How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Fat Zebra Partner API

The Partner (v2) API for ISOs and software platforms to programmatically create and manage their own sub-merchants and acquirer connections — 30 operations across 22 paths covering partner self/identity, merchant create/board/lifecycle (activate, suspend, cancel), credential rotation, acquirer connection management, SSO enforcement, and dashboard users. OpenAPI 3.1. Auth is HTTP Basic (partner username + API token). Production, sandbox, and staging environments documented.

Fat Zebra Partner API is one of 4 APIs that Fat Zebra publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Merchant Onboarding, Partner, and Acquiring. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 30 operations across 22 paths, organized into 7 resource areas, and defines 30 schemas. It is described by OpenAPI 3.1.0, at version 1.0.0.

Requests are made against 4 base URLs: https://gateway.pmnts.io/v2/partners, https://gateway.pmnts-sandbox.io/v2/partners, https://gateway.pmnts-staging.io/v2/partners, https://gateway.test/v2/partners.

30 operations 22 paths 30 schemas 1 DELETE11 GET3 PATCH14 POST1 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.1.0
API Version
1.0.0
Base URL
https://gateway.pmnts.io/v2/partners
Authentication
HTTP Basic
Resource Areas
7

Authentication & Security 1

Fat Zebra Partner API declares 1 security scheme for authenticating requests. It accepts HTTP basic authentication (PartnerBasicAuth). By default, every request must be authenticated.

  • PartnerBasicAuth — HTTP Basic. Send your reseller username as the Basic username and your reseller API token as the Basic password. Required on every endpoint.

Paths & Operations 30

Across 22 paths, the API surfaces 30 operations — 1 DELETE, 11 GET, 3 PATCH, 14 POST, 1 PUT. They span 7 resource areas: Health, Partner, Users, SSO, Acquirers, Merchants, Acquirer connections. Each is listed below with its method, path, parameters, and response codes.

Health 1

Liveness / auth canary.

GET
/ping
Auth + partner resolution canary
ping → 200401
Partner 2

The authenticated partner (self).

GET
/me
Show the authenticated partner (self)
showSelf → 200401
POST
/me/credentials/rotate
Rotate the partner's own API token
rotateSelfCredentials → 200401
Users 7

Partner dashboard users — CRUD plus deactivate/reactivate.

GET
/users
List the partner's dashboard users
listUsers 2 params → 200401
POST
/users
Create a dashboard user
createUser body → 201401422
GET
/users/{id}
Show a user
showUser 1 param → 200401404
PATCH
/users/{id}
Update a user
updateUser 1 param body → 200401404422
DELETE
/users/{id}
Remove a user
deleteUser 1 param → 204401404
POST
/users/{id}/deactivate
Deactivate a user
deactivateUser 1 param → 200401404
POST
/users/{id}/reactivate
Reactivate a user
reactivateUser 1 param → 200401404
SSO 3

Partner SSO enforcement — read state, enforce, disable.

GET
/sso
Show SSO enforcement state
showSso → 200401
POST
/sso/enforce
Enforce SSO
enforceSso → 200401409
POST
/sso/disable
Disable SSO enforcement
disableSso → 200401
Acquirers 2

The acquirer catalogue this partner may board onto.

GET
/acquirers
List acquirers this partner may board onto
listAcquirers → 200401
GET
/acquirers/{code}
Show one acquirer's detail
showAcquirer 1 param → 200401404
Merchants 9

Partner-owned merchant CRUD and lifecycle.

GET
/merchants
List the partner's merchants
listMerchants 2 params → 200401
POST
/merchants
Create a merchant
createMerchant body → 201401404409422
GET
/merchants/{username}
Show a merchant
showMerchant 1 param → 200401404
PATCH
/merchants/{username}
Update a merchant
updateMerchant 1 param body → 200401404422
PUT
/merchants/{username}
Update a merchant (alias for PATCH)
replaceMerchant 1 param body → 200401404422
POST
/merchants/{username}/activate
Activate a merchant
activateMerchant 1 param → 200401404409
POST
/merchants/{username}/suspend
Suspend a merchant
suspendMerchant 1 param → 200401404
POST
/merchants/{username}/cancel
Cancel a merchant
cancelMerchant 1 param → 200401404
POST
/merchants/{username}/credentials/rotate
Rotate a merchant's credentials
rotateMerchantCredentials 1 param → 200401404
Acquirer connections 6

A merchant's connections to acquirers — board, list, update, enable/disable.

GET
/merchants/{username}/acquirers
List a merchant's acquirer connections
listAcquirerConnections 3 params → 200401404
POST
/merchants/{username}/acquirers
Board a merchant onto an acquirer (synchronous)
boardAcquirer 1 param body → 201401404422
GET
/merchants/{username}/acquirers/{conn_id}
Show an acquirer connection
showAcquirerConnection 2 params → 200401404
PATCH
/merchants/{username}/acquirers/{conn_id}
Update an acquirer connection
updateAcquirerConnection 2 params body → 200401404422
POST
/merchants/{username}/acquirers/{conn_id}/enable
Enable an acquirer connection
enableAcquirerConnection 2 params → 200401404
POST
/merchants/{username}/acquirers/{conn_id}/disable
Disable an acquirer connection
disableAcquirerConnection 2 params → 200401404

Schemas 30

The contract defines 30 schemas that model the data the API accepts and returns. The most detailed are MerchantCreateRequest (33 properties), Merchant (33 properties), MerchantUpdateRequest (31 properties), User (10 properties). Each schema is shown below with its type and property counts.

PingResponse
object
1 property 1 required
Error
object
1 property 1 required
ListEnvelope
object
2 properties 2 required
Address
object
6 properties
MerchantCredentialsInline
object
Credentials embedded on the merchant object. token is null on reads and only populated once by create and credential-rotate.
2 properties 2 required
MerchantSurcharging
object
1 property
Merchant
object
A merchant under this partner.
33 properties 2 required
MerchantSummary
object
The slim merchant shape returned in list responses — username only. Fetch the full Merchant via GET /merchants/{username}.
1 property 1 required
MerchantListEnvelope
MerchantCreateRequest
object
Creates a merchant. Required to CREATE: name and mcc only. mcc has NO default — the merchant's category is never guessed; omitting it is a 422 validationerror.…
33 properties 2 required
MerchantUpdateRequest
object
Any subset of the create business/identity fields. username, status and credentials are read-only — use the lifecycle and credential-rotate endpoints for those…
31 properties
AcquirerBoardRequest
object
One acquirer to board in a combined create — same fields as the body of POST /merchants/{username}/acquirers.
8 properties 2 required
MerchantOnboardingResult
object
Returned by a combined create (POST /merchants with acquirers). A slim status payload — the merchant's status, username and one-time token, plus a per-acquirer…
4 properties 3 required
MerchantCredentials
object
Returned once by POST /merchants/{username}/credentials/rotate. The full token and signingsecret are shown here and never again.
4 properties 4 required
AcquirerConnection
object
The combined state across every acquirer link provisioned for one acquirer. Boarding is synchronous, so a connection that exists is always boarded.
9 properties 2 required
AcquirerConnectionListEnvelope
AcquirerConnectionCreateRequest
object
Board onto an acquirer. Name the acquirer and send the acquirer-assigned merchantid (MID); terminalid (TID) is optional. Fat Zebra validates the MID/TID and cu…
4 properties 2 required
AcquirerConnectionUpdateRequest
object
Only priority, currencies and cardtypes are mutable. Changing currencies / cardtypes re-evaluates which underlying processors stay active. The acquirer and the…
3 properties
Acquirer
object
A catalogue entry describing one acquirer the partner may board onto.
4 properties 2 required
AcquirerListEnvelope
PartnerBranding
object
4 properties
PartnerDefaults
object
3 properties
Partner
object
The authenticated partner (self). Returned by GET /me.
6 properties 4 required
PartnerCredentials
object
Returned once by POST /me/credentials/rotate. The full token is shown here and never again.
3 properties 3 required
SsoState
object
The partner's SSO enforcement state and IdP-link counts.
4 properties 4 required
User
object
A partner dashboard user.
10 properties 5 required
UserSummary
object
The slim user shape returned in list responses — id only. Fetch the full User via GET /users/{id}.
1 property 1 required
UserListEnvelope
UserCreateRequest
object
4 properties 3 required
UserUpdateRequest
object
Any subset of the user's name, email, role or password. The password is write-only.
4 properties

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

fat-zebra-partner.json Raw ↑

Other APIs Fat Zebra publishes across the network.

Fat Zebra Gateway API
Fat Zebra Billing API
Fat Zebra FDMS TPP Merchant Onboarding API
Where this information came from

This is an independent, third-party profile of Fat Zebra Partner API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.