# POST /api/merchants/{id}/screening-provider-profiles

Screening Provider: adds a screening provider profile to the merchant.

Example body:
```
{
  "isActive": true,
  "configuration": {
    "providerId": "example-screening",
    "fieldValues": [ { "key": "apiKey", "value": "…" } ]
  }
}
```
An active profile whose provider declares a conflict with one of the merchant's active processor
profiles is rejected. Optionally send `If-Match: "<concurrencyStamp>"` for optimistic
concurrency (409 on a stale stamp).

**Operation ID:** `merchantScreeningProviderProfileCreate`

## Authorization

Requires: Merchants.Merchants.Create, merchant scope.

Required permissions:
- `Merchants.Merchants.Create`

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| id | path | yes | string(uuid) | The merchant id. |
| suppressNulls | query | no | boolean | If true, omit properties with null values. |

## Request Body

The profile to add. The `screeningProviderProfileId` is server-assigned; any value supplied
on the body is ignored. Discover the provider's field keys via
`GET /api/screening-providers/{providerId}/config-schema`, or fetch a ready-to-fill skeleton
from `.../config-schema/template`.

**Content type:** `application/json`

Schema: `ScreeningProviderProfileDto`

Properties:
- `screeningProviderProfileId` (string(uuid)): Unique identifier of this screening provider profile. Server-assigned on add; any value supplied  on input to the sub-resource surface is ignored.
- `merchantId` (string(uuid)): The owning merchant. Stamped by the server; a value supplied on input is overwritten.
- `isActive` (boolean): Whether this profile is consulted. Only an active profile participates in the exclusivity rule  against the merchant's active processor profiles.
- `configuration` (object) required: The provider identity and its per-merchant field values.
- `reviewAction` (object): What the platform does when this provider asks for a human decision rather than answering  accept or decline. Omit (or send `null`) for the default,  `Audit`: record the verdict on the transaction and continue.
- `onFailureBehavior` (object): What the platform does when this provider cannot give a decision at all: a timeout, an error, an  Unavailable verdict, or a skipped call because the provider's circuit breaker is open. Omit (or  send `null`) for the default,  `ContinueWithAudit`: record the non-decision on the  transaction and continue to authorization.
- `timeoutMs` (integer(int32)): How long one call to this provider may take before it is abandoned and recorded as a timeout, in  milliseconds. Accepted range is `MinimumMs` to  `MaximumMs`; omit for the default,  `DefaultMs`.
- `reviewHoldDeadlineMinutes` (integer(int32)): How long a transaction held for manual review may wait for a reviewer's disposition, in minutes.  Accepted range is `MinimumDeadlineMinutes` to  `MaximumDeadlineMinutes`; omit for the default,  `DefaultDeadlineMinutes`. Conditional: When ReviewAction != HoldForReview.
- `reviewHoldExpiryAction` (object): What happens to a held transaction whose deadline elapsed with no reviewer disposition. Omit (or  send `null`) for the default,  `Decline`: an  unanswered review is not an approval. Conditional: When ReviewAction != HoldForReview.

**Content type:** `text/json`

Schema: `ScreeningProviderProfileDto`

Properties:
- `screeningProviderProfileId` (string(uuid)): Unique identifier of this screening provider profile. Server-assigned on add; any value supplied  on input to the sub-resource surface is ignored.
- `merchantId` (string(uuid)): The owning merchant. Stamped by the server; a value supplied on input is overwritten.
- `isActive` (boolean): Whether this profile is consulted. Only an active profile participates in the exclusivity rule  against the merchant's active processor profiles.
- `configuration` (object) required: The provider identity and its per-merchant field values.
- `reviewAction` (object): What the platform does when this provider asks for a human decision rather than answering  accept or decline. Omit (or send `null`) for the default,  `Audit`: record the verdict on the transaction and continue.
- `onFailureBehavior` (object): What the platform does when this provider cannot give a decision at all: a timeout, an error, an  Unavailable verdict, or a skipped call because the provider's circuit breaker is open. Omit (or  send `null`) for the default,  `ContinueWithAudit`: record the non-decision on the  transaction and continue to authorization.
- `timeoutMs` (integer(int32)): How long one call to this provider may take before it is abandoned and recorded as a timeout, in  milliseconds. Accepted range is `MinimumMs` to  `MaximumMs`; omit for the default,  `DefaultMs`.
- `reviewHoldDeadlineMinutes` (integer(int32)): How long a transaction held for manual review may wait for a reviewer's disposition, in minutes.  Accepted range is `MinimumDeadlineMinutes` to  `MaximumDeadlineMinutes`; omit for the default,  `DefaultDeadlineMinutes`. Conditional: When ReviewAction != HoldForReview.
- `reviewHoldExpiryAction` (object): What happens to a held transaction whose deadline elapsed with no reviewer disposition. Omit (or  send `null`) for the default,  `Decline`: an  unanswered review is not an approval. Conditional: When ReviewAction != HoldForReview.

**Content type:** `application/*+json`

Schema: `ScreeningProviderProfileDto`

Properties:
- `screeningProviderProfileId` (string(uuid)): Unique identifier of this screening provider profile. Server-assigned on add; any value supplied  on input to the sub-resource surface is ignored.
- `merchantId` (string(uuid)): The owning merchant. Stamped by the server; a value supplied on input is overwritten.
- `isActive` (boolean): Whether this profile is consulted. Only an active profile participates in the exclusivity rule  against the merchant's active processor profiles.
- `configuration` (object) required: The provider identity and its per-merchant field values.
- `reviewAction` (object): What the platform does when this provider asks for a human decision rather than answering  accept or decline. Omit (or send `null`) for the default,  `Audit`: record the verdict on the transaction and continue.
- `onFailureBehavior` (object): What the platform does when this provider cannot give a decision at all: a timeout, an error, an  Unavailable verdict, or a skipped call because the provider's circuit breaker is open. Omit (or  send `null`) for the default,  `ContinueWithAudit`: record the non-decision on the  transaction and continue to authorization.
- `timeoutMs` (integer(int32)): How long one call to this provider may take before it is abandoned and recorded as a timeout, in  milliseconds. Accepted range is `MinimumMs` to  `MaximumMs`; omit for the default,  `DefaultMs`.
- `reviewHoldDeadlineMinutes` (integer(int32)): How long a transaction held for manual review may wait for a reviewer's disposition, in minutes.  Accepted range is `MinimumDeadlineMinutes` to  `MaximumDeadlineMinutes`; omit for the default,  `DefaultDeadlineMinutes`. Conditional: When ReviewAction != HoldForReview.
- `reviewHoldExpiryAction` (object): What happens to a held transaction whose deadline elapsed with no reviewer disposition. Omit (or  send `null`) for the default,  `Decline`: an  unanswered review is not an approval. Conditional: When ReviewAction != HoldForReview.

## Responses

### 200

OK

**Content type:** `application/json`

Schema: `ScreeningProviderProfileDto`

Properties:
- `screeningProviderProfileId` (string(uuid)): Unique identifier of this screening provider profile. Server-assigned on add; any value supplied  on input to the sub-resource surface is ignored.
- `merchantId` (string(uuid)): The owning merchant. Stamped by the server; a value supplied on input is overwritten.
- `isActive` (boolean): Whether this profile is consulted. Only an active profile participates in the exclusivity rule  against the merchant's active processor profiles.
- `configuration` (object) required: The provider identity and its per-merchant field values.
- `reviewAction` (object): What the platform does when this provider asks for a human decision rather than answering  accept or decline. Omit (or send `null`) for the default,  `Audit`: record the verdict on the transaction and continue.
- `onFailureBehavior` (object): What the platform does when this provider cannot give a decision at all: a timeout, an error, an  Unavailable verdict, or a skipped call because the provider's circuit breaker is open. Omit (or  send `null`) for the default,  `ContinueWithAudit`: record the non-decision on the  transaction and continue to authorization.
- `timeoutMs` (integer(int32)): How long one call to this provider may take before it is abandoned and recorded as a timeout, in  milliseconds. Accepted range is `MinimumMs` to  `MaximumMs`; omit for the default,  `DefaultMs`.
- `reviewHoldDeadlineMinutes` (integer(int32)): How long a transaction held for manual review may wait for a reviewer's disposition, in minutes.  Accepted range is `MinimumDeadlineMinutes` to  `MaximumDeadlineMinutes`; omit for the default,  `DefaultDeadlineMinutes`. Conditional: When ReviewAction != HoldForReview.
- `reviewHoldExpiryAction` (object): What happens to a held transaction whose deadline elapsed with no reviewer disposition. Omit (or  send `null`) for the default,  `Decline`: an  unanswered review is not an approval. Conditional: When ReviewAction != HoldForReview.

### 403

Forbidden

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

### 401

Unauthorized

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

### 400

Bad Request

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

### 404

Not Found

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

### 501

Not Implemented

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

### 500

Internal Server Error

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

### default

The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. See the error-code reference in this document's description for the values `error.code` can take.

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

### 429

The request was refused because a rate limit was exceeded, or because something a later retry can clear stopped it. A rate limit refusal carries an `application/problem+json` body: wait at least the interval `Retry-After` names before retrying, then back off. Limits are tuned per deployment, so read the allowance from the response headers rather than assuming a fixed ceiling. Any other refusal carries the standard error envelope as `application/json`, and its `error.code` names the cause.

**Content type:** `application/problem+json`

Schema: `RateLimitProblemDetails`

Properties:
- `type` (string) required: The problem type identifier. Always the same value: the failure is the status code itself,  so there is no sub-type for a caller to branch on.
- `title` (string) required: A short, human-readable summary of the problem type.
- `status` (integer(int32)) required: The HTTP status code, repeated in the body as the problem-details format defines.
- `detail` (string) required: A human-readable explanation of this occurrence of the problem.
- `retryAfterSeconds` (integer(int32)) required: How long to wait before retrying, in whole seconds, carrying the same figure as the  `Retry-After` header. Always at least one: a value of zero would invite an immediate  retry that is certain to be rejected again.

**Content type:** `application/json`

Schema: `RemoteServiceErrorResponse`

Properties:
- `error` (RemoteServiceErrorInfo)

## Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a ScreeningProviderProfileDto. See the Request body section below for its fields.

### cURL

```bash
curl -X POST "{{BASE_URL}}/api/merchants/{id}/screening-provider-profiles" \
  -H "api-key: {{API_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{
  "configuration": {}
}'
```

### PowerShell

```powershell
$headers = @{
    'api-key' = '{{API_KEY}}'
}

$body = @'
{
  "configuration": {}
}
'@

$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/merchants/{id}/screening-provider-profiles' `
    -Headers $headers -ContentType 'application/json' -Body $body
```

### TypeScript (SDK)

```bash
npm install @winkpg/winkpg-api
```

```typescript
import { Configuration, MerchantsApi } from '@winkpg/winkpg-api';

const api = new MerchantsApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.merchantScreeningProviderProfileCreate("3fa85f64-5717-4562-b3fc-2c963f66afa6", {
  "configuration": {}
});
```

### TypeScript (raw HTTP)

```typescript
const response = await fetch('{{BASE_URL}}/api/merchants/{id}/screening-provider-profiles', {
  method: 'POST',
  headers: {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "configuration": {}
  }),
});

const data = await response.json();
```

### C# (SDK)

```bash
dotnet add package WinkPg.Api.Client
```

```csharp
using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;
using System.Text.Json;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new MerchantsApi(config);
var body = JsonSerializer.Deserialize<ScreeningProviderProfileDto>("""
    {
      "configuration": {}
    }
    """);

var result = await api.MerchantScreeningProviderProfileCreateAsync(Guid.Parse("3fa85f64-5717-4562-b3fc-2c963f66afa6"), body);
```

### C# (raw HTTP)

```csharp
using System.Text;

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/merchants/{id}/screening-provider-profiles");
request.Headers.Add("api-key", "{{API_KEY}}");

request.Content = new StringContent("""
    {
      "configuration": {}
    }
    """, Encoding.UTF8, "application/json");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();
```

### Python (SDK)

```bash
pip install winkpg-api
```

```python
import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.MerchantsApi(client)
    body = winkpg_api.ScreeningProviderProfileDto.from_dict({
      "configuration": {}
    })
    result = api.merchant_screening_provider_profile_create("3fa85f64-5717-4562-b3fc-2c963f66afa6", body)
```

### Python (raw HTTP)

```bash
pip install requests
```

```python
import requests

headers = {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
}

body = {
  "configuration": {}
}

response = requests.request(
    "POST",
    "{{BASE_URL}}/api/merchants/{id}/screening-provider-profiles",
    headers=headers,
    json=body,
)
response.raise_for_status()
data = response.json()
```

## See also

- [All documentation](https://devportal-simpay-sbx.winkpg.io/llms.txt): the machine-readable index of every public page on this site.