The scopes are checked on the key itself. A
payments:initiate, payments:read or payables:read key cannot read or move the balance, and a balance-only key cannot send, cancel, retry or read payments.
Reading the balance
Full account and routing numbers are never returned.
Adding money
Not available through the API yet.
POST /v1/balance/deposits answers 403 feature_unavailable until Cleo turns partner bank funding on. Your user can add money in the Cleo web app.Idempotency-Key and achAuthorizationAccepted: true, sent only after your user accepted the ACH debit authorization. Cleo records your API key and the request’s IP address with it.
Withdrawing
destination is "linked_bank" or the id of a verified bank account from GET /v1/bank-accounts that has full account and routing numbers on file. You cannot send raw account numbers. New destinations are added in the Cleo web app. A withdrawal can be up to $50,000 and runs standard ACH.
Same-day ACH
Cleo decides whether a transfer runs same-day ACH. You cannot ask for it. Transfer responses report thespeed Cleo chose (same_day or standard) and the expected date.
Refusals
Deposits and withdrawals are money writes. A failure that may have moved money is final for its key. See Idempotency.