How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Fat Zebra Merchants API

The Merchants API from Fat Zebra — 7 operation(s) for merchants.

Fat Zebra Merchants API is one of 31 APIs that Fat Zebra publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Merchants. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 10 operations across 7 paths, and defines 13 schemas. It is described by OpenAPI 3.2.0, at version 1.0.

Requests are made against 5 base URLs: https://acquiring-sandbox.fatzebra.com.au/api/v1, https://gateway.pmnts.io/v2/partners, https://gateway.pmnts-sandbox.io/v2/partners, https://gateway.pmnts-staging.io/v2/partners, https://gateway.test/v2/partners.

10 operations 7 paths 13 schemas 2 GET1 PATCH6 POST1 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.0
Base URL
https://gateway.pmnts.io/v1.0
Authentication
HTTP Basic, HTTP Basic
Resource Areas
1

Authentication & Security 2

Fat Zebra Merchants API declares 2 security schemes for authenticating requests. It accepts HTTP basic authentication (sec0). It accepts HTTP basic authentication (PartnerBasicAuth).

  • PartnerBasicAuth — HTTP Basic. Send your reseller username as the Basic username and your reseller API token as the Basic password. Required on every endpoint.

Paths & Operations 10

Across 7 paths, the API surfaces 10 operations — 2 GET, 1 PATCH, 6 POST, 1 PUT. Each is listed below with its method, path, parameters, and response codes.

Merchants 10
POST
/merchants
FDMS TPP Merchant Onboarding
onboard-a-merchant body → 200400
GET
/merchants
List merchants
list-merchants 1 param → 200400
POST
/merchants/onboard
Onboard merchants (internal)
update-merchants body → 200400
GET
/merchants/{username}
Show a merchant
showMerchant 1 param → 200401404
PATCH
/merchants/{username}
Update a merchant
updateMerchant 1 param body → 200401404422
PUT
/merchants/{username}
Update a merchant (alias for PATCH)
replaceMerchant 1 param body → 200401404422
POST
/merchants/{username}/activate
Activate a merchant
activateMerchant 1 param → 200401404409
POST
/merchants/{username}/suspend
Suspend a merchant
suspendMerchant 1 param → 200401404
POST
/merchants/{username}/cancel
Cancel a merchant
cancelMerchant 1 param → 200401404
POST
/merchants/{username}/credentials/rotate
Rotate a merchant's credentials
rotateMerchantCredentials 1 param → 200401404

Schemas 13

The contract defines 13 schemas that model the data the API accepts and returns. The most detailed are MerchantCreateRequest (33 properties), Merchant (33 properties), MerchantUpdateRequest (31 properties), AcquirerBoardRequest (8 properties). Each schema is shown below with its type and property counts.

MerchantSummary
object
The slim merchant shape returned in list responses — username only. Fetch the full Merchant via GET /merchants/{username}.
1 property 1 required
MerchantOnboardingResult
object
Returned by a combined create (POST /merchants with acquirers). A slim status payload — the merchant's status, username and one-time token, plus a per-acquirer…
4 properties 3 required
MerchantCredentials
object
Returned once by POST /merchants/{username}/credentials/rotate. The full token and signingsecret are shown here and never again.
4 properties 4 required
MerchantCredentialsInline
object
Credentials embedded on the merchant object. token is null on reads and only populated once by create and credential-rotate.
2 properties 2 required
Merchant
object
A merchant under this partner.
33 properties 2 required
AcquirerBoardRequest
object
One acquirer to board in a combined create — same fields as the body of POST /merchants/{username}/acquirers.
8 properties 2 required
MerchantListEnvelope
Address
object
6 properties
Error
object
1 property 1 required
MerchantCreateRequest
object
Creates a merchant. Required to CREATE: name and mcc only. mcc has NO default — the merchant's category is never guessed; omitting it is a 422 validationerror.…
33 properties 2 required
MerchantUpdateRequest
object
Any subset of the create business/identity fields. username, status and credentials are read-only — use the lifecycle and credential-rotate endpoints for those…
31 properties
ListEnvelope
object
2 properties 2 required
MerchantSurcharging
object
1 property

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

fat-zebra-merchants-api-openapi.yml Raw ↑

Other APIs Fat Zebra publishes across the network.

Fat Zebra Acquirer connections API
Fat Zebra Acquirers API
Fat Zebra Applicable Surcharge API
Fat Zebra Authenticate API
Fat Zebra Bank Accounts API
Fat Zebra Batches API
Fat Zebra Chargebacks API
Fat Zebra Credit Cards API
Fat Zebra Customers API
Fat Zebra Direct Credits API
Fat Zebra Direct Debits API
Fat Zebra Disputes API
Where this information came from

This is an independent, third-party profile of Fat Zebra Merchants API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.