Release identity
SHA-256 of the pack file bytes: 21b6a8114728f25d4d0062c712d9149b7085097089506c5f8c2e863d5200287b
Distributable: digest matches the release manifest. The binary carries a digest-bound manifest of the distributable library; a pack whose bytes differ from its manifest entry — endpoint, tier, allowlist, or credential edited, with provider, version, and review block preserved — fails the digest check, loses distributability, and renders MODIFIED rather than as the shipped reviewed artifact. Review state and artifact status are different facts: the first is a documentation-review declaration, the second is the identity of the exact bytes.
Capabilities (5)
brex.transactions.read v1.0.0R0
- Action
- read
- Endpoint
GET https://api.brex.com/v2/transactions/card/primary- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-brex-api-token- Data class
- financial
Read the account's primary card transactions.
brex.users.read v1.0.0R0
- Action
- read
- Endpoint
GET https://api.brex.com/v2/users- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-brex-api-token- Data class
- pii
Read the account's users: names, emails and roles, which are personal data.
brex.payments.create v1.0.0R3
- Action
- pay
- Endpoint
POST https://api.brex.com/v1/transfers- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-brex-api-token- Data class
- financial
Create a transfer, which is Brex's payment endpoint: money moves, so the action is pay at the R3 floor; pay is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer). The registered cost ceiling is a budget control on the declared amount: the gateway refuses a declared amount above it and commits the ceiling against the work budget; it does not bound the amount the provider request encodes.
brex.cards.create v1.0.0R2
- Action
- create
- Endpoint
POST https://api.brex.com/v2/cards- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-brex-api-token- Data class
- financial
Issue a card. Issuance creates spending power rather than moving money, and a card can be terminated, so the action is create at R2, the verb's floor — a lower bound, not a proof that issuance is reversible. Review the spend limits the integration may request: the limit is set at the provider, not in this pack.
brex.cards.terminate v1.0.0R3
- Action
- delete
- Endpoint
POST https://api.brex.com/v2/cards/CARD_ID/terminate- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-brex-api-token- Data class
- financial
Terminate a card. A terminated card is not un-terminated — a replacement is a new card — so the action is delete at the R3 floor; delete is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer). CARD_ID is a placeholder to replace before enabling.
Credential reference
The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.
- Reference
secret-ref-brex-api-token- Custody
- customer_vault
- Injection
- header (Authorization)
A Brex API token held in the client's own secret manager. The stored material must be the complete Authorization header value (scheme included). The token's scopes are chosen at Brex, and the minimum that makes these capabilities work is the right set: a token that may create payments should not also carry account-administration scopes this pack never names.
Resources
brex-account(api, financial):https://api.brex.com
Pack notes and exclusions
Use a Brex API token with only the scopes these capabilities need; the pack does not create one. Creating a payment moves money, so it carries the pay action at the R3 floor, and pay is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer); the registered cost ceiling and a policy budget are the second control. Card issuance is create at R2, the verb's floor — a card can be terminated, but the tier is a lower bound, not a risk assessment; terminating a card is registered as delete at R3 because a terminated card is not un-terminated — a replacement is a new card. The current API host is api.brex.com: Brex's older hostnames still answer, but the pack registers the documented host. Brex's payment rail is the transfers API (POST /v1/transfers, which carries its own transfers scope), and card transactions are read from /v2/transactions/card/primary. The Brex API's payments coverage depends on the account's enabled products and markets, and CARD_ID is a placeholder to replace before enabling. AAES has not been certified by Brex; the endpoints here are a reviewable default, not a vendor guarantee.
Review record
Review completed: 2026-09-20 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)
- https://developer.brex.com/openapi/transactions_api (retrieved 2026-09-20)
- https://developer.brex.com/guides/quickstart (retrieved 2026-09-20)
- https://developer.brex.com/examples/payments_examples (retrieved 2026-09-20)
- https://developer.brex.com/changelog (retrieved 2026-09-20)
A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.