Partner onboarding and clients

These console endpoints require a signed-in user and are scoped to partner organization membership.

• GET, POST /console/organizations/: list partner organizations or create one.
• GET /console/programs/: inspect active programs, versions and terms.
• POST /console/programs/{program_key}/enroll/: accept program terms for an organization.
• GET, POST /console/clients/: list client relationships or create a restricted client draft.
• POST /console/drafts/{id}/invite/: invite a merchant to claim a draft.
• GET /console/claims/{token}/ and POST /console/claims/{token}/accept/: merchant claim flow. The signed-in email must match the invitation.
• GET /console/grants/ and POST /console/grants/{id}/revoke/: delegated access.
• GET /console/merchant/partners/: merchant-side partner relationships and consent.

For server-side automation of the full console workflow, a user API key (tumr_live_...) acts as its owner/admin user and remains subject to organization roles and merchant consent. A tumr_pk_... partner key is narrower and only works on explicitly scoped distribution routes and the read-only commission balance route.

Partner membership does not transfer merchant ownership. A draft remains restricted until the invited merchant claims it. Reseller sponsorship requires merchant approval before a license can activate.