Routes and permissions

Anis staff grant your application its permissions. Read your profile to see the ones it has right now.

Every call

Permissions are profile:read, wallets:read, catalogue:read, orders:create, orders:read, cards:read, cards:reveal, diagnostics:use, meter_charges:create, meter_charges:read, direct_recharges:create and direct_recharges:read. orders:create also permits reading your own orders. meter_charges:create includes package and charge reads. direct_recharges:create includes direct recharge product, location, quote and direct recharge reads, and permits recipient correction. Webhook endpoint and event calls need no additional scope; they still require an admitted signed request for your own application.

Before a call is looked at

Anis checks each of these before any business decision, so an order call refused by one of them placed nothing itself. It says nothing about an earlier attempt with the same operation id: after invalid_credentials, insufficient_scope or wallet_not_granted, restore access first — after malformed_signed_request, fix how the request is signed first — then resume the same id (or read it with GET /orders/{operationId}). Never place it again under a new id. The order in which the checks run is not part of the contract — do not rely on meeting one before another.

Paging

The list calls return a page and a nextCursor. Pass it back as cursor — exactly as received — to get the next page. New product lists end with nextCursor: null. Existing card and wallet lists retain their documented last-page behavior: nextCursor is absent on the last page. A changed or malformed cursor is refused as validation_failed.