Endpoint
POST /v3/med/create
Authentication and target
Use an account credential for its bound account, or a user credential with bothX-ISPB and X-Account-Number. If an account credential sends those headers, both must be present and must match its bound account. Platform credentials are not accepted. All requests require the standard HMAC-SHA256 headers. The selected account determines payer-side MED owner scope; receiver-side operations are not exposed by these routes.
The curl example below uses an ACCOUNT credential bound to the operated account, so it omits X-ISPB and X-Account-Number. If X-Client-ID identifies a USER credential, add both target headers and include their exact trimmed values in the canonical header set before calculating X-Signature.
Request body
Success data
med_case with IDs, numeric canonical status, display text, progress/cancellation fields, original transaction, decimal-string amounts, numeric fraud/flow values, millisecond lifecycle timestamps/deadlines, timeline, infractions, and refunds.
Behavior and validation
Eligibility, workflow transitions, and cancellation availability are decided by the downstream MED service. The immediate result can be non-final; use numericstatus for logic.
Errors
Every call can fail for missing or invalid signature headers, an expired timestamp, nonce replay, an invalid body hash or signature, insufficient permission, or a downstream service error. Endpoint-specific errors include:4000missing end-to-end ID;4003008missing account context;4004101incomplete owner scope.500unavailable/nil MED response and mapped MED provider errors.