Glossary

A

API key: the secret string your code sends with every request to prove which merchant the call belongs to. Format: epd_<env>_sk_<random>.

API version: a date like 2026-02-11 that tells EPD which version of the API to behave like. Sent in the epd-version header. Lets your code keep working even after EPD ships changes.

B

Bearer token: the way you send an API key. The HTTP header Authorization: Bearer <key>.

C

Capture: actually moving the money from the cardholder. EPD captures immediately on a successful order; some integrations split into authorize-then-capture.

card_token: a single-use token (cct_…) representing a card captured in the browser with EPD Elements. Your frontend gets it from the SDK; your backend attaches it to a customer with your secret key. Expires 15 minutes after capture and can be used once.

Cardholder: the human whose card is being charged.

Chargeback: when a cardholder disputes a charge with their bank and the bank pulls the money back. You can fight chargebacks with evidence.

Composite tool: an MCP tool that performs more than one underlying API call in a single step (e.g. create_customer_and_charge).

Cursor pagination: list endpoints return at most one page; you ask for the next page using a cursor returned in cursors.next.

D

Dunning: the process of recovering from a failed renewal: retry, email the customer, give them a chance to update their card.

E

EPD Elements: the browser SDK (epd.js) that drops a secure, PCI-compliant card field into your own checkout, captures the card client-side, and returns a single-use card_token. Raw card data never touches your servers. See the EPD Elements guide.

epd-version: the header you send to pin your code to a particular API version date.

EPD-Signature: the header on inbound webhooks that proves the event came from EPD.

Environment: sandbox or live. Decided per API key.

I

Idempotency key: a unique string you send with a write request so EPD can recognize duplicate retries and not run the action twice. Header: X-EPD-Idempotency-Key.

Inbound Card Capture: a server-to-server way to save a card without a browser. Your backend POSTs the raw card to https://secure.epd.com, EPD tokenizes it in a PCI-certified environment, and returns a payment method. For phone/MOTO orders, back-office tools, and migrations. See the Inbound Card Capture guide.

Issuer / issuing bank: the bank that gave the cardholder their card. Approves or declines the charge.

L

Live mode: real cards, real money. Triggered by sending an epd_live_sk_... key.

M

Merchant: you. The business taking the payment.

Merchant Portal: the EPD web dashboard at commerce.epd.com where you manage your account.

MCP: Model Context Protocol. The protocol used to expose EPD as a set of tools an AI agent can call. See the MCP overview.

MOTO: mail-order/telephone-order: a sale where an agent keys the card in by hand because the cardholder isn’t present, e.g. over the phone. EPD supports this with Inbound Card Capture, the server-to-server flow built for it.

O

Order: a single sale: who paid, how much, with what payment method, in what currency. Orders can be refunded.

P

PAN: the primary account number: the digits printed on a card, i.e. the raw card number itself. EPD’s API never accepts a PAN directly; it only ever sees a token, whether the card was captured with EPD Elements (the PAN never reaches your servers) or Inbound Card Capture (the PAN reaches your servers, but is tokenized before EPD’s API sees it).

PCI / PCI DSS: the Payment Card Industry Data Security Standard: the security rules that apply to anyone who handles card data. Keep card data off your servers with EPD Elements and your compliance burden shrinks to the lightest self-assessment tier; see SAQ.

Payment method: a stored, reusable card on a customer record. Captured with EPD Elements or Inbound Card Capture. Identified by its UUID id.

Plan: pricing + cadence for a product. e.g. “Pro Monthly $29.99/month”. A product can have many plans.

Product: a thing you sell, conceptually. Has a name and description; price lives on a plan.

Publishable key: a browser-safe, capture-only key (epd_live_pk_… / epd_test_pk_…). It can tokenize a card via EPD Elements and nothing else; it cannot vault, charge, read, or list. Safe to ship in client-side code, unlike a secret key.

R

request_id: id returned on every error and (often) success response. Format: req_ followed by 32 hex characters. Quote it in support tickets.

Resource id: the id of any EPD resource (customer, payment method, product, plan, order, subscription, transaction, webhook endpoint, webhook event record) is a UUID, e.g. 550e8400-e29b-41d4-a716-446655440000. Most ids also accept an optional type prefix on input (cus_, prod_, and so on); payment_method_id is the exception and must be sent as a bare UUID.

Restricted key: an API key with limits on which resources it can read or write. Use these for narrow-purpose services.

Refund: reversing a paid order, fully or partially. Endpoint: POST /v1/orders/:id/refund.

S

Sandbox mode: the test environment. Same code, same endpoints, no real money. Triggered by epd_test_sk_... keys.

SAQ (A vs D): the Self-Assessment Questionnaire a merchant certifies against to prove PCI DSS compliance. SAQ A is the shortest form (a self-check, not an audit) for merchants who never touch raw card data, which is what you get by capturing cards with EPD Elements. SAQ D is the long form, required when your own systems handle the raw PAN, as with Inbound Card Capture.

Settlement: the bank-to-bank money movement that follows a successful capture. Typically completes 1–3 business days later.

Signing secret: the per-endpoint secret used to verify webhook signatures. Starts with whsec_.

Subscription: a recurring contract: this customer, this plan, this payment method. Generates renewal orders automatically. Identified by its UUID id.

T

Tool annotation: flag on an MCP tool indicating whether it is read-only, destructive, idempotent, or affects external systems.

Transaction: a single payment attempt against a card. An order can have one or many transactions if there were retries.

Trial: a free period at the start of a subscription. Not currently supported on the EPD API; implement trial logic in your application or use a $0 plan in the portal.

V

Vault: EPD’s PCI-scoped secure storage for card data. Raw card numbers live only in the vault; EPD Commerce stores just a tokenized reference (the payment method id).

W

Webhook: an HTTP POST that EPD sends to your server when something happens.

Webhook endpoint: a URL of yours that EPD knows about and will deliver events to.

whsec_: the prefix of a webhook signing secret.