Skip to main content

​
Control Plane API Overview

The Pcnaid Apple Pay Control Plane API is an edge-native REST API deployed at https://api.lifecyclemanager.app. It exposes routes for managing merchant profiles, notification settings, team member roles and invitations, and technical support tickets.

​
Base URL & environment

Route Prefix: All version 1 routes are mounted under the path prefix /applepay-lifecycle/v1/*.

​
Authentication & scopes

All API requests require an Auth0 Bearer access token passed in the standard Authorization header:
Access tokens are validated using RS256 with keys published at Pcnaid’s Auth0 JWKS endpoint.

​
Permission scopes

​
Strict tenant isolation

Tenant isolation is enforced cryptographically at the API boundary:
  1. The Control Plane extracts auth.merchantId directly from verified claims in the Auth0 Bearer token.
  2. Every database query executed against Render Postgres strictly parameterizes WHERE merchant_id = ${auth.merchantId}.
  3. Cross-tenant access is impossible; requests specifying a resource ID belonging to another merchant return 404 Not Found rather than leaking tenant existence.

​
Endpoint families

Explore the complete schemas, parameters, and payloads in the Control Plane API Reference:
  • Profile (/applepay-lifecycle/v1/merchants): View and update legal business names, tax IDs (EIN), contact numbers, and physical addresses.
  • Settings (/applepay-lifecycle/v1/settings): Retrieve unified profile and notification settings, or toggle individual email alerts.
  • Team (/applepay-lifecycle/v1/team): Query workspace rosters, issue 7-day invitations, update roles (owner, admin, analyst), and revoke access.
  • Support (/applepay-lifecycle/v1/support): Submit support tickets with severity levels (low, medium, high, urgent), read ticket threads, and post replies.