What authentication does the Payten MSU API use?

Authentication uses an Authorization header carrying MERCHANTUSER and MERCHANTPASSWORD credentials, exchanged via POST /session for a session token reused on subsequent calls. Through Jentic, the merchant credentials live in the vault and the agent only ever sees a scoped Jentic token.

Can I issue partial refunds with the Payten MSU API?

Yes. POST /refund accepts an amount that can be less than the original transaction total, so partial refunds work the same way as full refunds. Use POST /query first if you need to confirm the original charge is in a refundable state.

What are the rate limits for the Payten MSU API?

The OpenAPI spec does not declare explicit rate limits. Payten enforces gateway-side throttling per merchant and per acquirer; recurring batch jobs should sequence calls and use POST /session/extend to keep a single token alive rather than re-authenticating per request.

How do I generate a pay-by-link through Jentic?

Install the SDK with pip install jentic, search for 'create a Payten pay-by-link', load the POST /payByLink/add operation, and execute it with the amount, currency, and customer details. Jentic returns the hosted URL you can send to the customer.

Does the Payten MSU API support recurring billing?

Yes. Combine POST /card/add to vault the customer card with scheduled POST /sale calls referencing the saved card to charge subscriptions. The Recurring tag groups operations specific to recurring plan configuration.

Can I limit what my agent is allowed to do with the Payten MSU API?

Yes. The Payten MSU API takes its targets in the request body rather than as URL path resources, so with your self-hosted Jentic One instance you write the rules that decide which operations and credentials the agent may use. You can scope it to only the calls it needs, such as POST /sale and POST /payByLink/add, and destructive operations like POST /refund, POST /void, or POST /postauth stay out of reach unless you explicitly add them. Your MSU merchant credentials are injected at execution time under those same rules, so the agent can only exercise the operations you have allowed.