Merchants

Fetch merchant info and the presigned acceptance token required for every transaction.

The merchant endpoint is the only one that needs no authentication header — the public key travels as part of the URL. Use it to fetch merchant metadata and, crucially, the two presigned acceptance tokens you must include in every createTransaction call.

getMerchant()

GET /merchants/{publicKey}. Returns the merchant record. Requires only the public key (passed at client construction).

const [error, response] = await wompi.merchants.getMerchant();
if (error) throw error;

const merchant = response;

merchant.name; // string | undefined
merchant.legal_name; // string | undefined
merchant.accepted_payment_methods; // string[] | undefined
merchant.presigned_acceptance?.acceptance_token; // string
merchant.presigned_personal_data_auth?.acceptance_token; // string

Response shape

Field	Type	Notes
`id`	`number`	Wompi merchant id.
`name`	`string?`	Public merchant name.
`legal_name`	`string?`	Legal entity name.
`legal_id` / `legal_id_type`	`string?`	`NIT` or `CC`.
`accepted_payment_methods`	`string[]?`	`"CARD"`, `"NEQUI"`, `"PSE"`, …
`accepted_currencies`	`"COP"[]?`	Always `["COP"]` today.
`presigned_acceptance`	`object?`	See below.
`presigned_personal_data_auth`	`object?`	See below.

Presigned acceptance

Wompi asks the customer for two consents, and both objects have the same shape — { acceptance_token, permalink, type }:

presigned_acceptance — the merchant’s end-user policy. type is "END_USER_POLICY". Send it as acceptance_token.
presigned_personal_data_auth — the personal-data authorization. type is "PERSONAL_DATA_AUTH". Send it as accept_personal_auth.

Show both permalink values to the customer; pass both tokens to createTransaction and createPaymentSource.

const [error, response] = await wompi.merchants.getMerchant();
if (error) throw error;

const acceptance = response.presigned_acceptance;
const personalDataAuth = response.presigned_personal_data_auth;

// Persist for the duration of a single transaction — Wompi rotates these.
return {
  acceptanceToken: acceptance?.acceptance_token,
  termsUrl: acceptance?.permalink,
  personalAuthToken: personalDataAuth?.acceptance_token,
  personalDataUrl: personalDataAuth?.permalink,
};

acceptance_token — string, expires; fetch once per transaction.
permalink — URL to the merchant’s terms or personal-data policy.
type — "END_USER_POLICY" or "PERSONAL_DATA_AUTH".

Errors

The endpoint is public, so authentication errors don’t apply. Possible error values:

WompiNotFoundError — public key doesn’t match any merchant.
WompiRequestError — any other non-2xx response.