredstring | — |
Responses
| Status | Meaning |
|---|---|
200 | OK |
400 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
objectstring = "sign_in_challenge" | — |
challengestring | The one-time token to send back with the code. It expires at expires_at. |
stepenum | enroll for a login that has not set up its authenticator yet (it carries secret and otpauth_uri); verify once it has. one of enroll, verify |
expires_atstring (date-time) | — |
secretstring | The new authenticator secret, present only when step is enroll. |
otpauth_uristring | The otpauth link for the authenticator app, present only when step is enroll. |
roleenum | Whether the login is the partner's owner or one of its agents. one of owner, agent |
Example
Partner sign-in, step 1: the password (the first time, an authenticator is enrolled)
curl -X POST https://partners.socialmatterspay.com/v1/partners/login \
-H 'Content-Type: application/json' \
-d '{
"email": "morgan@ridgeline.example",
"password": "correct horse battery staple"
}'
HTTP 200
Cache-Control: no-store
{
"object": "sign_in_challenge",
"challenge": "sign_in_challenge",
"step": "enroll",
"expires_at": "2026-10-28T00:32:38.030Z",
"secret": "authenticator_secret",
"otpauth_uri": "otpauth://totp/Social%20Matter%20Payments%3Amorgan%40ridgeline.example?secret=authenticator_secret&issuer=Social%20Matter%20Payments&algorithm=SHA1&digits=6&period=30",
"role": "owner"
}
POST /v1/partners/logout
Revoke the bearer session
Host https://partners.socialmatterspay.com
Responses
| Status | Meaning |
|---|---|
200 | OK |
401 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
logged_outboolean = true | — |
Example
Sign out
curl -X POST https://partners.socialmatterspay.com/v1/partners/logout \
-H 'Authorization: Bearer partner_session_token'
HTTP 200
Cache-Control: no-store
{
"logged_out": true
}
GET /v1/partners/session
The signed-in partner owner
Host https://partners.socialmatterspay.com
Responses
| Status | Meaning |
|---|---|
200 | OK |
401 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
userobject | 5 child fields
|
Example
Who is signed in
curl https://partners.socialmatterspay.com/v1/partners/session \
-H 'Authorization: Bearer partner_session_token'
HTTP 200
Cache-Control: no-store
{
"user": {
"userId": "1e0cc508-9983-4120-8228-3fcea3caf9b2",
"role": "owner",
"partnerId": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
"agentId": null,
"email": "morgan@ridgeline.example"
}
}
GET /v1/agents/session
The signed-in agent
Host https://partners.socialmatterspay.com
Responses
| Status | Meaning |
|---|---|
200 | OK |
401 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
userobject | 5 child fields
|
Example
Agent session
curl https://partners.socialmatterspay.com/v1/agents/session \
-H 'Authorization: Bearer agent_session_token'
HTTP 200
Cache-Control: no-store
{
"user": {
"userId": "1c9fbf65-7fbb-4262-89d9-bb7ab50525a6",
"role": "agent",
"partnerId": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
"agentId": "62a14022-b94b-4d55-b7d7-bd0eb19611c2",
"email": "sam@ridgeline.example"
}
}
POST /v1/agents/accept-invite
An invited agent sets a password and becomes active
Host https://partners.socialmatterspay.com
Request body
| Field | Notes |
|---|---|
token requiredstring | — |
password requiredstring | — |
Responses
| Status | Meaning |
|---|---|
200 | OK |
400 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
agent_idstring | — | ||||||||||||||
statusstring = "active" | — | ||||||||||||||
sign_inobject | The second sign-in step, opened after a right password (or a password just set). Enter the authenticator code, or a backup code, at the verify-login operation with this challenge.7 child fields
|
Example
The agent sets a password (the answer enrols an authenticator)
curl -X POST https://partners.socialmatterspay.com/v1/agents/accept-invite \
-H 'Content-Type: application/json' \
-d '{
"token": "agent_invite_token",
"password": "correct horse battery staple"
}'
HTTP 200
Cache-Control: no-store
{
"agent_id": "62a14022-b94b-4d55-b7d7-bd0eb19611c2",
"status": "active",
"sign_in": {
"object": "sign_in_challenge",
"challenge": "sign_in_challenge",
"step": "enroll",
"expires_at": "2026-10-28T00:32:38.090Z",
"secret": "authenticator_secret",
"otpauth_uri": "otpauth://totp/Social%20Matter%20Payments%3Asam%40ridgeline.example?secret=authenticator_secret&issuer=Social%20Matter%20Payments&algorithm=SHA1&digits=6&period=30",
"role": "agent"
}
}
GET /r/{code}
Referral link: sets the smp_ref cookie (30 days) and redirects to the merchant application
Host https://partners.socialmatterspay.com
Parameters
| Field | Notes |
|---|---|
code requiredpath · string | — |
Responses
| Status | Meaning |
|---|---|
302 | Redirect to the merchant application with ?ref=<code> and the smp_ref cookie |
404 | Error — error shape and codes |
Example
A merchant follows the link
curl https://partners.socialmatterspay.com/r/z8cg3sg5mr
HTTP 302
Location: https://socialmatterspay.test/apply?ref=z8cg3sg5mr
Set-Cookie: smp_ref=z8cg3sg5mr; Max-Age=2592000; Path=/; Secure; SameSite=Lax
Cache-Control: no-store
POST /v1/partners/login/verify
Step 2 of signing in: an authenticator code (or a backup code); enrolment returns 10 backup codes once
Host https://partners.socialmatterspay.com
Request body
| Field | Notes |
|---|---|
challenge requiredstring | — |
codestring | pattern ^[0-9]{6}$ |
backup_codestring | — |
Responses
| Status | Meaning |
|---|---|
200 | OK |
400 | Error — error shape and codes |
401 | Error — error shape and codes |
429 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
tokenstring | The session bearer token. Shown once; only its hash is kept. |
expires_atstring (date-time) | — |
roleenum | one of owner, agent |
partner_idstring | — |
agent_idstring | null | The agent's id; null for the partner's owner. |
backup_codesarray of string | Ten one-time backup codes, shown once. Present only on the sign-in that enrolled the authenticator. |
Example
Partner sign-in, step 2: the authenticator code
curl -X POST https://partners.socialmatterspay.com/v1/partners/login/verify \
-H 'Content-Type: application/json' \
-d '{
"challenge": "sign_in_challenge",
"code": "123456"
}'
HTTP 200
Cache-Control: no-store
{
"token": "partner_session_token",
"expires_at": "2026-10-28T12:22:38.033Z",
"role": "owner",
"partner_id": "1506590a-fda8-428f-8ed1-cf5a8e52f8f5",
"agent_id": null,
"backup_codes": [
"backup_code_11",
"backup_code_12",
… 8 more
]
}
POST /v1/partners/password/set
Choose a password from a one-time link, then go on to the second step
Host https://partners.socialmatterspay.com
Request body
| Field | Notes |
|---|---|
token requiredstring | — |
password requiredstring | at least 12 characters |
Responses
| Status | Meaning |
|---|---|
200 | OK |
400 | Error — error shape and codes |
410 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
objectstring = "sign_in_challenge" | — |
challengestring | The one-time token to send back with the code. It expires at expires_at. |
stepenum | enroll for a login that has not set up its authenticator yet (it carries secret and otpauth_uri); verify once it has. one of enroll, verify |
expires_atstring (date-time) | — |
secretstring | The new authenticator secret, present only when step is enroll. |
otpauth_uristring | The otpauth link for the authenticator app, present only when step is enroll. |
roleenum | Whether the login is the partner's owner or one of its agents. one of owner, agent |
Example
Set the password from the link; the answer enrols an authenticator
curl -X POST https://partners.socialmatterspay.com/v1/partners/password/set \
-H 'Content-Type: application/json' \
-d '{
"token": "one_time_link_token",
"password": "the agent password, set again"
}'
HTTP 200
Cache-Control: no-store
{
"object": "sign_in_challenge",
"challenge": "sign_in_challenge",
"step": "enroll",
"expires_at": "2026-10-28T00:32:38.433Z",
"secret": "authenticator_secret",
"otpauth_uri": "otpauth://totp/Social%20Matter%20Payments%3Asam%40ridgeline.example?secret=authenticator_secret&issuer=Social%20Matter%20Payments&algorithm=SHA1&digits=6&period=30",
"role": "agent"
}
POST /v1/partners/password/forgot
Email a reset link (60 minutes); the same answer whether or not the email has a login
Host https://partners.socialmatterspay.com
Request body
| Field | Notes |
|---|---|
email requiredstring (email) | — |
Responses
| Status | Meaning |
|---|---|
202 | OK |
400 | Error — error shape and codes |
Fields of the response (202)
| Field | Notes |
|---|---|
sent_if_knownboolean = true | Always true, whether or not the email belongs to a login, so the answer does not reveal which emails exist. |
Example
Forgot the password: a reset link by email (the same answer for any address)
curl -X POST https://partners.socialmatterspay.com/v1/partners/password/forgot \
-H 'Content-Type: application/json' \
-d '{
"email": "sam@ridgeline.example"
}'
HTTP 202
Cache-Control: no-store
{
"sent_if_known": true
}
POST /v1/partners/password/reset
Set a new password from a reset link; every session of the login ends
Host https://partners.socialmatterspay.com
Request body
| Field | Notes |
|---|---|
token requiredstring | — |
password requiredstring | at least 12 characters |
Responses
| Status | Meaning |
|---|---|
200 | OK |
400 | Error — error shape and codes |
410 | Error — error shape and codes |
Fields of the response (200)
| Field | Notes |
|---|---|
password_resetboolean = true | — |
nextstring = "sign_in" | — |
Example
Set a new password from the reset link (the login’s sessions end)
curl -X POST https://partners.socialmatterspay.com/v1/partners/password/reset \
-H 'Content-Type: application/json' \
-d '{
"token": "one_time_link_token",
"password": "a new long agent password"
}'
HTTP 200
Cache-Control: no-store
{
"password_reset": true,
"next": "sign_in"
}
