This will be protected via a client token. The estateId and merchantId will be in the request message.