Read access to merchant-acquiring entity, organization and relationship intelligence.
StatementIQ resolves merchant-acquiring participants — acquirers, ISOs, payment facilitators, sponsor banks — into canonical entities, and records the evidence-backed relationships between them. An entity is a real-world organization, not a registration record: one company holding three Visa service-provider registrations is one entity, not three.
Version 1.0.0 of this API is read-only. Every operation is a
GET.
https://api.stmtiq.comdevelopers.statementiq.com serves documentation and answers no API request.
Send calls to api.stmtiq.com.
Every operation except GET /health requires an API client credential, sent as
an HTTP bearer token:
Authorization: Bearer <YOUR_API_CLIENT_CREDENTIAL>Credentials are issued to you by StatementIQ; there is no self-service registration. Treat the credential as a secret — it is equivalent to a password and is not restricted to a single source address. StatementIQ stores only a SHA-256 hash, so a lost credential cannot be recovered and must be reissued.
The API client credential is the only supported mechanism for external integration.
Authenticating proves who you are. What you can see is decided separately, by the organization grants attached to your API client. List operations filter rather than refuse: an empty page can mean "nothing matches" or "nothing you can see matches", and the two are deliberately indistinguishable.
Confirm your network path first — /health needs no credential:
curl https://api.stmtiq.com/healthThen make your first authenticated call:
curl -H "Authorization: Bearer $STATEMENTIQ_CREDENTIAL" \
"https://api.stmtiq.com/entities?search=example&size=5"
Paths are sent exactly as documented. Do not add an /api prefix — StatementIQ
adds it internally, which is why the path field inside error bodies shows a
different value from the URL you requested.
| Status | Meaning | What to do |
|---|---|---|
400 |
Malformed or self-contradictory request. | Fix the request. Retrying unchanged will not help. |
401 |
Credential missing, malformed, unknown or no longer valid. These cases are not distinguished. | Check the Authorization header. If it was working, the credential may have been revoked — contact StatementIQ. |
403 |
Credential is valid but not permitted to perform this operation. | An access-grant question, not a credential question. Contact StatementIQ. |
404 |
No such record — or a record you are not permitted to know exists. | StatementIQ returns 404 rather than 403 where confirming existence would itself disclose something. |
Two error body shapes exist and clients should tolerate both: most failures carry
timestamp, status, error and path;
validation failures carry only error.
This contract follows semantic versioning, independently of StatementIQ's internal release numbering. Additive changes increment the minor version; breaking changes increment the major version and are announced beforehand.
No rate limit is currently enforced. That is not a guarantee — build clients that tolerate
429 and 503.
StatementIQ's internal surface is larger than this contract. Administrative, job-control, diagnostic and security-management operations are deliberately excluded, are not supported for external use, and may change without notice. Their absence is a product decision, not an oversight.