Fat Zebra Partner API

{"openapi":"3.1.0","info":{"title":"Fat Zebra Partner API","version":"1.0.0","summary":"Partner-facing API for boarding and managing sub-merchants and their acquirer connections.","description":"The Partner API lets you (a Fat Zebra partner) create and manage your own\nmerchants, board them onto acquirers, and manage the resulting acquirer\nconnections. You pick an acquirer (your bank relationship); Fat Zebra\ndecides which processors carry it.\n\n## Base URL\n\n```\nhttps://gateway.pmnts.io/v2/partners\n```\n\nAll paths below are relative to that base. Sandbox and staging hosts are in\nthe server list; pick the one for your environment.\n\n## Auth\n\nHTTP Basic. Send your reseller **username** as the Basic username and your\nreseller API **token** as the Basic password\n(`Authorization: Basic <base64(username:token)>`). Every endpoint requires\nit.\n\n## Boarding is synchronous\n\nBoarding a merchant onto an acquirer is synchronous: an acquirer connection\nexists only once it is boarded, so it is always live. A board that can't\ncomplete is reported inline as the POST's `422` error response.\n\n## Envelopes\n\n* **Single resource** — returned as the resource itself, no wrapper.\n* **List** — `{ \"items\": [...], \"next_cursor\": <string|null> }`. A `null`\n  `next_cursor` means the last page; otherwise pass its value as\n  `starting_after` to fetch the next page. List query params are `limit`\n  (default 25, max 100) and `starting_after=<id>`.\n* **Error** — `{ \"error\": { \"type\", \"message\", \"fields\", \"request_id\" } }`.\n  `type` is the coarse class; the specific reason lives in `fields`, keyed by\n  a processor-agnostic field name (e.g. `mid`, `tid`, `currencies`) so you\n  never read a switch's native field paths. `type` values and statuses:\n  `authentication_error` (401), `not_found` (404), `conflict` (409),\n  `validation_error` (422 — something the caller can fix, including a\n  processor rejecting a field like the MID/TID), `processor_error` (422 —\n  an unactionable upstream failure: a processor was unreachable, busy, or\n  rejected us for a reason the caller can't fix; retry or escalate,\n  `fields` is empty).\n\nTimestamps are ISO 8601 UTC. Merchants and partners are addressed by their\n`username`. An acquirer connection's `id` is a derived merchant+acquirer\nvirtual id of the form `<merchant-id>-ACQ-<ACQUIRER-CODE>` (e.g.\n`042-ACQ-NAB`) — not a stored id. Wallets and users carry a stable generated\nid of the form `<owner-id>-<TYPE>-<random>` (e.g. `042-WAL-9f3k2m8q`).\nAcquirers are slug codes (e.g. `nab`, `cba`, `anz`).\n"},"servers":[{"url":"https://gateway.pmnts.io/v2/partners","description":"Production"},{"url":"https://gateway.pmnts-sandbox.io/v2/partners","description":"Sandbox"},{"url":"https://gateway.pmnts-staging.io/v2/partners","description":"Staging"},{"url":"https://gateway.test/v2/partners","description":"Local development"}],"tags":[{"name":"Health","description":"Liveness / auth canary."},{"name":"Partner","description":"The authenticated partner (self)."},{"name":"Merchants","description":"Partner-owned merchant CRUD and lifecycle."},{"name":"Acquirer connections","description":"A merchant's connections to acquirers — board, list, update, enable/disable."},{"name":"Acquirers","description":"The acquirer catalogue this partner may board onto."},{"name":"SSO","description":"Partner SSO enforcement — read state, enforce, disable."},{"name":"Users","description":"Partner dashboard users — CRUD plus deactivate/reactivate."}],"security":[{"PartnerBasicAuth":[]}],"paths":{"/ping":{"get":{"tags":["Health"],"summary":"Auth + partner resolution canary","description":"Smoke-tests auth and partner resolution. Returns `{ \"ok\": true }` on\nsuccess.\n","operationId":"ping","responses":{"200":{"description":"Auth ok; partner resolved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PingResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/me":{"get":{"tags":["Partner"],"summary":"Show the authenticated partner (self)","description":"Returns the partner object: id, name, status, environment, branding,\nand defaults.\n","operationId":"showSelf","responses":{"200":{"description":"The authenticated partner.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Partner"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/me/credentials/rotate":{"post":{"tags":["Partner"],"summary":"Rotate the partner's own API token","description":"Rotates the partner's API `token`. No body is expected. The fresh value\nis returned once — the previous token stops working immediately, so the\ncaller must store the response.\n","operationId":"rotateSelfCredentials","responses":{"200":{"description":"The rotated credentials (returned once).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PartnerCredentials"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/users":{"get":{"tags":["Users"],"summary":"List the partner's dashboard users","description":"Returns the partner's dashboard user ids newest-first in the list\nenvelope. Fetch the full user via `GET /users/{id}`.\n","operationId":"listUsers","parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/StartingAfter"}],"responses":{"200":{"description":"Users list envelope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserListEnvelope"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}},"post":{"tags":["Users"],"summary":"Create a dashboard user","description":"Creates a dashboard user under the partner. The `password` is\nwrite-only — it is accepted here but never returned on reads.\n","operationId":"createUser","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserCreateRequest"}}}},"responses":{"201":{"description":"The created user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/ValidationError"}}}},"/users/{id}":{"parameters":[{"$ref":"#/components/parameters/UserId"}],"get":{"tags":["Users"],"summary":"Show a user","operationId":"showUser","responses":{"200":{"description":"The user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"tags":["Users"],"summary":"Update a user","description":"Updates the user's `name`, `email`, `role` or `password`. The\n`password` is write-only — it is accepted here but never returned.\n","operationId":"updateUser","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserUpdateRequest"}}}},"responses":{"200":{"description":"The updated user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/ValidationError"}}},"delete":{"tags":["Users"],"summary":"Remove a user","description":"Deletes the user. Returns `204` with no content.\n","operationId":"deleteUser","responses":{"204":{"description":"The user was removed."},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/users/{id}/deactivate":{"parameters":[{"$ref":"#/components/parameters/UserId"}],"post":{"tags":["Users"],"summary":"Deactivate a user","description":"Locks the account so the user can't sign in. No body is expected.\n","operationId":"deactivateUser","responses":{"200":{"description":"The deactivated user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/users/{id}/reactivate":{"parameters":[{"$ref":"#/components/parameters/UserId"}],"post":{"tags":["Users"],"summary":"Reactivate a user","description":"Unlocks the account so the user can sign in again. No body is expected.\n","operationId":"reactivateUser","responses":{"200":{"description":"The reactivated user.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/sso":{"get":{"tags":["SSO"],"summary":"Show SSO enforcement state","description":"Returns whether SSO is enforced for the partner, plus how many users\nare linked to the IdP versus not.\n","operationId":"showSso","responses":{"200":{"description":"The SSO enforcement state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoState"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/sso/enforce":{"post":{"tags":["SSO"],"summary":"Enforce SSO","description":"Turns on SSO enforcement for the partner. No body is expected. Returns\n`409 conflict` when active users aren't yet linked to the IdP — they'd\nbe locked out, so link them first.\n","operationId":"enforceSso","responses":{"200":{"description":"The SSO enforcement state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoState"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"409":{"$ref":"#/components/responses/Conflict"}}}},"/sso/disable":{"post":{"tags":["SSO"],"summary":"Disable SSO enforcement","description":"Turns off SSO enforcement for the partner. No body is expected.\n","operationId":"disableSso","responses":{"200":{"description":"The SSO enforcement state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoState"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/acquirers":{"get":{"tags":["Acquirers"],"summary":"List acquirers this partner may board onto","description":"Scoped to the partner's allowed set (derived from the processors behind\neach acquirer). Returns the list shape; `next_cursor` is always `null`\n(the catalogue is small and unpaginated).\n","operationId":"listAcquirers","responses":{"200":{"description":"Acquirer catalogue list.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerListEnvelope"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/acquirers/{code}":{"parameters":[{"$ref":"#/components/parameters/AcquirerCode"}],"get":{"tags":["Acquirers"],"summary":"Show one acquirer's detail","description":"Returns the acquirer's `supported_currencies` and `supported_schemes`.\n\nAn unknown or non-boardable acquirer code returns `404`.\n","operationId":"showAcquirer","responses":{"200":{"description":"Acquirer detail.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Acquirer"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/merchants":{"get":{"tags":["Merchants"],"summary":"List the partner's merchants","description":"Returns the partner's merchants newest-first in the list envelope. Each\nitem is a summary (username only) — fetch the full merchant via\n`GET /merchants/{username}`.\n","operationId":"listMerchants","parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/StartingAfter"}],"responses":{"200":{"description":"Merchants list envelope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MerchantListEnvelope"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}},"post":{"tags":["Merchants"],"summary":"Create a merchant","description":"Creates a merchant. By default (no `acquirers` in the body) the merchant\nis identity-only: `status` is `pending`, no processing connection is\nattached, and a fresh API token is generated. The merchant can't take\npayments until a processing connection is boarded and the merchant is\nactivated. Pass an `acquirers` array to create and board in one call\n(see **Combined create-and-board** below).\n\nThe response is `201` with the merchant object and a one-time\n`credentials.token`. The token is shown once here and never again on\nreads — store it.\n\n`username` may be omitted; one is derived from the trading/business\nname. Either way the stored username is prefixed with the partner's\nreseller prefix.\n\nA create is rejected with `409 conflict` (`\"merchant exists\"`) when this\npartner already has a merchant with the same ABN, business name and\ntrading name — a repeated submit of the same business. A shared ABN\nalone is allowed: it creates a new merchant.\n\n**Combined create-and-board.** When the body carries an `acquirers`\narray, the merchant is created, every named acquirer is boarded, and\nthe merchant is activated — all in one call. If any acquirer can't be\nboarded the whole request fails and nothing is created: no merchant,\nno connections. The failure is reported the same way as the standalone\nboard endpoint:\n\n* `422 validation_error` — something the caller can fix: an unsupported\n  currency or card type, a duplicate/missing `merchant_id`, no processor\n  supports the acquirer for the requested currencies, or a processor\n  rejecting a field (e.g. the MID). `fields` names the offending field.\n* `422 processor_error` — an unactionable upstream failure: a processor\n  was unreachable, busy, or rejected the board for a reason the caller\n  can't fix. `fields` is empty; retry or escalate.\n* `404 not_found` — an acquirer is unknown or not available to this\n  partner.\n\n**Idempotency and retries.** Boarding is synchronous and recovery is\nalways the partner re-issuing a call. Safe-retry behaviour is built\ninto the operations themselves:\n\n* **Identity create** dedupes on the triple `(ABN, business name,\n  trading name)` — re-posting the same business returns `409 conflict`\n  (`\"merchant exists\"`) instead of producing a duplicate. A shared\n  ABN alone is allowed and creates a new merchant.\n* **Combined create-and-board** either creates the merchant and every\n  requested connection, or creates nothing. On failure the partner\n  re-issues the same request — there is no partial state to clean up.\n* **Standalone board** (`POST /merchants/{username}/acquirers`) is\n  idempotent per acquirer: re-posting the same `acquirer` against a\n  merchant that already has it returns the existing connection\n  instead of creating a duplicate. A `processor_error` retry is safe\n  for the same reason.\n\n**What to do on each failure**:\n\n* `422 validation_error` → read `fields`, correct the named input\n  (currency, MID, card type, etc.), POST again. Idempotency makes a\n  corrected retry safe.\n* `422 processor_error` → the request itself is fine; the upstream\n  processor isn't. Back off and re-post the identical request, or\n  escalate if it persists. Don't mutate the payload.\n* `409 conflict` on create → the merchant already exists for this\n  partner; fetch it with `GET /merchants/{username}` instead of\n  re-creating.\n","operationId":"createMerchant","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MerchantCreateRequest"}}}},"responses":{"201":{"description":"Created merchant, with a one-time token. An identity-only create\n(no `acquirers`) returns a bare `Merchant`. A combined create (with\n`acquirers`) returns a `MerchantOnboardingResult` — a slim payload of\nthe merchant's status, username and token plus a per-acquirer\nboarding status list. A `201` means the merchant and every requested\nacquirer boarded; a boarding failure rolls the whole create back and\nreturns the relevant error below.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Merchant"},{"$ref":"#/components/schemas/MerchantOnboardingResult"}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"},"422":{"$ref":"#/components/responses/ValidationError"}}}},"/merchants/{username}":{"parameters":[{"$ref":"#/components/parameters/Username"}],"get":{"tags":["Merchants"],"summary":"Show a merchant","operationId":"showMerchant","responses":{"200":{"description":"The merchant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Merchant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"tags":["Merchants"],"summary":"Update a merchant","description":"Updates the merchant's identity/business details. `username`, `status`\nand `credentials` are read-only here — use the lifecycle endpoints\n(`/activate`, `/suspend`, `/cancel`) to change `status`, and\n`/credentials/rotate` to rotate credentials.\n","operationId":"updateMerchant","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MerchantUpdateRequest"}}}},"responses":{"200":{"description":"The updated merchant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Merchant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/ValidationError"}}},"put":{"tags":["Merchants"],"summary":"Update a merchant (alias for PATCH)","description":"Routes to the same update action as `PATCH /merchants/{username}`; same\nbehaviour and contract.\n","operationId":"replaceMerchant","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MerchantUpdateRequest"}}}},"responses":{"200":{"description":"The updated merchant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Merchant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/ValidationError"}}}},"/merchants/{username}/activate":{"parameters":[{"$ref":"#/components/parameters/Username"}],"post":{"tags":["Merchants"],"summary":"Activate a merchant","description":"Transitions the merchant to `active` so it can transact. No body is\nexpected. Activating a merchant that has no active acquirer connection\nis rejected with `409 conflict` (\"merchant has no active processing\nconnection\") — board an acquirer first.\n","operationId":"activateMerchant","responses":{"200":{"description":"The activated merchant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Merchant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"}}}},"/merchants/{username}/suspend":{"parameters":[{"$ref":"#/components/parameters/Username"}],"post":{"tags":["Merchants"],"summary":"Suspend a merchant","description":"Transitions the merchant to `suspended`. No body is expected.\n","operationId":"suspendMerchant","responses":{"200":{"description":"The suspended merchant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Merchant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/merchants/{username}/cancel":{"parameters":[{"$ref":"#/components/parameters/Username"}],"post":{"tags":["Merchants"],"summary":"Cancel a merchant","description":"Transitions the merchant to `closed`. No body is expected.\n","operationId":"cancelMerchant","responses":{"200":{"description":"The closed merchant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Merchant"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/merchants/{username}/credentials/rotate":{"parameters":[{"$ref":"#/components/parameters/Username"}],"post":{"tags":["Merchants"],"summary":"Rotate a merchant's credentials","description":"Rotates the merchant's API `token` and its `signing_secret`. No body is\nexpected. The fresh values are returned once — the previous token stops\nworking immediately, so the caller must store the response.\n\nThe response is a bare credentials object: `username`, `token`,\n`signing_secret`, `rotated_at`.\n","operationId":"rotateMerchantCredentials","responses":{"200":{"description":"The rotated credentials (returned once).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MerchantCredentials"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/merchants/{username}/acquirers":{"parameters":[{"$ref":"#/components/parameters/Username"}],"get":{"tags":["Acquirer connections"],"summary":"List a merchant's acquirer connections","description":"Returns the merchant's acquirer connections newest-first in the list\nenvelope.\n","operationId":"listAcquirerConnections","parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/StartingAfter"}],"responses":{"200":{"description":"Acquirer connections list envelope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnectionListEnvelope"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"tags":["Acquirer connections"],"summary":"Board a merchant onto an acquirer (synchronous)","description":"Boards the merchant onto an acquirer synchronously and returns the\nresulting connection with `201`. There is no pending state.\n\nYou name an `acquirer` (your bank relationship) and the\nacquirer-assigned `merchant_id` (MID), plus the\n`terminal_id` (TID) when the acquirer needs one. Fat Zebra validates the MID/TID and `currencies`\nagainst its config and boards the merchant onto every processor behind\nthat acquirer that can carry a requested currency — you never name a\nprocessor. Omit `currencies` to board everything the acquirer supports.\n\nBoarding is idempotent: re-posting the same acquirer returns the\nexisting connection rather than creating a duplicate.\n\nFailures are reported inline:\n\n* `422 validation_error` — an unsupported currency, a missing\n  `merchant_id`, or no\n  processor supports the acquirer for the requested currencies. The\n  offending fields are listed under `error.fields`.\n* `422 processor_error` — an underlying processor board was rejected or\n  errored upstream.\n* `404 not_found` — the acquirer is unknown or not available to this\n  partner.\n","operationId":"boardAcquirer","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnectionCreateRequest"}}}},"responses":{"201":{"description":"The boarded connection.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnection"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/ValidationError"}}}},"/merchants/{username}/acquirers/{conn_id}":{"parameters":[{"$ref":"#/components/parameters/Username"},{"$ref":"#/components/parameters/ConnId"}],"get":{"tags":["Acquirer connections"],"summary":"Show an acquirer connection","operationId":"showAcquirerConnection","responses":{"200":{"description":"The acquirer connection.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnection"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}},"patch":{"tags":["Acquirer connections"],"summary":"Update an acquirer connection","description":"Patches the mutable fields only: `priority`, `currencies`,\n`card_types`. Changing `currencies` / `card_types` re-evaluates which\nunderlying processors stay active. `card_types` is narrowed to each\nprocessor's routable set, so a PATCH can't enable a scheme the acquirer\ncan't settle. The `acquirer` and the MID/TID (`merchant_id` /\n`terminal_id`) are immutable once the connection exists.\n","operationId":"updateAcquirerConnection","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnectionUpdateRequest"}}}},"responses":{"200":{"description":"The updated connection.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnection"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/ValidationError"}}}},"/merchants/{username}/acquirers/{conn_id}/enable":{"parameters":[{"$ref":"#/components/parameters/Username"},{"$ref":"#/components/parameters/ConnId"}],"post":{"tags":["Acquirer connections"],"summary":"Enable an acquirer connection","description":"Flips `enabled` to `true` across the underlying links. The routing\ntoggle only — config and MID/TID are untouched. No body is expected.\n","operationId":"enableAcquirerConnection","responses":{"200":{"description":"The enabled connection.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnection"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/merchants/{username}/acquirers/{conn_id}/disable":{"parameters":[{"$ref":"#/components/parameters/Username"},{"$ref":"#/components/parameters/ConnId"}],"post":{"tags":["Acquirer connections"],"summary":"Disable an acquirer connection","description":"Flips `enabled` to `false` across the underlying links — turns a boarded\nconnection off for routing without deleting it. Config and MID/TID are\nuntouched. No body is expected.\n","operationId":"disableAcquirerConnection","responses":{"200":{"description":"The disabled connection.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcquirerConnection"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}}},"components":{"securitySchemes":{"PartnerBasicAuth":{"type":"http","scheme":"basic","description":"HTTP Basic. Send your reseller **username** as the Basic username and\nyour reseller API **token** as the Basic password. Required on every\nendpoint.\n"}},"parameters":{"Limit":{"in":"query","name":"limit","description":"Page size. Defaults to 25, capped at 100.","required":false,"schema":{"type":"integer","minimum":1,"maximum":100,"default":25}},"StartingAfter":{"in":"query","name":"starting_after","description":"Cursor — the id of the last item from the previous page. Omit for the first page.","required":false,"schema":{"type":"string"}},"Username":{"in":"path","name":"username","description":"The merchant's username (e.g. `acme-store`).","required":true,"schema":{"type":"string"}},"ConnId":{"in":"path","name":"conn_id","description":"Acquirer-connection id — the derived merchant+acquirer virtual id (e.g. `042-ACQ-NAB`).","required":true,"schema":{"type":"string"}},"UserId":{"in":"path","name":"id","description":"User id (e.g. `123-RU-9f3k2m8q`).","required":true,"schema":{"type":"string"}},"AcquirerCode":{"in":"path","name":"code","description":"Acquirer code (e.g. `nab`).","required":true,"schema":{"type":"string"}}},"responses":{"Unauthorized":{"description":"Missing or invalid HTTP Basic credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"},"examples":{"invalidToken":{"value":{"error":{"type":"authentication_error","message":"Invalid or missing token","fields":{},"request_id":"req_a1b2c3"}}}}}}},"NotFound":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"},"examples":{"notFound":{"value":{"error":{"type":"not_found","message":"Couldn't find merchant","fields":{},"request_id":"req_a1b2c3"}}}}}}},"Conflict":{"description":"The request conflicts with the resource's current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"},"examples":{"noActiveConnection":{"value":{"error":{"type":"conflict","message":"merchant has no active processing connection","fields":{},"request_id":"req_a1b2c3"}}}}}}},"ValidationError":{"description":"The request couldn't be completed. A `validation_error` is something the\ncaller can fix — a bad payload, a merchant that failed validation, or a\nprocessor rejecting a field (e.g. the MID); the reason is in `fields`,\nkeyed by a processor-agnostic field name. A `processor_error` is an\nunactionable upstream failure (a processor was unreachable, busy, or\nerrored); `fields` is empty and the caller should retry or escalate.\nRaw upstream detail is never surfaced here — only a parsed,\nprocessor-neutral reason.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"},"examples":{"merchantValidation":{"summary":"The merchant details were rejected","value":{"error":{"type":"validation_error","message":"the merchant details were rejected","fields":{"company_name":["can't be blank"],"postcode":["is not a valid postcode"]},"request_id":"req_a1b2c3"}}},"unsupportedCurrency":{"summary":"A currency the acquirer can't carry","value":{"error":{"type":"validation_error","message":"currency not supported by this acquirer","fields":{"currencies":["NZD is not supported by this acquirer"]},"request_id":"req_a1b2c3"}}},"missingConnectionFields":{"summary":"Missing a required connection field","value":{"error":{"type":"validation_error","message":"missing required connection fields: merchant_id, terminal_id","fields":{"merchant_id":["is required"],"terminal_id":["is required"]},"request_id":"req_a1b2c3"}}},"noSupportingProcessor":{"summary":"No processor can carry the acquirer for the requested currencies","value":{"error":{"type":"validation_error","message":"no processor can carry this acquirer for the requested currencies","fields":{"acquirer":["cannot be boarded for the requested currencies"]},"request_id":"req_a1b2c3"}}},"processorRejectedMid":{"summary":"A processor rejected a field (here, the MID) — caller-fixable","value":{"error":{"type":"validation_error","message":"the connection details were rejected","fields":{"mid":["is not supported"]},"request_id":"req_a1b2c3"}}},"processorUnavailable":{"summary":"A processor is busy/errored — not the caller's to fix","value":{"error":{"type":"processor_error","message":"a processor is temporarily unavailable","fields":{},"request_id":"req_a1b2c3"}}}}}}}},"schemas":{"PingResponse":{"type":"object","required":["ok"],"properties":{"ok":{"type":"boolean","const":true,"description":"Always `true` when the API is reachable and the token is valid."}}},"Error":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["type","message","fields","request_id"],"properties":{"type":{"type":"string","description":"Machine-readable error category.","enum":["authentication_error","not_found","conflict","validation_error","processor_error"]},"message":{"type":"string","description":"Human-readable explanation of the error."},"fields":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"Per-field validation messages. Empty object when not field-specific."},"request_id":{"type":["string","null"],"description":"Correlation id for this request, for support and tracing (e.g. `req_a1b2c3`)."}}}}},"ListEnvelope":{"type":"object","required":["items","next_cursor"],"properties":{"items":{"type":"array","description":"The page of results. Each list endpoint overrides the item type."},"next_cursor":{"type":["string","null"],"description":"Id to pass as `starting_after` for the next page; `null` on the last page."}}},"Address":{"type":"object","properties":{"line1":{"type":["string","null"],"description":"First line of the street address (e.g. `1 Market St`)."},"line2":{"type":["string","null"],"description":"Second address line (e.g. `Level 4`)."},"city":{"type":["string","null"],"description":"Suburb or city (e.g. `Sydney`)."},"state":{"type":["string","null"],"description":"State or territory (e.g. `NSW`)."},"postcode":{"type":["string","null"],"description":"Postal code (e.g. `2000`)."},"country":{"type":["string","null"],"pattern":"^[A-Za-z]{2}$","description":"ISO-3166 alpha-2 country code (e.g. `AU`)."}}},"MerchantCredentialsInline":{"type":"object","description":"Credentials embedded on the merchant object. `token` is `null` on reads\nand only populated once by create and credential-rotate.\n","required":["username","token"],"properties":{"username":{"type":"string","description":"The merchant's username (e.g. `acme-store`)."},"token":{"type":["string","null"],"description":"The live API token (e.g. `tok_live_3b9c1d…`). `null` except on create / rotate."}}},"MerchantSurcharging":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether card surcharging is enabled for the merchant."}}},"Merchant":{"type":"obje

# --- truncated at 32 KB (59 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/fat-zebra/refs/heads/main/openapi/fat-zebra-partner.json