How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

BreadPay Foundations API

Platform foundations — service-account authorization (HTTP Basic client credentials exchanged for a bearer JWT), buyer login and token refresh, org-token exchange, one-time verification codes, org codes, and the common models shared across every other domain. 15 operations.

BreadPay Foundations API is one of 13 APIs that Bread Financial publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Authentication, OAuth, Tokens, and Verification Codes. The published artifact set on APIs.io includes an OpenAPI specification and authentication docs.

This API exposes 15 operations across 14 paths, and defines 55 schemas. It is described by OpenAPI 3.0.3, at version 2.0.0.

Requests are made against 2 base URLs: https://api-preview.platform.breadpayments.com/, https://api.platform.breadpayments.com/.

15 operations 14 paths 55 schemas 4 GET11 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.3
API Version
2.0.0
Base URL
https://api.platform.breadpayments.com
Authentication
HTTP Basic, HTTP Bearer
Resource Areas
1

Authentication & Security 2

BreadPay Foundations API declares 2 security schemes for authenticating requests. It accepts HTTP basic authentication (basicAuthService). It accepts HTTP bearer tokens (JWT) (bearerAuth).

  • basicAuthService — The string 'Basic [apiKey]:[secret]' should be provided to the Authorization header where '[apiKey]:[secret]' is base64 encoded.
  • bearerAuth — The scoped JWT provided by the Auth service.

Paths & Operations 15

Across 14 paths, the API surfaces 15 operations — 4 GET, 11 POST. Each is listed below with its method, path, parameters, and response codes.

Auth 15

Provides authentication support for BreadPayments platform

POST
/api/auth/send-code
Send a Verification OTP Code
sendCode 1 param body → 200400401403404409503
GET
/api/auth/code
List codes
listCodes 6 params → 200400401403500
GET
/api/auth/code/{referenceID}/status
Get the status of a Verification OTP Code
getStatusByCodeID 2 params → 200400401403500
POST
/api/auth/buyer/verify-code
Verify an OTP Code
verifyCode 1 param body → 200400401403503
POST
/api/auth/buyer/authorize
Authorize a buyer based on buyer credentials
buyerAuthorize 1 param body → 200400401403404
POST
/api/auth/login
Login with an OTP Code
BuyerLogin 1 param body → 200400401403404
POST
/api/auth/buyer/token/refresh
Refresh a Buyer JWT
refreshBuyerToken → 200400401403
POST
/api/auth/org/token/exchange
Exchange Org User Token
exchangeOrgToken body → 200400401403
POST
/api/auth/service/authorize
Authorize a Service Account
authorizeService body → 200400401403503
POST
/api/auth/buyer/token/exchange
Exchange Service Account JWT For Buyer JWT
exchangeBuyerToken body → 200400401403404503
POST
/api/auth/org/code
Create Org Codes
createOrgCodes body → 200400401403404503
GET
/api/auth/org/code
Get Org Codes
getOrgCodes 6 params → 200400401403404503
POST
/api/auth/org/authorize
Authorize Org Code
authorizeOrgCode body → 200400401403404503
POST
/api/auth/org/code/expire
Expire Org Codes
expireOrgCodes body → 204400401403404503
GET
/api/auth/identity
Get App Identities
listAppIdentities → 200400401403

Schemas 55

The contract defines 55 schemas that model the data the API accepts and returns. The most detailed are Code (13 properties), OrgCode (10 properties), BuyerLoginBody (8 properties), BankAccountDetail (6 properties). Each schema is shown below with its type and property counts.

AuthError
object
Default error model for Auth errors
1 property
AuthErrorReason
string
Auth error reason codes
AuthToken
object
Default error model for Auth errors
3 properties 2 required
SendCodeBody
object
6 properties 3 required
SendCodeBodyResponse
object
A response containing a JWT successfully returned from the POST /api/auth/buyer/authorize endpoint
1 property 1 required
Code
object
Code represents an OTP code record
13 properties
ListCodesBodyResponse
object
A list of Code records including pagination response fields.
4 properties
GetCodeStatusByIDBodyResponse
object
A response containing the status of the code with the ID from the GET /api/auth/code/{referenceID}/status endpoint
1 property 1 required
DisclosureTypeEnum
string
List of types of disclosures.
DeliveryMethodEnum
string
List of types of delivery methods.
BuyerAuthorizeBody
object
5 properties 2 required
BuyerLoginBody
object
8 properties 2 required
VerifyCodeBody
object
2 properties 2 required
BuyerTokenBody
object
3 properties 1 required
ExchangeOrgBody
object
2 properties
CreateOrgCodeBody
object
3 properties 2 required
OrgCodeClaims
object
2 properties 1 required
ListOrgCodeResponse
object
A list of org codes records including pagination response fields.
2 properties
Pagination
object
A model to represent pagination fields
3 properties
OrgCode
object
10 properties
AuthorizeServiceBody
object
1 property
AuthorizeOrgCodeBody
object
1 property 1 required
AuthorizeOrgCodeResponse
object
3 properties 3 required
ExpireOrgCodeRequestBody
object
5 properties 1 required
ListAppIdentitiesResponse
object
A list of App Identity records.
1 property
AppIdentity
object
2 properties
CountryCode
string
The two character ISO-3166-1 country code.
Region
string
The region or first-level administration division (e.g. State/Province) of the address.
CurrencyCode
string
The three letter currency code as defined in ISO 4217.
LanguageCode
string
The two language code as defined in ISO 639-1 along with subtags tag if applicable.
Money
object
Represents a monetary amount in the specified currency
2 properties 2 required
Phone
string
Telephone number including country code
Email
string
Email address
Percentage
number
Percentage value
BasisPoint
integer
A value which represents one-hundredth of one percent.
Date
string
The date value formatted per RFC3339. This does not allow nulls.
NullDate
string
The date value formatted per RFC3339. This allows nulls.
Timestamp
string
The timestamp value formatted per RFC3339. This does not allow nulls.
NullTimestamp
string
The timestamp value formatted per RFC3339. This does allow nulls.
UUID
string
A universally unique identifier (Version 4) as defined in RFC4122. This does not allow nulls.
NullUUID
string
A universally unique identifier (Version 4) as defined in RFC4122. This allows nulls.
Address
object
Represents a fully defined address for an entity
6 properties 5 required
Name
object
Represents the full name
3 properties 2 required
Contact
object
Represents contact information for an entity
4 properties 1 required
BankAccountDetail
object
Bank account detail definition
6 properties 4 required
BusinessIdentity
object
Identity for a business
2 properties 2 required
PersonIdentity
object
Identity for a person
2 properties 2 required
BankIdentifier
object
2 properties 2 required
PaymentProductType
string
The type of payment product
TermInterval
string
Defines set of valid term intervals for a payment product
Terms
object
Represents the terms offered for a payment product
4 properties 4 required
AsLowAs
object
Represents a sample offer with the appropriate user prompts for a given amount and apr along with apr bounds
6 properties 6 required
Identity
object
The claims that determines the access level of the caller.
5 properties 1 required
Error
object
1 property 4 required
BaseError
object
4 properties 3 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

bread-foundations-openapi.json Raw ↑

Other APIs Bread Financial publishes across the network.

BreadPay Platform API
Bread Pay API
Bread SplitPay API
BreadPay Checkout API
Bread SplitPay
BreadPay Merchant Operations API
BreadPay Servicing API
BreadPay Buyer Management API
BreadPay Payments API
BreadPay Webhook API
BreadPay Program API
BreadPay Tradein API
Where this information came from

This is an independent, third-party profile of BreadPay Foundations API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.