Clawback a fraudulent/voided promotional grant (ops)
Claw back a promotional grant when the source event that funded it is voided or refunded, or for fraud. A LOCKED grant claws back its full amount. A RELEASED grant claws back only the remaining unspent amount; any already-spent portion is recorded as a merchant loss and is never pulled back from the customer’s actual cash balance (promotional money never converts to cash). This transitions the grant to CLAWED_BACK (a terminal state) in a single atomic operation. The call is mutating and idempotent on the Idempotency-Key header: clawing back an already-CLAWED_BACK grant replays as a no-op. RBAC-gated to operator/admin callers. Tenant-scoped; a grant belonging to another tenant resolves to FORBIDDEN (403) or NOT_FOUND (404).
Authorizations
Partner API key (platform- or merchant-scoped). Contract key-enforces context.merchant_id.
Headers
Partner-generated UUID; the ONE dedup key for all mutating endpoints. 24h TTL. Same key + same payload -> byte-identical replay; same key + different payload -> IDEMPOTENCY_KEY_REUSED (422).
Path Parameters
The promotional grant ledger row id. NOT a UUID, grant ids carry the pg_ prefix.
Body
Clawback a promotional grant (ops).
Common request metadata shared across all Partner API domains. partner_request_id is a correlation identifier only: it appears in logs and responses for tracing but is never used as the deduplication key. Request deduplication is keyed exclusively on the Idempotency-Key header.
Why the grant is being clawed back.
SOURCE_ORDER_VOIDED, SOURCE_REFUNDED, FRAUD, DUPLICATE, OTHER Free-text note for the audit trail.
Response
Grant clawed back; any spent portion logged as merchant loss.
The standard response envelope that every enveloped endpoint serializes through. ok is a boolean discriminator: when ok is true, the typed result is carried in data; when ok is false, a typed error object is returned instead. The meta object is uniform across the entire API surface.
The uniform response metadata block returned on every response. data_completeness_score is computed per call and reports the completeness of the returned data. decision_trace_id is present on responses that carry decision or insight output and can be used to correlate the response with its reasoning. capabilities is an additive, response-level array of hints advertising features the caller may use, and may be extended over time without notice.
The outcome of a clawback. spent_loss_logged is any already-spent promotional portion booked as a merchant loss; it is never pulled from the customer's actual cash balance.
The typed error object returned with every non-2xx response. code is a string enum (for example WALLET_PROGRAM_AMBIGUOUS, CREDENTIAL_TYPE_UNSUPPORTED, INSUFFICIENT_FUNDS, IDEMPOTENCY_KEY_REUSED, CURRENCY_NOT_SUPPORTED), never a bare HTTP status number. Inspect code for programmatic branching, not the HTTP status. Some codes echo the valid set in details so clients can present or reconcile the accepted values: for example CREDENTIAL_TYPE_UNSUPPORTED lists the supported credential types, CURRENCY_NOT_SUPPORTED lists the supported ISO-4217 currencies, and WALLET_PROGRAM_AMBIGUOUS lists the candidate wallet_program_id values that matched the request.