How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

GSMA Debit Mandates API

The **Debit Mandates** APIs allow a mobile money customer to provide prior approval for payments to be taken from their account bya requesting payee. If the amount limit field is not supplied, the payee will be able to take any amount. Mandates can be open-endedor can be constrained by a quantified number of payments for a given frequency.Mandates can be created, viewed and modified. The request to create a debit mandate will be typically initiated by theservice provider (payee) but can also be requested by the customer (payer).

GSMA Debit Mandates API is one of 31 APIs that GSMA publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Debit Mandates. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an API reference, and a changelog.

This API exposes 6 operations across 4 paths, and defines 27 schemas. It is described by OpenAPI 3.2.0, at version 1.2.0.

Requests are made against a single base URL, https://sandbox.mobilemoneyapi.io/simulator/v1.2/passthrough/mm.

6 operations 4 paths 27 schemas 2 GET2 PATCH2 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.2.0
Base URL
https://sandbox.mobilemoneyapi.io/simulator/v1.2/passthrough/mm
Resource Areas
1

Paths & Operations 6

Across 4 paths, the API surfaces 6 operations — 2 GET, 2 PATCH, 2 POST. Each is listed below with its method, path, parameters, and response codes.

Debit Mandates 6

The Debit Mandates APIs allow a mobile money customer to provide prior approval for payments to be taken from their account by a requesting payee. If the amount limit field is not…

POST
/accounts/{accountId}/debitmandates
Create A Debit Mandate
accountsAccountIdDebitmandatesPOST 13 params body → 201202400401404500503
POST
/accounts/{identifierType}/{identifier}/debitmandates
Create A Debit Mandate
accountsIdentifierTypeIdentifierDebitmandatesPOST 14 params body → 201202400401404500503
GET
/accounts/{accountId}/debitmandates/{debitMandateReference}
View A Debit Mandate
accountsAccountIdDebitmandatesDebitMandateReferenceGET 12 params → 200400401404500503
PATCH
/accounts/{accountId}/debitmandates/{debitMandateReference}
Update A Debit Mandate
accountsAccountIdDebitmandatesDebitMandateReferencePATCH 14 params body → 202204400401404500503
GET
/accounts/{identifierType}/{identifier}/debitmandates/{debitMandateReference}
View A Debit Mandate
accountsIdentifierTypeIdentifierDebitmandatesDebitMandateReferenceGET 13 params → 200400401404500503
PATCH
/accounts/{identifierType}/{identifier}/debitmandates/{debitMandateReference}
Update A Debit Mandate
accountsIdentifierTypeIdentifierDebitmandatesDebitMandateReferencePATCH 15 params body → 202204400401404500503

Schemas 27

The contract defines 27 schemas that model the data the API accepts and returns. The most detailed are responseDebitMandate (16 properties), requestDebitMandate (11 properties), requestStateObject (8 properties), errorObject (5 properties). Each schema is shown below with its type and property counts.

responseDebitMandate
object
16 properties 1 required
metadata
object
2 properties 2 required
requestGenericPatch
object
3 properties 3 required
payee
array
A collection of key/value pairs that enable the payee to be identified. Keys include MSISDN and Wallet Identifier.
genericUpdateSuccess
object
1 property 1 required
metadataArray
array
A collection of key/value pairs. These can be used to populate additional properties that describe administrative information regarding the resource.
requestingOrganisation
object
An object that details the originating organisation of the request.
2 properties 2 required
dateCreated
string
Date and time when the object was created by the API Provider.
requestGenericPatchArray
array
Collection of updates that are to be processed.
requestDebitMandate
object
11 properties 1 required
endDate
string
Date on which the mandate ends.
modificationDate
string
Date and time when the object was modified by the API Provider.
currency
string
customDataArray
array
A collection of key/value pairs. These can be used to populate provider specific fields.
dateModified
string
Date and time when the object was modified by the API Provider.
mandateStatus
string
requestStateObject
object
8 properties 3 required
frequencyType
string
numberOfPayments
number
Indicates the number of consecutive payments that are to be taken.
creationDate
string
Date and time when the object was created by the API Provider.
mandateReference
string
Unique reference provided by the API Provider for the mandate.
startDate
string
Date on which the mandate starts. If a frequencyType is specified, this will also be the date on which the first payment is to be taken.
requestDate
string
The date and time of the request as supplied by the client.
party
object
2 properties 2 required
errorObject
object
5 properties 2 required
amount
string
customData
object
2 properties 2 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

gsma-debit-mandates-api-openapi.yml Raw ↑

Other APIs GSMA publishes across the network.

GSMA Accounts API
GSMA Authorisation Codes API
GSMA Bills API
GSMA Call Forwarding information retrieval API
GSMA Check Device Swap API
GSMA Check SIM Swap API
GSMA Device reachability status API
GSMA Discovery API
GSMA Get Device Identifiers API
GSMA Home Devices QoD API
GSMA Links API
GSMA Location Retrieval API
Where this information came from

This is an independent, third-party profile of GSMA Debit Mandates API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.