> ## Documentation Index > Fetch the complete documentation index at: https://developers.staging01.melio.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get limitations > Returns the entity's per-operation capabilities. Each operation (named `resource.subtype:action`) is either allowed or, if not, lists the reasons why (for example, missing information). Only write operations can be limited; read operations are always allowed and are not listed. ## OpenAPI ````yaml /openapi.json get /limitations openapi: 3.0.3 info: title: Melio Payouts API version: '1.0' description: > Self-serve payouts API. Partners onboard an Entity, which is the business (organization plus owner, with the details required to be payment-eligible), then attach accounts (internal accounts and external accounts) and make payments. ## Resource ids Every resource has an opaque, prefixed id that is stable for the life of the resource: `ent_` (entity), `pay_` (payment), `acct_` (account, internal or external). Ids are Melio-issued; treat them as opaque strings and never parse or construct them. To attach your own identifier to a resource, use `externalId`. ## Pagination List endpoints are cursor-paginated and always return results newest-first (`createdAt` descending). The response envelope is: ```json { "data": [ /* resources */ ], "hasMore": true } ``` Page through results with `limit` (1 to 50, default 50) plus a cursor: - `startingAfter=`: return the page immediately **after** the given resource id (the next, older page). This is how you walk forward through a list. - `endingBefore=`: return the page immediately **before** the given resource id (the previous, newer page). `startingAfter` and `endingBefore` are mutually exclusive. The cursor is a resource id you already received (e.g. the `id` of the last item on the current page), not an index. Keep requesting the next page until `hasMore` is `false`. ## Filtering & sorting Ordering is fixed (newest-first); there is no `sortBy`. To narrow a list, filter it. Each list endpoint documents its own filter parameters (there is no generic query language). Date-range filters use bracket suffixes and accept RFC 3339 timestamps: `created[gte]`, `created[lte]`. Filter by your own identifier with `externalId`, and by metadata with `metadata[]=` (matches resources whose metadata contains every supplied key/value pair). Filters combine with AND and compose with pagination. ## External ids Every created resource accepts an optional `externalId`, your own unique identifier for the resource (≤255 chars, letters/digits/`-`/`_`). It is unique per partner per resource type: reusing one returns `409 DUPLICATE_EXTERNAL_ID`. Use it to correlate Melio resources with records in your system and to look resources up (`?externalId=`) without storing Melio ids. `externalId` identifies a *resource*; it is not a request-deduplication key (that is the `Idempotency-Key` header, below); the two are complementary. ## Idempotency Send an `Idempotency-Key` header on every create so retries are safe: the original response is replayed instead of creating a second resource. It is required on `POST /payments`. ## Metadata Most resources accept a `metadata` object: free-form string key/value pairs that Melio stores and returns verbatim but never interprets. Limits: up to 50 keys, key ≤40 chars, value ≤100 chars. Use it to stash your own structured context on a resource; it is also filterable (see above). ## Melio Sonar Session Token Write endpoints optionally accept a `Melio-Sonar-Token` header: a signed session token minted by the MelioSonar SDK on the end user's device, carrying device signals used for risk evaluation. Omit it when no SDK session is available. contact: name: Melio Platform External API email: platform@melio.com servers: - description: Production url: https://api.melio.com/v2 - description: Staging01 url: https://api.staging01.melio.com/v2 security: [] tags: - name: Entities description: >- A business you onboard and operate on behalf of: its profile, compliance details, and per-operation limitations. - name: Accounts description: Accounts the entity pays from (internal) and payees it pays to (external). - name: Payments description: >- Money moved from an internal account to an external account, and their lifecycle. - name: Tools description: >- Pre-flight calculators for fees, fast-payment eligibility, and delivery estimates. No resource is created. - name: Webhooks description: >- Your single endpoint for event notifications, and the events you can subscribe to. paths: /limitations: parameters: - $ref: '#/components/parameters/MelioEntityId' get: tags: - Entities summary: Get limitations description: > Returns the entity's per-operation capabilities. Each operation (named `resource.subtype:action`) is either allowed or, if not, lists the reasons why (for example, missing information). Only write operations can be limited; read operations are always allowed and are not listed. responses: '200': description: Limitations. content: application/json: schema: $ref: '#/components/schemas/BusinessLimitations' example: capabilities: - operation: payment.domestic:write allowed: false reasons: - code: MissingInformation message: >- Additional information is required before this business can send payments. missingFields: - taxInfo - operation: account.internal:write allowed: true reasons: [] - operation: account.external:write allowed: true reasons: [] '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - ApiKey: [] components: parameters: MelioEntityId: name: Melio-Entity-Id in: header required: true description: >- Entity the request operates on — an entity id (`ent_`) or `me` (the partner's sole entity). schema: type: string schemas: BusinessLimitations: type: object description: > The business's per-operation capabilities. Every entry reports whether a write operation (create/update/delete) is allowed today and, if not, why. Only limitable operations are listed; read operations are always allowed and never appear. New operations will be added over time. required: - capabilities properties: capabilities: type: array items: $ref: '#/components/schemas/BusinessCapability' ErrorResponse: type: object required: - error properties: error: $ref: '#/components/schemas/Error' BusinessCapability: type: object description: A single operation, gated by `allowed`. required: - operation - allowed - reasons properties: operation: $ref: '#/components/schemas/BusinessCapabilityOperation' allowed: type: boolean description: Whether the business may perform this operation today. reasons: type: array items: $ref: '#/components/schemas/BusinessLimitationReason' description: > The reasons this operation is not allowed. Empty when `allowed` is true. Error: type: object required: - type - code - message properties: type: type: string description: >- Coarse, machine-readable error category. Branch on this to handle a whole class of failures without enumerating every `code`. enum: - invalid_request_error - authentication_error - authorization_error - not_found_error - conflict_error - rate_limit_error - service_unavailable_error - internal_error code: type: string description: Machine-readable error code. enum: - VALIDATION_ERROR - INVALID_ACCOUNT_TYPE - INVALID_DELIVERY_PREFERENCE - MCC_REQUIRED - GOODS_RECEIVED_REQUIRED - IDEMPOTENCY_KEY_REQUIRED - FEE_CALCULATION_FAILED - UNAUTHORIZED - NOT_FOUND - NO_ACTIVE_API_KEY - DUPLICATE_ENTITY - DUPLICATE_ACCOUNT - DUPLICATE_PAYMENT - DUPLICATE_EXTERNAL_ID - ACCOUNT_IN_USE - BUSINESS_NOT_ELIGIBLE - PAYMENT_NOT_EDITABLE - PAYMENT_NOT_CANCELABLE - IDEMPOTENCY_KEY_REUSED - IDEMPOTENCY_KEY_IN_PROGRESS - IDEMPOTENCY_STORE_UNAVAILABLE - INTERNAL_ERROR message: type: string description: Human-readable error message. details: type: object description: Additional error context (e.g. field-level validation failures). BusinessCapabilityOperation: type: string description: > The operation a capability gates, named inline as `resource.subtype:action`. `write` covers create, update and delete; only write operations can be limited. Read operations are always allowed and are never listed. New operations will be added to this enum over time; treat unknown values leniently. enum: - payment.domestic:write - account.internal:write - account.external:write BusinessLimitationReason: type: object description: A single reason a capability is not allowed. required: - code - message - missingFields properties: code: type: string description: > Machine-readable reason code, e.g. "MissingInformation", "AccountBlocked", "AccountUnderReview", "OutstandingBalance", "LocationRestricted", "AccountUnresponsive". message: type: string description: Static, English-language message approved for external display. missingFields: type: array items: type: string description: > Dot-paths into the Entity wire model that must be completed to lift this reason, e.g. "taxInfo". Empty when the reason is not about missing information. contactEmail: type: string description: > Melio contact address for resolving this reason. Present only when a contact address is available for the limitation; omitted otherwise. securitySchemes: ApiKey: type: apiKey in: header name: api-key ````