> ## Documentation Index > Fetch the complete documentation index at: https://docs.feddi.io/llms.txt > Use this file to discover all available pages before exploring further. # Tenant-scoped capability descriptor > Returns the capability descriptor for the integration identified by the `x-api-key`. An integrating client (POS adapter, SDK, automation) **MUST read this before assuming any enum, currency set, or feature flag**: it is the authoritative source of truth for what the integration can transact in. Fields exposed: `api_version`, `integration_id`, `provider`, `supported_currencies` (the active wallet program assignments), `supported_identify_credential_types` (credential types accepted to resolve WHO a customer is), `supported_payment_credential_types` (credential types accepted to authorize a wallet debit), `features` (named flags keyed by operation), and `rate_limits`. Empty collections indicate the feature is not yet provisioned for this integration, not that it is unsupported globally. The descriptor is additive: it never over-claims. A client that caches this response should honor the `Cache-Control` header and re-fetch when it receives a `CREDENTIAL_TYPE_UNSUPPORTED` or `CURRENCY_NOT_SUPPORTED` typed error. ## OpenAPI ````yaml /api-reference/openapi.yaml get /capabilities openapi: 3.1.0 info: title: Feddi Partner API version: '2026-06-01' description: >- Operate a Feddi closed-loop wallet and loyalty program at the point of sale: identify customers, read balances, accept wallet payments, run top-ups, and reconcile transactions. All amounts are integer minor units with an explicit ISO-4217 currency. Balances are merchant-held and closed-loop. Every response uses a typed envelope (`ok` / `data` / `error` / `meta`) with string error codes (never a bare HTTP number) and an idempotency-replay flag. Authenticate with the `x-api-key` header; exchange it for a short-lived POS terminal JWT for hot-path calls. Self-validate against this document (`GET /openapi`) and read `GET /capabilities` for the credential types, currencies, and features enabled for your integration before assuming any enum. Operations are tagged `x-feddi-availability: ga` (stable) or `beta` (callable, contract may still change additively); confirm what is enabled for your credentials via `GET /capabilities`. Sandbox access is granted per partner agreement; request credentials from your Feddi contact. servers: - url: https://api.feddi.io/v1/partner description: production - url: https://api.dev.feddi.io/v1/partner description: dev security: - ApiKeyAuth: [] tags: - name: platform description: >- Platform cross-cutting: health, capabilities, openapi self-serve, merchant provisioning, settlement, reconciliation. - name: checkout_session description: >- Checkout sessions: every interaction opens a session, then identity and basket attach to it, and payment, top-up, and offers run against it. - name: auth description: >- Partner authentication + onboarding: API key lifecycle, POS terminal JWT exchange, terminal heartbeat. - name: customers description: >- Customer lookup + identification: resolve identity, cashier-panel summaries, preferences, GDPR export/erase. - name: enrollment description: >- Enrollment + signup: OTP enroll, cashback claims, identity/consent, customer correction + merge. - name: payments description: >- Payments + redemption: debit wallet (promo-first), balance-check, void, refund, QR mint. - name: topup description: >- Wallet top-up: 2-step prepare/confirm, reload-bonus grants, SKU top-up, settlement + reconciliation. - name: incentives description: >- Incentives + offers: offer feeds, apply/redeem/release locks, proposals, budget envelopes, points, grant clawback. - name: transactions description: >- Transactions + receipts: transaction detail, void, receipts, disputes, settlements, reconciliation, exports. - name: webhooks description: >- Webhooks + events: subscriptions, delivery history + retry, event catalog, polling fallback. paths: /capabilities: get: tags: - platform summary: Tenant-scoped capability descriptor description: >- Returns the capability descriptor for the integration identified by the `x-api-key`. An integrating client (POS adapter, SDK, automation) **MUST read this before assuming any enum, currency set, or feature flag**: it is the authoritative source of truth for what the integration can transact in. Fields exposed: `api_version`, `integration_id`, `provider`, `supported_currencies` (the active wallet program assignments), `supported_identify_credential_types` (credential types accepted to resolve WHO a customer is), `supported_payment_credential_types` (credential types accepted to authorize a wallet debit), `features` (named flags keyed by operation), and `rate_limits`. Empty collections indicate the feature is not yet provisioned for this integration, not that it is unsupported globally. The descriptor is additive: it never over-claims. A client that caches this response should honor the `Cache-Control` header and re-fetch when it receives a `CREDENTIAL_TYPE_UNSUPPORTED` or `CURRENCY_NOT_SUPPORTED` typed error. operationId: getCapabilities parameters: [] responses: '200': description: Capability descriptor for the authenticated integration. content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: data: $ref: '#/components/schemas/Capabilities' example: ok: true data: api_version: '2026-06-01' integration_id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa provider: ODOO supported_currencies: - QAR - SAR supported_identify_credential_types: - phone - qr - short_code supported_payment_credential_types: - otp - qr features: identify: true checkout: true topup: false promo_grants: false rate_limits: identify: per_minute: 120 payments: per_minute: 60 error: null meta: request_id: req_a1b2c3 idempotency_replayed: false api_version: '2026-06-01' data_completeness_score: 100 '401': description: '`INVALID_API_KEY` (HTTP 401), missing or invalid `x-api-key`.' content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: error: $ref: '#/components/schemas/Error' '404': description: >- `RESOURCE_NOT_FOUND` (HTTP 404), the integration resolved from the API key is not found or not active. content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: error: $ref: '#/components/schemas/Error' security: - ApiKeyAuth: [] components: schemas: ResponseEnvelope: type: object description: >- The standard response envelope that every enveloped endpoint serializes through. `ok` is a boolean discriminator: when `ok` is `true`, the typed result is carried in `data`; when `ok` is `false`, a typed error object is returned instead. The `meta` object is uniform across the entire API surface. required: - ok - meta properties: ok: type: boolean data: type: - object - 'null' error: oneOf: - $ref: '#/components/schemas/Error' - type: 'null' meta: $ref: '#/components/schemas/Meta' Capabilities: type: object description: >- Tenant-scoped capability descriptor. An integrating agent MUST read this before assuming any enum or feature flag. Fields grow additively, never renamed or removed in v1. required: - api_version - integration_id - provider - supported_currencies - supported_identify_credential_types - supported_payment_credential_types - features - rate_limits properties: api_version: type: string description: The single canonical API version string (e.g. `'2026-06-01'`). example: '2026-06-01' integration_id: type: string format: uuid description: The Feddi integration UUID the key authenticated as. provider: type: string description: Provider name (e.g. `'ODOO'`, `'FOODICS'`, `'SADAD'`). example: ODOO supported_currencies: type: array items: type: string description: >- ISO 4217 codes of currencies this integration can transact in, derived from active wallet program assignments. Empty = none provisioned yet. example: - QAR - SAR supported_identify_credential_types: type: array items: $ref: '#/components/schemas/IdentifyCredentialType' description: >- Credential types this integration accepts for IDENTITY RESOLUTION (resolving WHO the customer is), the `IdentifyCredential` variants accepted by `POST /identify` and the session-anchored identify. Empty on foundation; grows as endpoint bites land. example: - phone - qr - short_code supported_payment_credential_types: type: array items: $ref: '#/components/schemas/CredentialType' description: >- Credential types this integration accepts to AUTHORIZE A WALLET DEBIT, the `PaymentCredential` variants accepted by `POST /payments`. A separate concern from identity resolution; only `qr` and `short_code` appear in both sets. Empty on foundation; grows as endpoint bites land. example: - otp - qr features: type: object description: >- Named feature flags keyed by operation slug. A missing key or `false` means the feature is not available for this integration. additionalProperties: type: boolean example: identify: true checkout: true topup: false promo_grants: false rate_limits: type: object description: >- Per-operation rate limit descriptors (`per_minute` integer). Matches the `X-RateLimit-*` headers enforced on each endpoint. additionalProperties: type: object properties: per_minute: type: integer example: identify: per_minute: 120 payments: per_minute: 60 Error: type: object description: >- The typed error object returned with every non-2xx response. `code` is a string enum (for example `WALLET_PROGRAM_AMBIGUOUS`, `CREDENTIAL_TYPE_UNSUPPORTED`, `INSUFFICIENT_FUNDS`, `IDEMPOTENCY_KEY_REUSED`, `CURRENCY_NOT_SUPPORTED`), **never a bare HTTP status number**. Inspect `code` for programmatic branching, not the HTTP status. Some codes echo the valid set in `details` so clients can present or reconcile the accepted values: for example `CREDENTIAL_TYPE_UNSUPPORTED` lists the supported credential types, `CURRENCY_NOT_SUPPORTED` lists the supported ISO-4217 currencies, and `WALLET_PROGRAM_AMBIGUOUS` lists the candidate `wallet_program_id` values that matched the request. required: - code - message properties: code: type: string enum: - INSUFFICIENT_FUNDS - INVALID_API_KEY - CREDENTIAL_TYPE_UNSUPPORTED - CURRENCY_NOT_SUPPORTED - IDEMPOTENCY_KEY_REUSED - WALLET_PROGRAM_AMBIGUOUS - REQUIRES_DYNAMIC_CREDENTIAL - NOT_FOUND - FORBIDDEN - VALIDATION_ERROR - RATE_LIMITED - CONFLICT - INTERNAL_SERVER_ERROR message: type: string details: type: object additionalProperties: true Meta: type: object description: >- The uniform response metadata block returned on every response. `data_completeness_score` is computed per call and reports the completeness of the returned data. `decision_trace_id` is present on responses that carry decision or insight output and can be used to correlate the response with its reasoning. `capabilities` is an additive, response-level array of hints advertising features the caller may use, and may be extended over time without notice. required: - request_id - api_version properties: request_id: type: string description: Feddi-issued correlation id for this response. idempotency_replayed: type: boolean description: True when this response was replayed from the idempotency store. api_version: type: string description: The single API version field. example: '2026-06-01' data_completeness_score: type: integer minimum: 0 maximum: 100 description: >- 0-100, computed per call (basket/identity/tax/category/consent presence). decision_trace_id: type: - string - 'null' description: Opaque trace id on intelligence-bearing responses; one per response. capabilities: type: object additionalProperties: true description: Additive response-level capability hints. IdentifyCredentialType: type: string enum: - phone - provider_customer_id - card_fingerprint - short_code - qr description: >- The type of customer credential presented for IDENTITY RESOLUTION (resolving WHO the customer is). Discriminant for `IdentifyCredential` (`POST /identify` and the session-anchored identify). Distinct from the payment/debit credential set (`CredentialType`), only `qr` and `short_code` are members of both. CredentialType: type: string enum: - otp - qr - short_code - pass_tap description: >- The type of customer credential presented at the POS to AUTHORIZE A WALLET DEBIT. Discriminant for `PaymentCredential` (`POST /payments`). For identity-resolution credential types see `IdentifyCredentialType`, only `qr` and `short_code` are members of both sets. Extend the enum to add new types with zero route changes. securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Partner API key (platform- or merchant-scoped). Contract key-enforces context.merchant_id. ````