Support

Support channels

Pick the channel that matches the urgency and tier of your integration. Every channel routes to the same engineering on-call rota; email is the system of record for anything that needs a paper trail.

Partners on the Scale and Platform tiers also receive a dedicated Slack Connect channel and a named integration engineer. To request access, email us from the address registered to your organisation on the hub.

Response targets

These are best-effort targets for a first human response during UK business hours (Mon–Fri, 09:00–18:00 GMT/BST), excluding bank holidays. A severity-1 outage that affects money movement is paged 24/7.

What to include in a ticket

The single most useful thing you can send is the request_id. Every API response — success or error — carries one, both in the JSON body and in the x-credicorp-request-id response header. It lets us pull the exact request, the decisioning trace, and any downstream PISP or identity call from our logs without guesswork.

Reading the request_id off a response is one header lookup. Both the SDK and a raw curl call surface it:

# -i prints response headers; grep the request id for your ticket
curl -i https://api.credicorp.co.uk/partner/v1/applications/app_3pQ7r2Kk9 \
  -H "Authorization: Bearer $CREDICORP_SECRET_KEY" \
  | grep -i "x-credicorp-request-id"

# x-credicorp-request-id: req_8Hn2Lp0Wd4Xc

import { Credicorp } from '@credicorp/sdk';
const credicorp = new Credicorp(process.env.CREDICORP_SECRET_KEY);

try {
  const app = await credicorp.applications.retrieve('app_3pQ7r2Kk9');
} catch (err) {
  // every error carries the request id — quote it in your ticket
  console.error('request_id:', err.requestId);
  console.error('code:', err.code, err.message);
}

A good error body has everything you need to triage and everything we need to trace. This is the standard shape returned across the API:

{
  "error": {
    "type": "invalid_request_error",
    "code": "company_not_eligible",
    "message": "Applicant must be a UK incorporated company or LLP.",
    "param": "applicant.company_number",
    "doc_url": "https://dev.credicorp.co.uk/api-reference/errors.html#company_not_eligible"
  },
  "meta": {
    "request_id": "req_8Hn2Lp0Wd4Xc",
    "environment": "live"
  }
}

A clean, copy-paste report

Drop this template into your email. Notice the Authorization header is redacted — that's exactly what we want to see.

Environment:  live  (key prefix: sk_live_)
Endpoint:     POST /partner/v1/payments
request_id:   req_8Hn2Lp0Wd4Xc
Time (UTC):   2026-06-29T13:42:07Z
Expected:     202 Accepted, payment moves to "processing"
Actual:       409 Conflict, error.code = idempotency_key_reused

curl -X POST https://api.credicorp.co.uk/partner/v1/payments \
  -H "Authorization: Bearer [REDACTED]" \
  -H "Idempotency-Key: pay-2026-06-29-inv-5512" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 250000, "currency": "GBP", "scheme": "pisp" }'

Help yourself first

Most tickets we receive are answered by a page we already publish. Before you write in, a two-minute check here will often unblock you immediately — and if it doesn't, you'll arrive with the right request_id and error code in hand.

Reporting a security issue

Suspected vulnerabilities and credential exposure are handled separately from integration support and are triaged immediately. Email [email protected] or follow the disclosure policy at security.txt. Please do not post security reports to the help centre or a shared Slack channel.