Spend requests and single-use cards: what this connector can do

Member·4 minutes to read

What this page is for

docs/connectors/payments.md is the setup guide for whoever runs your organisation's Botseon deployment — turning spend requests on and choosing a card issuer. This page is the other half: what Spend requests and single-use cards actually lets a bot do once your organisation has turned it on, what it asks you for along the way, its limits, and how to take it away again.

Ask a member to approve one purchase, then pay for it with a single-use card locked to that merchant.

What a bot can do with it

Read — Spend requests and single-use cards tells a bot things, nothing changes

Tool	What it does
`payments.card_status`	Look up what became of a card this bot was issued: its state, its remaining headroom and when it expires.

Write — Spend requests and single-use cards lets a bot change things

Tool	What it does
`payments.request_spend`	Ask the member to approve one purchase at one merchant, for one amount.

The permissions it asks for, in plain words

Every call a bot makes through this connector is tagged with what kind of thing it is. Only the tags below ever apply here — a tag this connector's tools never carry is not listed, because it can never ask you for it.

read — Looks something up. Nothing changes, and nothing is sent anywhere. A bot never has to ask first for this.
external_send — Sends something to someone outside Botseon — a message, a reply, an email, a post. Asks you first, unless always-allowed.
spend — Spends your money in the real world. Always asks first — there is no always-allow rule that ever covers this.

Limits

Ask a member to approve one purchase, then pay for it with a single-use card locked to that merchant. Nothing outside that list is possible through this connector, however a bot is asked to use it.

Spend requests and single-use cards has no scopes to narrow or widen — it is Botseon's own plugin, switched on or off for your organisation by whoever runs your deployment, on docs/connectors/payments.md.

Disconnecting

In Botseon

Open Plugins from the sidebar, press this connector's card to open its detail page, and under Accounts press the ✕ next to the account (its label is "Remove account" and the name of the account), then Revoke and remove to confirm — or Uninstall to remove the plugin and every account connected to it at once. Either one revokes the stored connection immediately: nothing more is read or changed through it from that moment on. Install a plugin walks through the same screen step by step.

What Botseon keeps, and how your data is used

Whatever a bot reads or writes through this connector becomes part of your conversations and the record of that run — the same records, and the same retention schedule, as everything else a bot works on. Botseon is the processor for that content; your organisation decides what it may read and remember, and can delete it sooner than the schedule would on its own.

Your data is sent to a model provider only to produce the bot's answer, and for nothing else — it is not used to train any model. The Privacy Policy's Models and How long we keep it sections have the full detail, including exactly how long each kind of record is kept for.