L
Laso Finance x402 API
OtherAbout Laso Finance x402 API
Review the Service identity, supported languages, protocol versions, and source metadata discovered by the directory.Service details
Service Id
5e5c2929-4f46-4ad7-951a-94b7dbd2f0b6
Service origin
https://laso.finance
ListedSeptember 24, 2026, 11:40 PM
Last checkedSeptember 24, 2026, 11:40 PM
Protocol details
SourceOpenAPI
Endpoints
Endpoint details are saved from the OpenAPI document. Authentication requirements and prices are advertised information, not a verified payment or access guarantee. The document may contain additional endpoints.POST/addBankingDestination
Attach bank details to a recipient
Attaches a bank account or crypto address to a recipient and returns the `destination_id` that `/send-bank-payment` pays out to. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/agentAuth
Exchange an API key for a session
Exchanges a durable `lasoak_` API key for a short-lived `id_token` (one hour) plus a `refresh_token`, and returns an `auth_url` to hand your human so they can watch what you do. This is the first call an agent makes. The reply's `id_token` authenticates every other endpoint here. If you have no key, your human creates one at https://laso.finance/agent/dashboard — there is no other way to obtain one. Send the `id_token` from `/auth` as a Bearer token, with a plain JSON body (no `data` wrapper). Free.Price unavailablePOST/agentWalletTransfer
Send USDC from the managed wallet
Moves USDC out of the managed wallet to any Solana address. Laso signs on your behalf. Takes an address, and deliberately **not** an address-book name: a rename between your human asking and you sending would move money somewhere they did not intend. When you resolve a name via `listAddressBook`, say the address back to them before sending. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/agentX402Pay
Pay an x402 endpoint from the managed wallet
Settles an x402 payment on your behalf, so you never build a payment header or hold a private key. Takes either a Laso `route` name or the full `url` of any external x402 endpoint on the open web. For an external `url`, pin `maxAmountUsdc` plus optionally `expectedAsset` / `expectedNetwork` / `expectedPayTo`; a challenge that exceeds or does not match them is refused. The call succeeds as long as the request went out, so check the returned `status` — it is the endpoint's status, not the callable's. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/announceAgentConnection
Announce that you connected
**Required immediately after sign-in, before anything else.** Your human is on a "waiting for your agent" screen that only flips to "connected" when this lands; until then a successful sign-in is indistinguishable from a broken one on their side. Skipping it is the most common agent mistake here, and the one humans actually notice. The reply also carries the wallet's funding state, so it doubles as a first `getAgentWallet` call. Send the `id_token` from `/auth` as a Bearer token, with a plain JSON body (no `data` wrapper). Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/auth
Get auth credentials
Free endpoint. Returns an ID token, refresh token, and user ID for the calling wallet. Use the ID token as a Bearer token to call Laso Finance APIs. Prove wallet ownership by sending a `SIGN-IN-WITH-X` header: a base64-encoded CAIP-122 signed message. Build it with `@x402/extensions/sign-in-with-x` (e.g. `wrapFetchWithSIWx` handles the round-trip automatically). Works for any EVM (Base, eip155:8453) or Solana mainnet wallet. For ID-token refresh use `POST /auth` with `grant_type=refresh_token`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/auth
Refresh an ID token
Exchange a refresh token for a new ID token. This is a free endpoint — no x402 payment required. Uses the standard OAuth2 `grant_type=refresh_token` pattern.Price unavailableGET/bank-recipients
List bank payout recipients (free)
Lists the recipients registered on your banking profile and the destinations attached to each, so you can find the `destination_id` that `GET /send-bank-payment` pays out to. Free — only the payout itself is a paid action. Bank account numbers are returned masked to their last four digits; routing numbers are returned in full. Create recipients and destinations with the `createBankingRecipient` and `addBankingDestination` callables, rename a destination's `nickname` (the only editable field) with `updateBankingDestination`, and remove a recipient with `deleteBankingRecipient` (see the [bank accounts guide](/guides/agent-bank-accounts)). Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/cancel-intl-order
Cancel a queued international card order
Cancel a previously queued international non-reloadable card order, as long as it has not yet been fulfilled by an admin (`state=queued`). The charged amount is credited back to the account balance. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/create-reloadable-card
Create a reloadable card
Creates a **reloadable** card funded from the account holder's balance with the card issuer, and returns it. This is the same card the holder creates in the Laso dashboard, so an agent and a human end up with the same product. The card is **reusable by default** (`reusable: true`): it stays open across charges until its limit is spent. Pass `reusable: false` for a single-use card that closes after its first approved charge. **This route is free** — no x402 payment. The card draws on the account holder's own balance with the issuer, so Laso fronts nothing. **If the balance is short**, this route answers `402`. Fund it by sending USDC: `GET /get-card-deposit-address` returns the holder's own deposit address at the card issuer (USDC on Base only), and the balance credits within a couple of minutes. The holder can also top up with Apple or Google Pay in the dashboard. Read the new card's number and CVV with `/get-card-data?card_id=...`. A card created here is Laso-issued, so its `card_details` come back dire…Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/createAgentApiKey
Issue an API key
Issues a durable `lasoak_` API key for the account. **The raw key is returned once** — only its hash is stored, so it cannot be retrieved again. Normally the human does this from the dashboard. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/createAgentWallet
Provision a managed wallet
Creates the Laso-custodied Solana spend wallet for the account, or returns the existing one. Idempotent. Most agents never call this: the wallet is provisioned when the human completes setup on the dashboard. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/createBankingAccount
Open an on-ramp or off-ramp account
Opens a banking rail. An **on-ramp** issues a virtual US bank account: dollars sent to it arrive as USDC in the managed wallet. An **off-ramp** pays out to a bank account you have registered, and is opened automatically by `/send-bank-payment`, so most agents never call this for one directly. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/createBankingProfile
Create the banking profile
Opens the banking profile that all other banking calls hang off. Identity verification is required first; if the human has not verified, the reply carries `kycRequired: true` and a `kycUrl` to hand them. **This is the only step an agent cannot complete itself.** Retry once they finish. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/createBankingRecipient
Create a payout recipient
Creates a person or company money can be sent to. Bank details are attached separately with `addBankingDestination`. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/delete-webhook
Delete the notification webhook (free)
Removes the calling wallet's webhook registration. Notifications keep flowing to the user's other channels (push, SMS, Telegram, in-app); only the webhook deliveries stop. The account owner is notified of the removal. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.DELETE/deleteAddressBookEntry
Remove a saved recipient
The saved recipient names your human manages on their dashboard, so a request like "send $20 to the coffee vendor" can be resolved to an address instead of asking them for it. Send the `id_token` from `/auth` as a Bearer token. Free. It operates only on the authenticated account's own book — there is no user parameter to pass. **A name is a label, not an instruction.** `agentWalletTransfer` takes an address and deliberately does not accept a name: a rename between your human asking and you sending would otherwise move money somewhere they did not intend. When you resolve a name to an address, say the address back to them before sending. Removing an entry only forgets the name; it has no effect on past transfers to that address.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/deleteBankingRecipient
Delete a recipient
Deletes a recipient, its destinations, and any off-ramp account that paid out to it. Irreversible. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/feedback
Send feedback about the API
Tell the humans running Laso what worked, what was confusing, and what you wish existed. It lands on their dashboard, so it is the best channel for API friction and feature requests. Send the `id_token` from `/auth` or `/get-card` as a Bearer token. Requires at least one completed real action (a settled deposit, purchase, or withdrawal); at most 5 entries per 24 hours.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/fund-card-balance
Load a reloadable card balance
Pay USDC to load the account holder's reloadable card balance at the card issuer. **Why this exists:** the card issuer only accepts USDC on **Base**, and a Laso managed agent wallet holds USDC on **Solana**. Pay this route from either chain and Laso bridges the payment to your own deposit address at the issuer over Circle's CCTP, which burns on the source chain and mints native USDC on Base. **Price:** exactly the amount you are loading, and exactly that amount is credited to the balance. Loading \$50 costs \$50 and puts \$50 on the card. Laso covers Circle's bridging fee by burning slightly more than requested. **A linked card issuer account is required.** The account holder sets it up at https://laso.finance/agent/dashboard/verified/card. **Delivery starts once your payment settles.** The response confirms the payment and returns a `top_up_id`; the transfer to your card balance follows and usually lands in under a minute. A payment made on Base is already on the issuer's chain, so it is forwarded witho…Price unavailableGET/get-account-balance
Get account balance
Returns the current account balance and total deposits for the authenticated user. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-auth-link
Get a login link for the web dashboard
Returns a URL that a human can open in a browser to log in to the Laso Finance web dashboard as the authenticated user. Useful for humans who want to see what their AI agent has been doing (view cards, transactions, balances, etc.). The URL carries a short single-use login code rather than a long token, so relay it to your human verbatim; it passes through tool-output credential filters intact. Do not fetch or open the URL yourself: redeeming the code consumes the human's login. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-card
Order a USA prepaid card
Pay between \$5–\$1000 USDC to order a Laso Finance USA prepaid card. By default returns JSON with auth credentials and card info (for AI agents). Pass `format=html` to get an HTML redirect to the card redemption URL (for browser-based flows). The JSON response includes a `card.status` of `"pending"`. Card details (number, CVV, etc.) take ~7-10 seconds to become available. Poll `getCardData` at the `callableBaseUrl` to check when `status` becomes `"ready"`. **U.S. only.** This card is issued in USD and can only be used for purchases at U.S.-based merchants. Physical goods must ship to a U.S. address. For non-U.S. merchants or non-USD currencies, use `GET /order-intl-card` instead. This endpoint is intended for the caller's own use — the card is non-transferable.Price unavailableGET/get-card-data
Get card details
Returns the current status and details of card orders. If `card_id` is provided, returns a single card, looked up across U.S. non-reloadable, international non-reloadable, and reloadable cards. If omitted, returns all cards of the given `card_type` for the authenticated user; `card_type` defaults to `Non-Reloadable U.S.` when omitted, so existing callers see unchanged behavior. Pass `card_type=Non-Reloadable International` to list international cards, or `card_type=Reloadable` to list reloadable cards. For U.S. non-reloadable cards, details take ~7-10 seconds to become available after ordering; poll every 2-3 seconds until `status` is `"ready"`, then read `card_details`. For international non-reloadable cards, the order is `queued` until an admin fulfills it (typically within 24 hours), after which `card_details` is populated. For international cards, the `card_id` returned by `/order-intl-card` is a queue id. After admin fulfillment, the issuer's transaction id becomes the new `card_id` and the original q…Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-card-deposit-address
Get the reloadable card deposit address
Returns the account holder's own USDC deposit address at the card issuer, and the balance currently on it. **This is how an agent funds a reloadable card balance with crypto.** Funding is user-funded: the address belongs to the account holder, so USDC sent to it credits their balance and funds their cards. The issuer provisions the address on first read, so simply calling this creates it. **Base only.** The address takes USDC on Base. USDC sent on another chain is unrecoverable. A Laso managed agent wallet holds USDC on **Solana**, so fund from a wallet that holds USDC on Base rather than transferring straight from a managed wallet. Deposits usually confirm within a couple of minutes. Poll this endpoint until `balance` reflects the deposit, then call `POST /create-reloadable-card`. The address is stable per holder, but read it through this endpoint rather than caching it: the issuer is the only authority on it.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-kyc-link
Get a KYC verification link (optional)
**KYC is optional.** It is only needed for certain features such as Venmo/PayPal payouts via `/send-payment`, and may be used for additional controls in the future. If you are not using those features, you can ignore the verification endpoints. Returns a one-time identity-verification link (`kyc_url`) for the calling wallet. Open it (or hand it to the wallet owner) to complete verification. The typical flow is: call `/get-kyc-status`, and only if `kyc_verified` is `false` call this to get a link, complete it, then proceed to `/send-payment`. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-kyc-status
Get KYC verification status (optional)
**KYC is optional.** Most endpoints (cards, gift cards, push-to-card, account balance, withdrawals) do not require verification. It is only needed for certain features such as Venmo/PayPal payouts via `/send-payment`, and may be used for additional controls in the future. If you are not using those features, you can ignore the verification endpoints entirely. Returns the calling wallet's cached KYC verification status. Use this as a free pre-flight check before paying for `/send-payment`: if `kyc_verified` is `true` the payout will go through. If it is `false`, don't call `/send-payment` yet — that call would not send the payout (it returns `kyc_required` and a `kyc_url`), and the USDC you paid would just land in your account balance, recoverable with `POST /withdraw`. To start verification when not verified, call `/get-kyc-link`. This reads the cached status kept up to date by the verification webhook; it does not start verification or return a verification link. Requires a Bearer token from `/auth` or `…Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-payment-status
Check Venmo and PayPal payout status (free)
Reports the state of the Venmo and PayPal payouts this account has sent with `GET /send-payment`. Free: only the payout itself is a paid action. Three ways to call it: with `payment_id` to fetch one payout, with `recipient_id` (from `GET /payment-recipients`) to list every payout to that saved recipient, or with neither to list every payout this account has sent, newest first. `state` is `queued` (waiting on account balance), `in-process` (dispatched to the platform), `complete`, `failed`, or `cancelled`. `queued` and `in-process` are the two states still in flight; poll every few minutes, or register a webhook with `POST /register-webhook` to be told when a payout completes instead. A payout that has been `in-process` for more than an hour is worth raising with the account owner. `state` is absent on payouts sent before state tracking existed. Bank payouts are not listed here: follow those with `listBankingTransactions`. Push-to-card transfers are completed by the recipient in the browser and have no ser…Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-push-to-card
Send money to a debit card (USD, EUR, GBP)
Pay USDC to initiate a push-to-card transfer. Specify the face value in the target currency (USD, EUR, or GBP); Laso computes the USDC cost using the current exchange rate plus a 4.8% fee (minimum fee of \$1.50/€1.50/£1.50 in the transfer currency), and that becomes the x402 price. Returns a `redemption_url` that must be opened to complete the transfer. The form requires sender name, debit card number, and cardholder name. **Supported currencies:** - `USD` — U.S. debit cards (U.S. bank accounts only) - `EUR` — Eurozone debit cards - `GBP` — U.K. debit cards Laso cannot perform the transfer directly — the redemption URL must be visited and the debit card details entered manually (by the agent or a human). **Fee:** 4.8%, with a minimum of 1.50 in the transfer currency (included in the USDC price, computed from the requested face value).Price unavailableGET/get-webhook
Get webhook registration & delivery health (free)
Returns the calling wallet's webhook registration and its delivery health. The signing secret is never returned here — it is shown once by `POST /register-webhook`; re-register to rotate it. A registration is auto-disabled after 50 consecutive failed deliveries (`disabled` becomes `true`); re-register to re-enable it. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/get-withdrawal-status
Get withdrawal statuses
Returns the status of withdrawals for the authenticated user. If `withdrawal_id` is provided, returns a single withdrawal. If omitted, returns all withdrawals. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/getAgentSpendLimit
Read the per-payment spend limit
Returns the maximum the account owner allows for any single payment from the managed wallet: `maxPerPaymentUsdc`, plus the `min`, `max`, and `default` bounds it can be set within, all in whole USDC. The limit defaults to \$1,000 and ranges from \$1 to \$50,000. It applies to every payment `agentX402Pay` makes, Laso routes and external `url` endpoints alike. Check an amount against this **before** attempting a payment rather than waiting to be refused. Compare the fee-inclusive total, since fees are added on top of the amount you request. Read-only to an agent: only the account owner can change the limit, from the dashboard. If a payment would exceed it, do not split it into smaller payments. Stop and tell your human. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/getAgentWallet
Read the managed wallet
Returns the managed wallet's Solana address and USDC balance: `wallet_address`, `balance_usdc`, `needs_funding`, and `has_wallet`. `wallet_address` is the only place to send funds, and it is **not** your `user_id` — a `usr_...` value is an account id, never a receive address. Poll this to watch a deposit land. Send the `id_token` from `/auth` as a Bearer token, with a plain JSON body (no `data` wrapper). Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/getBankingApplication
Read the banking application
Reads what the application still needs. Returns `ready` (whether it can be submitted), `applicationStatus`, and the outstanding questions. The identity answers carry over from verification; what remains are non-identity questions such as employment status and source of funds, which an agent can answer itself. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/getBankingProfileStatus
Check the banking profile status
Reads the current state of the banking profile: whether it exists, and where its application stands. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/getBankingTransaction
Read one transaction
Reads a single banking transaction — an on-ramp arriving or an off-ramp paying out — with its normalized status. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/list-card-transactions
List reloadable card transactions
Returns transactions on the authenticated user's **reloadable** cards, newest first: amount, merchant, status, and timestamps. Pass `card_id` for one card's history, or omit it for every reloadable card on the account. Filter with `status` and cap the page with `limit`. This route covers reloadable cards only. The two non-reloadable products keep their history in Laso's own records and are read through `/get-card-data`. If the wallet has no card issuer account linked, the list is empty and a `note` explains how the account holder sets one up at https://laso.finance/agent/dashboard/verified/card.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/listAddressBook
List saved recipients
The saved recipient names your human manages on their dashboard, so a request like "send $20 to the coffee vendor" can be resolved to an address instead of asking them for it. Send the `id_token` from `/auth` as a Bearer token. Free. It operates only on the authenticated account's own book — there is no user parameter to pass. **A name is a label, not an instruction.** `agentWalletTransfer` takes an address and deliberately does not accept a name: a rename between your human asking and you sending would otherwise move money somewhere they did not intend. When you resolve a name to an address, say the address back to them before sending.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/listBankingAccounts
List banking accounts
Lists the account's banking rails and their details — for an on-ramp, the routing and account numbers to give whoever is paying in. The off-ramp deposit address is deliberately withheld: it is internal payout plumbing, not account detail. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/listBankingRecipients
List recipients and destinations
Lists payout recipients and their destinations, with account numbers masked to the last four digits. This is where `destination_id` values come from. Also available as the free paywalled route `GET /bank-recipients`. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/listBankingTransactions
List transactions
Lists banking transactions for the account: money arriving over the on-ramp and paying out over the off-ramp, with normalized statuses and amounts. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/order-gift-card
Order a gift card
Pay USDC via x402 to order a gift card. First browse the catalog via `GET /search-gift-cards` to find the `laso_server_id` for the card you want, then call this endpoint with the amount and product ID. **Pricing:** `amount` is the card's face value in the product's own currency, not USD. Laso converts it to USD at the current exchange rate and adds the product's fee (up to 4.8%); that total is the x402 USDC price. A 100 SAR card costs roughly \$28 USDC, not \$100. Check the product's `currency` field in `GET /search-gift-cards` to see what `amount` is denominated in. The \$5 minimum and \$9,000 maximum apply to the **converted USD value**, not the raw amount, so a foreign-currency amount is accepted only when its USD equivalent falls inside that range. Returns redemption details (URL, code, and/or PIN) depending on the gift card brand.Price unavailableGET/order-intl-card
Order an international prepaid card
Order an international non-reloadable prepaid card (USD). The order is queued and fulfilled by an admin — after fulfillment, card details become available via `GET /get-card-data` with `card_type=Non-Reloadable International`. The x402 payment covers the on-card amount plus a 3.8% fee. Minimum \$100, maximum \$1,000 on-card amount. Submit a whole dollar amount. Placing the order accepts the card issuer's terms on behalf of the account holder: the [Cardholder Agreement](https://laso.finance/intl-card-cardholder-agreement.pdf), the [E-Communications Disclosure](https://laso.finance/intl-card-e-communications-disclosure.pdf), and the [Privacy Notice](https://laso.finance/intl-card-privacy-notice.pdf). If you need to cancel a queued order before it is fulfilled, use `POST /cancel-intl-order`.Price unavailableDELETE/payment-recipients
Remove a saved recipient (free)
Removes a saved Venmo or PayPal recipient. Payment history is kept; only the saved entry stops being offered. This is not reversible through the API, so prefer archiving (`POST /payment-recipients` with `archived: true`) when the account owner may want the recipient back, and confirm before removing someone they did not ask you to remove. `platform` and `recipient_id` may be sent in the JSON body or the query string. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/payment-recipients
List saved Venmo and PayPal recipients (free)
Lists the Venmo or PayPal recipients this account has paid before, so you can resolve a name your human said ("send $20 to Jane") into the `handle` that `GET /send-payment` takes as its `recipient_id`. Free — only the payout itself is a paid action. Two different ids are in play. Each entry's `recipient_id` is an opaque saved-entry id: pass it to `POST` and `DELETE /payment-recipients`. Its `handle` is the phone number or email you actually pay: pass that as `recipient_id` to `GET /send-payment`. Passing the saved-entry id to `GET /send-payment` does not send to the saved person. Use `total_sent` and `last_sent_timestamp` to disambiguate similar names, and confirm with your human rather than guessing between two entries. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/payment-recipients
Rename or archive a saved recipient (free)
Renames a saved Venmo or PayPal recipient, archives it, or both. Provide at least one of `display_name` or `archived`. Archiving hides an entry from the default list while keeping its history, which is the reversible way to retire a recipient. Prefer it over `DELETE`. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/refreshDeprecated
Refresh an ID token (deprecated)
**Deprecated:** Use `POST /auth` with `grant_type=refresh_token` instead. This endpoint is kept for backward compatibility. Exchange a refresh token for a new ID token. This is a free endpoint — no x402 payment required.Price unavailablePOST/refresh-card-data
Trigger a card data refresh
Requests an updated balance for a card. For U.S. non-reloadable cards (default), the card is re-scraped from the issuer via a retrieval queue and processed asynchronously. Rate limited per card to one request every 5 minutes, and to at most 12 refreshes in any rolling 24-hour period. For international non-reloadable cards, a balance update request is recorded; an admin will manually update the balance within 24 hours. While a balance update is already pending for a card, additional requests for that card return 409. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/register-webhook
Register a notification webhook (free)
Registers (or replaces) an HTTPS webhook URL to receive the calling wallet's account notifications as signed POSTs — banking application status changes, bank transfer and payout completions, agent wallet deposits, card orders, and every other event the user is notified about. This closes the polling gap for agents: instead of re-fetching status endpoints, point this at any URL you can receive HTTP on (your harness's inbound webhook endpoint, or a relay you poll). Deliveries are signed per the Standard Webhooks specification (https://www.standardwebhooks.com/): each POST carries `webhook-id`, `webhook-timestamp`, and `webhook-signature` (`v1,<base64 HMAC-SHA256>`) headers verifiable with any standard-webhooks library using the returned `secret`. The body is `{"type": "notification.<category>", "timestamp": "<ISO 8601>", "data": {"user_id", "title", "text", "category"}}`. The `secret` is returned exactly once, by this call. Re-registering rotates the secret, replaces the URL, and re-enables a registration th…Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/saveAddressBookEntry
Save or rename a recipient
The saved recipient names your human manages on their dashboard, so a request like "send $20 to the coffee vendor" can be resolved to an address instead of asking them for it. Send the `id_token` from `/auth` as a Bearer token. Free. It operates only on the authenticated account's own book — there is no user parameter to pass. **A name is a label, not an instruction.** `agentWalletTransfer` takes an address and deliberately does not accept a name: a rename between your human asking and you sending would otherwise move money somewhere they did not intend. When you resolve a name to an address, say the address back to them before sending. The address is the entry's key, so saving one that is already saved renames it rather than creating a duplicate. That makes this safe to retry.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/search-gift-cards
Search the gift card catalog
Browse and search available gift cards. Returns a list of gift card products with pricing, denomination, and catalog information. Use the `laso_server_id` from the results to order a card via `GET /order-gift-card`. Every response includes a `facets` object listing the valid values for the `category`, `currency`, and `country` filters. The facets are computed from the full catalog, so a single unfiltered request (no query parameters) is enough to discover everything you can filter on. This is a free endpoint — no x402 payment required. Requires a Bearer token from `/auth`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/search-merchants
Search merchant spend data
Search Laso's merchant database for confirmed spend data for a given card type. Returns whether the card was accepted, not accepted, or unknown at each merchant. Use `card_type` to search by the USA prepaid card (`Non-Reloadable U.S.`, the default) or the international prepaid card (`Non-Reloadable International`). USA searches exclude merchants with non-US country-code TLDs; international searches do not. **Important:** This database only contains merchants where Laso users have previously attempted a transaction. A merchant not being listed, or being listed as `unknown`, does NOT mean the card won't work there — it just means it hasn't been tried yet. If a merchant is listed as `accepted`, you can confidently use the card there. If listed as `not_accepted`, the card will fail at that merchant. Banking and money-transfer merchants are always returned as `not_accepted` with a `restriction_note`, whatever the transaction history shows. Spending there counts as a transfer of value and is not supported on an…Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/send-bank-payment
Send dollars to a bank account
Pay USDC to send dollars to a bank account by ACH. The x402 USDC price is the requested amount plus a 0.25% transfer fee (with a \$1.50 minimum fee). On-chain payment credits the calling wallet's Laso account balance via the standard deposit webhook; the callable then debits the gross amount and queues the transfer. **A bank destination is required first.** `destination_id` comes from the banking callables: create the banking profile with `createBankingProfile`, register who is being paid with `createBankingRecipient`, and attach their bank account with `addBankingDestination`, which returns the id. List what you already have at `GET /bank-recipients` (free). See the [bank accounts guide](/guides/agent-bank-accounts) for the full setup. **Identity verification is required** on the account that owns the banking profile, and only the human owner can complete it. `createBankingProfile` hands back a `kycUrl` when it is outstanding. **If the payout cannot be fulfilled** (no approved banking profile, a destinat…Price unavailableGET/send-payment
Send a payment via Venmo or PayPal
Pay USDC to send money to a Venmo or PayPal recipient. The x402 USDC price is the requested amount plus a 4.9% fee (with a \$1.50 minimum fee). On-chain payment credits the calling wallet's Laso account balance via the standard deposit webhook; the callable then debits the gross amount and dispatches the payout. **KYC required.** The first time a wallet sends a Venmo or PayPal payout it must complete identity verification. If the wallet is not yet verified the response returns `kyc_required: true` and a `kyc_url` — open the URL, complete the flow, and retry. If you don't want to proceed, the credited account balance can be withdrawn with `POST /withdraw`. **Recipient details.** Both Venmo and PayPal require the recipient's first name and last name. For Venmo, `recipient_id` is the recipient's 10-digit U.S. phone number and `recipient_email` is required. For PayPal, `recipient_id` is the recipient's PayPal email, which also serves as `recipient_email` (so `recipient_email` is optional). **Fee:** 4.9% with …Price unavailablePOST/signup
Start a signup for a human with no Laso account
Begins account creation for a human who does not have a Laso account yet. Requires no authentication, because the caller has no account. This does **not** create the account. An agent cannot: the account is created by Privy in the human's own browser, so it belongs to them and not to their agent. What this returns is a `claim_url` to hand over. Give your human the `claim_url` verbatim in your very next reply (send `message_for_human` if unsure what to say), and do not open it yourself. Then poll `GET /signup-status`, which holds the connection open until they finish and hands you your `lasoak_` API key. Rate limited per IP.Price unavailableGET/signup-status
Wait for your human to finish the signup
Long-polls until the human opens the claim link and finishes creating the account. Holds the connection open for about 60 seconds and returns **204 No Content** if they have not finished yet. **Retry on 204 and nothing else.** The call already blocks for you, so add no sleep between attempts. Every other status is final and retrying will not change the answer: 401 means the token is wrong, 410 means the link expired. Both carry `"terminal": true` in the body. A loop written as "retry until 200" spins at network speed against those, because they answer instantly rather than holding the connection. On completion it returns your `api_key` — **delivered exactly once**. Store it before doing anything else; a later poll returns the account without it. By that point the human is on their dashboard, their agent wallet is provisioned, and you are already recorded as their connected agent, so `announceAgentConnection` is not needed on this path.Price unavailablePOST/submitBankingApplication
Submit the application
Submits the completed application for review. If the partner rejects it as incomplete, the reply says what is still missing rather than failing opaquely. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/updateBankingApplicationDetails
Answer application questions
Submits answers to the non-identity application questions read from `getBankingApplication`. Call as many times as needed; each call merges. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/updateBankingDestination
Rename a destination
Sets or clears a destination's nickname. This is the only editable field: bank details are immutable at the partner, so anything else wrong means deleting the recipient and creating a new one. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/uploadBankingDocument
Upload a proof-of-address document
Attaches a proof-of-address document to the banking application, for the cases where the partner asks for one. The application must already exist and have an individual on it, so complete the application first. **Two things reject uploads that otherwise look fine.** A `.jpg` file must be sent as `fileType: "jpeg"` — `"jpg"` is refused. And the partner caps the *decoded* size at 10MB, even though their own upload page advertises 20MB; oversized files are rejected here before the round-trip. `fileContent` accepts either a bare base64 string or a `data:` URL, so a browser `FileReader.readAsDataURL` result can be passed through unchanged. A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.GET/version
Get the current docs version
Returns the current content-hash version of the Laso Finance agent docs (`SKILL.md`, `openapi.json`, `llms.txt`, `llms-full.txt`, `ai-plugin.json`). Free, no auth or payment header. Agents aggressively cache these docs, so use this to detect a stale cache: if the `docs_version` you last saw differs from the value returned here, refetch the docs. Every API response also carries this value in the `X-Laso-Docs-Version` response header, alongside `X-Laso-Docs-Manifest`, which points at the authoritative freshness beacon at `https://laso.finance/.well-known/docs-version.json`. This route is also the `status` target of the API catalog at `https://laso.finance/.well-known/api-catalog` (RFC 9727), which every response advertises via a `Link` header with `rel="api-catalog"`.Price unavailablePOST/withdraw
Withdraw from account balance
Initiate a withdrawal from the user's account balance. The USDC is sent on Solana to the `solana_address` you supply; the destination is never inferred, so the address is required. The withdrawal is created in a `pending` state and sent within a few minutes. Requires a Bearer token from `/auth` or `/get-card`.Price unavailableThe operation requires declared authentication; API keys, bearer tokens and other schemes are not evidence of AEP support.POST/withdraw-card-balance