Important: currently this service is in Beta testing and we welcome your feedback by contacting our Customer Support team. During the Beta testing, only personal access tokens are available. Service access tokens will be released in a future update.
Also during the Beta phase, it will be available on all paid plans at no additional cost.
What is the Vivid Business API
The Vivid Business API lets you read your account activity from your own systems, so you can pull operations into your accounting, reconciliation, or reporting tools without exporting files by hand.
Currently, the API is read-only (personal access token). You can retrieve operations on your accounts. You cannot use it to move money, issue or manage cards, set up automatic notifications, or write anything back to an operation. We will look to expand the capabilities in the future by including service access tokens.
To use it you need two things:
The list of IP addresses you wish to be accessible with the API
To create an API token in your Vivid Business account
How to create a token
Keep in mind that only Owners and Admins can create the token.
Sign in to your Vivid Business account on the web.
Go to the API section of your account settings.
Select Create key.
Read and confirm the consent screen.
Copy the token and store it somewhere secure.
Currently, all tokens have a validity period of 90 days.
How to revoke a token
Go to the API section of your account and deactivate the token you no longer want to use. Once a token is deactivated, any calls made with it are refused.
What happens if the token creator is removed from the account?
During the Beta phase with personal access tokens, if the person who created the API token is removed from the Vivid Business account, the API token will automatically be deactivated. In the future, service access tokens will allow you to set up a key per company account.
How do I configure and use the API?
Refer to our knowledge source here for more information about using the API.
Keeping your data safe when using the Vivid Business API
When you connect the API to your systems or a third-party tool, your account data is sent there on your instruction. That data may include personal data, such as names of team members, cardholders or payment counterparties. Once it leaves Vivid, it is outside our control. Vivid doesn’t check the tools you connect and isn’t responsible for how they use or protect your data. That processing is your responsibility, including under the GDPR. Only connect tools you trust, review their privacy and security practices, and only share the data they need.
You can always exercise your GDPR rights with Vivid, for processes controlled by Vivid (see our Privacy Notice). For data already sent to a third-party tool, contact its provider directly.
To protect your account:
tokens can only be created after two-factor sign-in
you choose what each token can read, limited to the last 90 days of operations
calls are only accepted from your allowed IP addresses
tokens expire automatically and can be deactivated at any time
Treat your token like a password, because anyone who has it can read your data. If you think it has been exposed, deactivate it immediately and contact Customer Support.