Skip to main content
A partner can call the TED plugin with its own credential. You confine that credential to the Midaz organizations it acts for. You need this when one TED deployment serves several organizations. Every TED partner needs a scope.

Step by step

1

Choose the organizations the partner acts for

TED has one restriction:The ledger and the accounts of a transfer are not a TED restriction. TED finds the ledger from the sender’s account. To confine a partner to some ledgers or accounts, also give it a Midaz scope. Midaz then applies that scope to the postings TED makes for the partner. See The partner’s Midaz rules apply to its transfers.
2

Give the partner its permissions and scope

Create the partner, or change it, in the Console or with the Identity API. The product slug is plugin-br-bank-transfer. The restriction accepts several organizations.
  • Add the scope entry for the organizations. Without it, Access Manager refuses the partner with 400 and IDE-1060.
  • Check the resources and actions. The most you can give is what the plugin-br-bank-transfer-editor-role role holds in your tenant. Above that, Access Manager refuses with IDE-1043.
You can give a partner these actions on the resource transfers: create, process, read, list, and return. Every other action acts on the whole tenant: the cancellation and the reconciliation retry of a transfer, the TED IN poller and its replay, the reconciliation cycle, the manual resolution and the scope repair, the webhooks, the runtime settings, and the event catalog. Access Manager refuses them with 400 and IDE-1056, and the Console marks the line Outside the scope.
3

Create its TED application

Create the partner’s application with the product plugin-br-bank-transfer. See Create the partner’s applications in the API guide, or in the Console. Send the client ID and the client secret to the partner through a secure channel.
4

Name the organization on every request

Every request names the organization in the X-Organization-Id header, which TED already requires on these routes. The value must be inside the partner’s scope. A request without it is refused.The header takes one organization. A transfer of another organization answers 404, even when that organization is in the partner’s scope: name the organization the transfer belongs to.
5

Confirm that it works

Use the partner’s credential. List the transfers of an organization in the partner’s scope. The answer is 200:
Send the same request with an organization outside the partner’s scope. The answer is 403 with BTF-0405.

The partner’s Midaz rules apply to its transfers

TED posts each transfer to Midaz while it serves the partner’s request. When the partner also has Midaz permissions, Midaz applies the partner’s Midaz scope to that posting. For example, a partner restricted in Midaz to one ledger cannot move money from another ledger of the same organization through TED.
  • When Midaz refuses the partner, TED answers 403 with BTF-0405, and upstream.code carries the Midaz code, for example AUT-1019. The refusal moves no money, and a repeat gets the same refusal until you change the partner’s Midaz permissions or scope.
  • The Midaz scope does not narrow what the partner reads in TED. Reading a transfer, listing transfers, the pending reconciliation list, and the dashboard show every TED transfer of the organization, also the transfers of ledgers outside the partner’s Midaz scope. TED answers these reads from its own records and does not call Midaz. Give a partner read and list only when it can see all the transfers of the organization.
  • A partner with no Midaz permissions is decided by its TED permissions and scope only.
  • You can give the partner its Midaz rules in the same Console flow, or later on the Midaz product.
  • A TED IN credit, the reconciliation, and the other background work run without a partner. The partner’s rules do not apply there.

Routes that no partner reaches

A partner with a TED scope is refused with 403 and BTF-0405 on the routes that name no organization:
  • The TED IN reads: GET /v1/transfers/ted-in/poller, GET /v1/transfers/ted-in/retained, GET /v1/transfers/ted-in/undeliverables, and GET /v1/transfers/ted-in/reconciliation-gaps.
  • The routing report: GET /v1/transfers/routing/preflight.
These routes show data of every organization of your tenant. Use an application of your own institution for them.

If something fails

BTF-0405 does not say whether the permissions or the scope refused the request. This is on purpose: a partner cannot use a refusal to learn which organizations exist outside its scope. For the refusals when you create or change a partner, see Error codes in the API guide.