Fat Zebra Partner API

openapi: 3.2.0
info:
  title: Fat Zebra Partner API
  version: 1.0.0
  summary: Partner-facing API for boarding and managing sub-merchants and their acquirer connections.
  description: 'The Partner API lets you (a Fat Zebra partner) create and manage your own

    merchants, board them onto acquirers, and manage the resulting acquirer

    connections.'
servers:
- url: https://gateway.pmnts.io/v2/partners
  description: Production
- url: https://gateway.pmnts-sandbox.io/v2/partners
  description: Sandbox
- url: https://gateway.pmnts-staging.io/v2/partners
  description: Staging
- url: https://gateway.test/v2/partners
  description: Local development
security:
- PartnerBasicAuth: []
tags:
- name: Partner
  description: The authenticated partner (self).
paths:
  /me:
    get:
      tags:
      - Partner
      summary: Show the authenticated partner (self)
      description: 'Returns the partner object: id, name, status, environment, branding,

        and defaults.'
      operationId: showSelf
      responses:
        '200':
          description: The authenticated partner.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Partner'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /me/credentials/rotate:
    post:
      tags:
      - Partner
      summary: Rotate the partner's own API token
      description: 'Rotates the partner''s API `token`. No body is expected. The fresh value

        is returned once — the previous token stops working immediately, so the

        caller must store the response.'
      operationId: rotateSelfCredentials
      responses:
        '200':
          description: The rotated credentials (returned once).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PartnerCredentials'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  responses:
    Unauthorized:
      description: Missing or invalid HTTP Basic credentials.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            invalidToken:
              value:
                error:
                  type: authentication_error
                  message: Invalid or missing token
                  fields: {}
                  request_id: req_a1b2c3
  schemas:
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: object
          required:
          - type
          - message
          - fields
          - request_id
          properties:
            type:
              type: string
              description: Machine-readable error category.
              enum:
              - authentication_error
              - not_found
              - conflict
              - validation_error
              - processor_error
            message:
              type: string
              description: Human-readable explanation of the error.
            fields:
              type: object
              additionalProperties:
                type: array
                items:
                  type: string
              description: Per-field validation messages. Empty object when not field-specific.
            request_id:
              type:
              - string
              - 'null'
              description: Correlation id for this request, for support and tracing (e.g. `req_a1b2c3`).
    PartnerDefaults:
      type: object
      properties:
        currencies:
          type: array
          description: Default currencies for the partner's merchants.
          items:
            type: string
            description: ISO-4217 currency code (e.g. `AUD`).
        card_types:
          type: array
          description: Default accepted card types.
          items:
            type: string
            description: Card type slug (e.g. `visa`, `mastercard`).
        timezone:
          type:
          - string
          - 'null'
          description: IANA timezone identifier.
          examples:
          - Australia/Sydney
          - Australia/Brisbane
          - Australia/Perth
          - Pacific/Auckland
          - Europe/London
          - America/New_York
          - UTC
    Partner:
      type: object
      description: 'The authenticated partner (self). Returned by `GET /me`.

        '
      required:
      - id
      - name
      - status
      - environment
      properties:
        id:
          type: string
          description: The partner's username (e.g. `acme-partner`).
        name:
          type:
          - string
          - 'null'
          description: The partner's display name (e.g. `Acme Payments`).
        status:
          type: string
          description: The partner's account status (e.g. `active`).
        environment:
          type: string
          enum:
          - live
          - test
          description: '`live` in production, `test` elsewhere.'
        branding:
          $ref: '#/components/schemas/PartnerBranding'
        defaults:
          $ref: '#/components/schemas/PartnerDefaults'
    PartnerCredentials:
      type: object
      description: 'Returned once by `POST /me/credentials/rotate`. The full `token` is

        shown here and never again.

        '
      required:
      - username
      - token
      - rotated_at
      properties:
        username:
          type: string
          description: The partner's username (e.g. `acme-partner`).
        token:
          type: string
          description: The newly-generated API token (e.g. `sk_live_8f3a…`).
        rotated_at:
          type: string
          format: date-time
          description: When the credentials were rotated — ISO 8601 UTC (e.g. `2026-06-02T00:00:00Z`).
    PartnerBranding:
      type: object
      properties:
        display_name:
          type:
          - string
          - 'null'
          description: Partner brand name shown to merchants (e.g. `Acme Payments`).
        logo_url:
          type:
          - string
          - 'null'
          description: Absolute URL of the partner logo (e.g. `https://acme.example/logo.png`).
        support_email:
          type:
          - string
          - 'null'
          format: email
          description: Support contact email (e.g. `support@acme.example`).
        support_phone:
          type:
          - string
          - 'null'
          description: Support contact phone in E.164 format (e.g. `+61290000000`).
  securitySchemes:
    PartnerBasicAuth:
      type: http
      scheme: basic
      description: 'HTTP Basic. Send your reseller **username** as the Basic username and

        your reseller API **token** as the Basic password. Required on every

        endpoint.

        '