> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Control Plane API Overview

> Base URLs, authentication scopes, tenant isolation, and overview of the Pcnaid Apple Pay Control Plane REST API.

# Control Plane API Overview

The **Pcnaid Apple Pay Control Plane API** is an edge-native REST API deployed at `https://api.lifecyclemanager.app`. It exposes routes for managing merchant profiles, notification settings, team member roles and invitations, and technical support tickets.

## Base URL & environment

| Environment | Base URL | Status |
| - | - | - |
| **Production** | `https://api.lifecyclemanager.app` | Live |
| **Staging** | `https://api-staging.lifecyclemanager.app` | Internal |

> [!NOTE]
>
> **Route Prefix**: All version 1 routes are mounted under the path prefix `/applepay-lifecycle/v1/*`.

## Authentication & scopes

All API requests require an Auth0 Bearer access token passed in the standard `Authorization` header:

```http theme={null}
Authorization: Bearer <JWT_ACCESS_TOKEN>
```

Access tokens are validated using RS256 with keys published at Pcnaid's Auth0 JWKS endpoint.

### Permission scopes

| Scope | Description | Allowed Endpoints |
| - | - | - |
| `read:merchants` | Read-only access to merchant identity, configuration, notification settings, team rosters, and support tickets. | `GET /merchants/me`, `GET /settings`, `GET /settings/notifications`, `GET /team`, `GET /support/tickets`, `GET /support/tickets/:id` |
| `write:merchants` | Write access to update profile attributes, upsert notification preferences, issue team invitations, update member roles, and submit support tickets. | `PATCH /merchants/me`, `PATCH /settings`, `PUT /settings/notifications`, `POST /team/invitations`, `PATCH /team/members/:id`, `DELETE /team/members/:id`, `POST /support/tickets`, `POST /support/tickets/:id/messages` |

## Strict tenant isolation

Tenant isolation is enforced cryptographically at the API boundary:

1. The Control Plane extracts `auth.merchantId` directly from verified claims in the Auth0 Bearer token.
2. Every database query executed against Render Postgres strictly parameterizes `WHERE merchant_id = ${auth.merchantId}`.
3. Cross-tenant access is impossible; requests specifying a resource ID belonging to another merchant return `404 Not Found` rather than leaking tenant existence.

## Endpoint families

Explore the complete schemas, parameters, and payloads in the [Control Plane API Reference](https://docs.pcnaid.com/nodes/web-apps/lifecycle-manager-apple-pay/developer/api/control-plane.md):

* **Profile (`/applepay-lifecycle/v1/merchants`)**: View and update legal business names, tax IDs (EIN), contact numbers, and physical addresses.
* **Settings (`/applepay-lifecycle/v1/settings`)**: Retrieve unified profile and notification settings, or toggle individual email alerts.
* **Team (`/applepay-lifecycle/v1/team`)**: Query workspace rosters, issue 7-day invitations, update roles (`owner`, `admin`, `analyst`), and revoke access.
* **Support (`/applepay-lifecycle/v1/support`)**: Submit support tickets with severity levels (`low`, `medium`, `high`, `urgent`), read ticket threads, and post replies.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.