Write the institution's connector credentials

curl --request PUT \
  --url https://api.example.com/v1/institutions/{institutionId}/connector-credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "credentials": {
    "crm_client_id": "midaz-crm-client",
    "crm_client_secret": "REPLACE_ME",
    "ledger_client_id": "midaz-ledger-client",
    "ledger_client_secret": "REPLACE_ME"
  }
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/institutions/{institutionId}/connector-credentials"

	payload := strings.NewReader("{\n  \"credentials\": {\n    \"crm_client_id\": \"midaz-crm-client\",\n    \"crm_client_secret\": \"REPLACE_ME\",\n    \"ledger_client_id\": \"midaz-ledger-client\",\n    \"ledger_client_secret\": \"REPLACE_ME\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    credentials: {
      crm_client_id: 'midaz-crm-client',
      crm_client_secret: 'REPLACE_ME',
      ledger_client_id: 'midaz-ledger-client',
      ledger_client_secret: 'REPLACE_ME'
    }
  })
};

fetch('https://api.example.com/v1/institutions/{institutionId}/connector-credentials', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/institutions/{institutionId}/connector-credentials"

payload = { "credentials": {
        "crm_client_id": "midaz-crm-client",
        "crm_client_secret": "REPLACE_ME",
        "ledger_client_id": "midaz-ledger-client",
        "ledger_client_secret": "REPLACE_ME"
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "connectorType": "midaz",
  "createdAt": "2024-01-15T10:30:00Z",
  "enabled": true,
  "institutionCode": "12345678",
  "institutionId": "550e8400-e29b-41d4-a716-446655440000",
  "updatedAt": "2024-01-15T12:00:00Z",
  "accountFormat": "^[0-9]{1,12}$",
  "branchFormat": "^[0-9]{4}$",
  "connectorMetadata": {
    "baseUrl": "https://midaz.example.com",
    "blockableAccountTypes": [
      "deposit"
    ],
    "blockableBalances": [
      "default"
    ],
    "organizations": [
      {
        "ledgers": [
          "019fcd7c-1e18-7034-8cd3-9e39c1759e41"
        ],
        "organizationId": "019fcd7b-97df-71a5-8023-6eb3c661968b"
      }
    ]
  },
  "connectorMetadataValid": false,
  "effectiveCrmMode": "legacy",
  "retryPolicyConfig": {
    "maxAttempts": 3
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Write the institution's connector credentials

Writes (or rotates) the connector credentials of an existing institution: the credentials subtree of connector_metadata is replaced, sealed under a fresh data key, audited as a credential rotation, and never echoed; every other metadata key is kept as stored. This is the ONLY credential write path: PATCH /v1/institutions/ refuses a credentials subtree with 400. Returns 404 when the institution has no configuration.

PUT

institutions

{institutionId}

connector-credentials

Write the institution's connector credentials

curl --request PUT \
  --url https://api.example.com/v1/institutions/{institutionId}/connector-credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "credentials": {
    "crm_client_id": "midaz-crm-client",
    "crm_client_secret": "REPLACE_ME",
    "ledger_client_id": "midaz-ledger-client",
    "ledger_client_secret": "REPLACE_ME"
  }
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/institutions/{institutionId}/connector-credentials"

	payload := strings.NewReader("{\n  \"credentials\": {\n    \"crm_client_id\": \"midaz-crm-client\",\n    \"crm_client_secret\": \"REPLACE_ME\",\n    \"ledger_client_id\": \"midaz-ledger-client\",\n    \"ledger_client_secret\": \"REPLACE_ME\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    credentials: {
      crm_client_id: 'midaz-crm-client',
      crm_client_secret: 'REPLACE_ME',
      ledger_client_id: 'midaz-ledger-client',
      ledger_client_secret: 'REPLACE_ME'
    }
  })
};

fetch('https://api.example.com/v1/institutions/{institutionId}/connector-credentials', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/institutions/{institutionId}/connector-credentials"

payload = { "credentials": {
        "crm_client_id": "midaz-crm-client",
        "crm_client_secret": "REPLACE_ME",
        "ledger_client_id": "midaz-ledger-client",
        "ledger_client_secret": "REPLACE_ME"
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "connectorType": "midaz",
  "createdAt": "2024-01-15T10:30:00Z",
  "enabled": true,
  "institutionCode": "12345678",
  "institutionId": "550e8400-e29b-41d4-a716-446655440000",
  "updatedAt": "2024-01-15T12:00:00Z",
  "accountFormat": "^[0-9]{1,12}$",
  "branchFormat": "^[0-9]{4}$",
  "connectorMetadata": {
    "baseUrl": "https://midaz.example.com",
    "blockableAccountTypes": [
      "deposit"
    ],
    "blockableBalances": [
      "default"
    ],
    "organizations": [
      {
        "ledgers": [
          "019fcd7c-1e18-7034-8cd3-9e39c1759e41"
        ],
        "organizationId": "019fcd7b-97df-71a5-8023-6eb3c661968b"
      }
    ]
  },
  "connectorMetadataValid": false,
  "effectiveCrmMode": "legacy",
  "retryPolicyConfig": {
    "maxAttempts": 3
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Authorizations

Authorization

string

header

required

JWT bearer token issued by the identity provider.

Path Parameters

institutionId

string

required

The institution's unique identifier (UUID).

Example:

"550e8400-e29b-41d4-a716-446655440000"

Body

application/json

credentials

object

required

The connector's credentials under their snake_case allowlisted names (ledger_client_id, ledger_client_secret, crm_client_id, crm_client_secret). Sealed under a fresh data key before the row is written and never echoed. Rotating does NOT revoke the previous credential upstream.

Show child attributes

Example:

{
  "crm_client_id": "midaz-crm-client",
  "crm_client_secret": "REPLACE_ME",
  "ledger_client_id": "midaz-ledger-client",
  "ledger_client_secret": "REPLACE_ME"
}

Response

connectorType

string

required

The outbound connector type for this institution.

Example:

"midaz"

createdAt

string

required

RFC 3339 creation timestamp (UTC).

Example:

"2024-01-15T10:30:00Z"

enabled

boolean

required

Whether the connector configuration is active.

Example:

true

institutionCode

string

required

The institution's BACEN CNPJ (8 digits) for return-file headers and file header validation.

Example:

"12345678"

institutionId

string

required

The institution's unique identifier (UUID).

Example:

"550e8400-e29b-41d4-a716-446655440000"

updatedAt

string

required

RFC 3339 last-update timestamp (UTC).

Example:

"2024-01-15T12:00:00Z"

accountFormat

string

The regular expression the institution declared for the account number of a court-indicated target; omitted when none is declared.

Example:

"^[0-9]{1,12}$"

branchFormat

string

The regular expression the institution declared for the branch (agência) number of a court-indicated target; omitted when none is declared.

Example:

"^[0-9]{4}$"

connectorMetadata

any

Connector-specific configuration bag. The non-secret connector-owned keys (baseUrl, authAddress, crmBaseUrl, crmMode, organizations[], blockableBalances, blockableAccountTypes, salaryAccountTypes) are preserved verbatim; secret-bearing keys — the whole credentials subtree included — are removed and never echoed. blockableBalances carries the LEDGER's balance-key values — for Midaz, balanceKey (default/overdraft/a client-registered key), not the available/onHold fields of a balance.

Example:

{
  "baseUrl": "https://midaz.example.com",
  "blockableAccountTypes": ["deposit"],
  "blockableBalances": ["default"],
  "organizations": [
    {
      "ledgers": ["019fcd7c-1e18-7034-8cd3-9e39c1759e41"],
      "organizationId": "019fcd7b-97df-71a5-8023-6eb3c661968b"
    }
  ]
}

connectorMetadataValid

boolean

read-only

Present and false only when the stored connector metadata cannot be parsed by its connector; absent otherwise. The offending value is never echoed.

Example:

false

effectiveCrmMode

enum<string>

read-only

The CRM surface this institution resolves to (legacy|embedded): its own crmMode override when the connector metadata names one, the service-wide default otherwise. Derived and read-only; omitted when the connector metadata cannot be parsed.

Available options:

legacy,

embedded

Example:

"legacy"

retryPolicyConfig

any

Operational retry policy (backoff/attempts) as arbitrary JSON.

Example:

{ "maxAttempts": 3 }

SISBAJUD Mensageria · Institutions

SISBAJUD Mensageria · Orders and files

SISBAJUD Mensageria · Monitoring

SISBAJUD Mensageria · Return files

SISBAJUD Mensageria · LGPD requests

SISBAJUD Mensageria · Security

SISBAJUD Mensageria · Compliance

SISBAJUD Mensageria · Lerian STA dead-letter

SISBAJUD executor · Institutions and Midaz connector

SISBAJUD executor · Orders that need attention

SISBAJUD executor · Ledger routing

SISBAJUD executor · Security

SISBAJUD executor · Audit

Error handling

Write the institution's connector credentials

Authorizations

Path Parameters

Body

Response