"Not permitted to perform create on holds"

Question

I can create a card and create an account with that new card, but when I try to create a hold I receive a 401 error saying Not permitted to perform create on holds

I am using balanced.js to create the card then sending the card_uri to my application.

I then create an account by POSTing

{
"uri": card_uri,
"email_address":"xxx@yyy.com"
}

to https://api.balancedpayments.com/v1/marketplaces/MYTESTMARKETURI/accounts?MYTESTMARKETSECRETKEY and I recieve a response like this:

{
"holds_uri": "/v1/marketplaces/MYTESTMARKETURI/accounts/AC6uOkhFTsOMpvY8zAvjnBtu/holds",
"name": null,
"roles": [],
"created_at": ...,
"uri": ...,
"bank_accounts_uri": ...,
"refunds_uri": ...,
"meta": {},
"debits_uri": ..,
"transactions_uri": ...,
"email_address": "xxx@yyy.com",
"id": "AC6uOkhFTsOMpvY8zAvjnBtu",
"credits_uri": ...,
"cards_uri": ...
}

and the new account with the new card shows up in my dashboard on balancedpayments.com.

When I try to create a hold by POSTing

{
"amount": 200
}

to https://api.balancedpayments.com/v1/marketplaces/MYTESTMARKETURI/accounts/AC6uOkhFTsOMpvY8zAvjnBtu/holds?MYTESTMARKETSECRETKEY I receive the following error:

{
"status": "Unauthorized",
"category_code": "authentication-required",
"category_type": "permission",
"description": "Not permitted to perform create on holds. Your request id is OHMf82dbd8e10a811e29f5d026ba7d31e6f.",
"request_id": "OHMf82dbd8e10a811e29f5d026ba7d31e6f",
"status_code": 401
}

What am I doing wrong? How do I create a hold using the BalancedPayments.com REST API?

Answer 1

401 means you are not authenticating when making the create hold request.

Instead of including MYTESTMARKETSECRETKEY in the query string you need to use a Basic Auth header.

I'm not sure which of the balanced clients you are using (they include that header for you, you just tell it your MYTESTMARKETSECRETKEY) but for curl the request would be:

curl -u MYTESTMARKETSECRETKEY: https://api.balancedpayments.com/v1/marketplaces
/MYTESTMARKETURI/accounts/AC6uOkhFTsOMpvY8zAvjnBtu/holds -x POST -d amount=200

And the response looks like:

{
  "account": {
    "holds_uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/holds", 
    "name": "xxxx",
    "roles": [
      "buyer"
    ], 
    "created_at": "2012-07-28T23:12:15.859231Z", 
    "uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx", 
    "bank_accounts_uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/bank_accounts", 
    "refunds_uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/refunds", 
    "meta": {}, 
    "debits_uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/debits", 
    "transactions_uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/transactions", 
    "email_address": "xxxxxxxx@xxxxxx.com", 
    "id": "ACxxxxxxxxxxxxxxxxxxxxxx", 
    "credits_uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/credits", 
    "cards_uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/cards"
  }, 
  "fee": 35, 
  "description": null, 
  "amount": 123, 
  "created_at": "2012-10-08T05:23:20.943961Z", 
  "uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/holds/HLxxxxxxxxxxxxxxxxxxxxxx", 
  "expires_at": "2012-10-15T05:23:20.876214Z", 
  "source": {
    "card_type": "xxxx"
    "hash": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", 
    "country_code": "USA", 
    "expiration_year": xxxx, 
    "created_at": "2012-09-03T01:08:31.530261Z", 
    "brand": "xxxx",
    "uri": "/v1/marketplaces/MKxxxxxxxxxxxxxxxxxxxxxx/accounts/ACxxxxxxxxxxxxxxxxxxxxxx/cards/CCxxxxxxxxxxxxxxxxxxxxxx", 
    "expiration_month": x, 
    "is_valid": true, 
    "meta": {}, 
    "last_four": "xxxx", 
    "postal_code": "xxxxx", 
    "id": "CCxxxxxxxxxxxxxxxxxxxxxx", 
    "street_address": "xxxxxxxxxxx", 
    "name": "xxxxxxxxx"
  }, 
  "transaction_number": "HLxxx-xxx-xxxx", 
  "meta": {}, 
  "is_void": false, 
  "debit": null, 
  "id": "HLxxxxxxxxxxxxxxxxxxxxxx"
}