rafiqPay
Developers
API Reference · Security & ownership

Security Policy

Configure approval thresholds, hold durations, and solo caps within your KYB tier bounds (ACCESS_RULES).

The security_policy object

Represents a security_policy entity in the rafiqPay system.

FieldType & FlagsDescription
isSolo
boolean
True when the business has only 1 active team member.
settings
object
Effective value, default, bounds, source, and scheduledChange per setting.
Example security_policy JSON
security_policy example payload
{
  "object": "security_policy",
  "isSolo": false,
  "payoutApprovalThreshold": {
    "value": "50000.00",
    "default": "500000.00",
    "bounds": {
      "strictest": "0.00",
      "loosest": "5000000.00"
    },
    "source": "business",
    "ownerCanChange": true,
    "scheduledChange": {
      "newValue": "100000.00",
      "scheduled_for": "2026-10-21T16:10:00+01:00"
    }
  }
}

Endpoints & Operations

GET/v1/security-policyProposed

Retrieve the security policy

Returns effective values, tier bounds, source (default | business | rafiqpay_override), and any scheduled looser change.

Request Example
GET /v1/security-policy
cURL · v1
curl -X GET "https://api.rafiqpay.net/v1/security-policy" \
  -H "Authorization: Bearer rp_test_sk_kanzu_9f8a7b6c5d4e3f2a"
Response (200 OK)
Response payload
{
  "object": "security_policy",
  "isSolo": false
}
PATCH/v1/security-policyProposed

Change settings

Requires an Owner-scoped key. Stricter values apply immediately (200); looser values schedule 24 hours out (202).

Request Example
PATCH /v1/security-policy
cURL · v1
curl -X PATCH "https://api.rafiqpay.net/v1/security-policy" \
  -H "Authorization: Bearer rp_test_sk_kanzu_9f8a7b6c5d4e3f2a" \
  -H "Content-Type: application/json" \
  -d '{
  "payoutApprovalThreshold": "100000.00"
}'
Response (200 OK)
Response payload
{
  "object": "security_policy.scheduled_change",
  "id": "sch_01",
  "scheduled_for": "2026-10-21T16:10:00+01:00"
}
DELETE/v1/security-policy/scheduled/:idProposed

Cancel a scheduled change

Cancels a pending 24-hour looser policy change before it takes effect.

Request Example
DELETE /v1/security-policy/scheduled/:id
cURL · v1
curl -X DELETE "https://api.rafiqpay.net/v1/security-policy/scheduled/:id" \
  -H "Authorization: Bearer rp_test_sk_kanzu_9f8a7b6c5d4e3f2a"
Response (200 OK)
Response payload
{
  "id": "sch_01",
  "cancelled": true
}

Related Webhook Events

These events are dispatched to your webhook endpoints when actions occur on this resource:

security_policy.change_scheduledsecurity_policy.updated