PayMate Cards API
Commercial credit card enrolment and management
Operations 3
Documentation
Documentation
https://api.paymate.my/GlobalPartnerAPI
APIReference
https://api.paymate.my/GlobalPartnerAPI
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/paymate-cards-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
OpenAPI Specification
openapi: 3.2.0
info:
title: PayMate Global Partner Cards API
version: v1
description: 'Partner-facing B2B payments API for the PayMate global platform — business (KYB) onboarding, contact onboarding, commercial-card management, vendor payments, payment collection requests and reporting.
GENERATED, NOT PUBLISHED BY PAYMATE. PayMate does not publish an OpenAPI description. This document was generated by API Evangelist from PayMate''s OWN machine-readable endpoint dataset (MalaysiaData.json / singaporeData.json / AustraliaData.json / UaeData.json / OmanData.json / SouthAfricaData.json), which is bundled into the Partner API documentation app served at https://api.paymate.my/GlobalPartnerAPI. The verbatim datasets are kept alongside this file in openapi/_source/. Every path, method, parameter, data type, required flag, description and example here comes from that dataset; nothing was invented.
Regional deployments run the same v1 surface on six hosts. In Australia and South Africa the platform is branded DuNoMo. Each operation carries x-regions listing the regional datasets that declare it — POST /v1/VendorPayment is declared only in the Australian dataset.'
contact:
name: PayMate partner support
url: https://api.paymate.my/GlobalPartnerAPI
email: support@paymate.my
x-generated-by: API Evangelist enrichment pipeline
x-generated-on: '2026-08-26'
x-source: https://api.paymate.my/GlobalPartnerAPI/static/js/main.d40c1507.js
servers:
- url: https://api.paymate.sg
description: Singapore
- url: https://api.paymate.my
description: Malaysia
- url: https://api.paymate.ae
description: United Arab Emirates
- url: https://api.paymate.om
description: Oman
- url: https://api.dunomo.au
description: Australia (DuNoMo brand)
- url: https://api.dunomo.co.za
description: South Africa (DuNoMo brand)
security:
- PartnerApiKey: []
tags:
- name: Cards
description: Commercial credit card enrolment and management
paths:
/v1/AddCard:
post:
operationId: AddCard
summary: Add Card
description: Businesses can tokenize their credit cards for secure transactions through Paymate Tokenize Card API. Only PCI certified customer can use this api
tags:
- Cards
x-regions:
- ae
- au
- my
- om
- sg
- za
responses:
'200':
description: PayMate response envelope. Business outcome is carried in StatusCode; see errors/paymate-error-codes.yml.
content:
application/json:
schema:
type: object
properties:
RequestID:
type: string
maxLength: 30
description: Sent during request
StatusCode:
type: string
maxLength: 3
description: Status of the Request
Description:
type: string
maxLength: 300
description: Status Description
DetailedSummary:
type: object
description: This will be used to show Contact status and respond. Refer DetailedSummary Object
properties:
BusinessCode:
type: string
maxLength: 30
description: Business unique reference no. on partner system.
BusinessXpressID:
type: string
maxLength: 15
description: Business Unique Relationship no which was issued at the time of boarding.
CardReferenceNo:
type: string
maxLength: 20
description: PayMate Reference number
Status:
type: string
maxLength: 20
description: Current status of the Card
Message:
type: string
maxLength: 500
description: Status description
FomData:
type: string
x-declared-type: AN
description: Form data
example:
RequestID: '1234567899876'
StatusCode: '000'
Description: Your request has been processed successfully
DetailedSummary:
- BusinessXpressID: TDS0223444
CardReferenceNo: CR0000001
CardNo: '4149011500000527'
Status: '716'
Message: Token creation in process
FormData: <!DOCTYPE html><html><head><title>3D Secure</title></head><body><form id='pageform' action='https://checkoutshoppertest.adyen.com/checkoutshopper/threeDS2.shtml?pspReference=M9MWKVFX77TG5S82' method='post'><input type='hidden' name='MD' value='GPFC74CE741659E6B5'><input type='hidden' name='PaReq' value='BQABAgBD02VwOvs1PHQ7EJNbcgu4pqKVw_fFtuHhB5Mt5kmuGoD4rObq3W8tZIDiptSIG3ZkuBzNXxdwPtSvTHmhz'><input type='hidden' name='TermUrl' value='https://checkoutshoppertest.adyen.com/checkoutshopper/threeDS/return/TUQ9R1BGQzc0Q0U3NDE2NTlFNkI1JmdwaWQ9R1BGQzc0Q0U3NDE2NTlFNkI1JmludGVncmF0aW9uPWFwaV9hdXRoJnBzcFJlZmVyZW5jZT1NOU1XS1ZGWDc3VEc1UzgyJnNpZz1ta1pwNnJQWkxiYmNaZnNqZVc2UEpXV1lGOUZELUhOempORWNpTTd0LXNZ'></form><script>window.onload=function(){document.getElementById('pageform').submit()}</script></body></html>
'401':
description: Empty/invalid header credentials (StatusCode 106), observed on an unauthenticated probe.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
RequestID:
type: string
maxLength: 50
description: A unique RequestID for identifying the request.
BusinessCode:
type: string
maxLength: 30
description: Business unique reference no. on partner system. Parameter is mandatory if business is not sending issued BusinessXpressID
BusinessXpressID:
type: string
maxLength: 15
description: Business Unique Relationship no issued by PayMate. Parameter is mandatory if business is not sending registered BusinessCode
CardNumber:
type: string
pattern: ^[0-9]+$
maxLength: 20
description: 'Credit/Debit Card: 16 digit card number'
ExpiryMonth:
type: string
pattern: ^[0-9]+$
maxLength: 2
description: Expiry moth of the card
ExpiryYear:
type: string
pattern: ^[0-9]+$
maxLength: 4
description: Card Expiry year
CVV:
type: string
pattern: ^[0-9]+$
maxLength: 3
description: Card verification value
Network:
type: string
maxLength: 15
description: Network
x-possible-values: '[''VISA'', ''MASTERCARD'', ''AMEX'']'
CardHolderName:
type: string
maxLength: 50
description: Name on Card
IssuingBank:
type: string
maxLength: 100
description: Name of the card issuer. If CardOrderId is passed then this is optional else required
IssuingCountryCode:
type: string
maxLength: 3
description: 3 digit country iso code
CardType:
type: string
maxLength: 20
description: Card Type
x-possible-values: '[''CreditCard'', ''DebitCard'']'
ReturnURL:
type: string
maxLength: 200
description: URL to be redirected after the card addition is completed
required:
- RequestID
- CardNumber
- ExpiryMonth
- ExpiryYear
- CVV
- Network
- CardHolderName
- IssuingBank
- CardType
- ReturnURL
example:
RequestID: '123456789'
BusinessCode: ARFC1223
BusinessXpressID: ''
CardNumber: 4149XXXXXXXX0527
CardHolderName: JohnDoe
ExpiryMonth: XX
ExpiryYear: XXXX
CVV: XXX
Network: VISA
IssuingBank: affin bank
IssuingCountryCode: MYS
CardType: CreditCard
ReturnURL: ''
/v1/managecard:
post:
operationId: ManageCards
summary: Manage Cards
description: Customer can get the card details by using this method
tags:
- Cards
x-regions:
- ae
- au
- my
- om
- sg
- za
responses:
'200':
description: PayMate response envelope. Business outcome is carried in StatusCode; see errors/paymate-error-codes.yml.
content:
application/json:
schema:
type: object
properties:
RequestID:
type: string
maxLength: 30
description: Sent during request
StatusCode:
type: string
maxLength: 3
description: Status of the Request
Description:
type: string
maxLength: 300
description: Status Description
DetailedSummary:
type: object
description: Card details summary will come under DetailedSummary Object
properties:
CardReferenceNo:
type: string
maxLength: 50
description: Card unique key
CardDetails:
type: string
maxLength: 30
description: Card hashed details
Status:
type: string
maxLength: 3
description: Card Status code
Message:
type: string
maxLength: 500
description: Status description
example:
RequestID: '123456789'
StatusCode: '000'
Description: Card fetch successfully
DetailedSummary:
- CardReferenceNo: ' CR000013456'
CardDetail: '******3567'
Status: ''
Message: ''
- CardReferenceNo: ' CR000013457'
CardDetail: '******3569'
Status: ''
Message: ''
'401':
description: Empty/invalid header credentials (StatusCode 106), observed on an unauthenticated probe.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
RequestID:
type: string
maxLength: 50
description: A unique RequestID for identifying the request.
BusinessCode:
type: string
maxLength: 30
description: Business unique reference no. on partner system. Parameter is mandatory if business is not sending issued BusinessXpressID
BusinessXpressID:
type: string
maxLength: 15
description: Business Unique Relationship no issued by PayMate. Parameter is mandatory if business is not sending registered BusinessCode
required:
- RequestID
example:
CardDetails:
RequestID: '54652165245215'
BusinessCode: ''
BusinessXpressID: ''
/v1/Deletecard:
post:
operationId: DeleteCard
summary: Delete Card
description: Contact can delete their registered card by delete card method
tags:
- Cards
x-regions:
- ae
- au
- my
- om
- sg
- za
responses:
'200':
description: PayMate response envelope. Business outcome is carried in StatusCode; see errors/paymate-error-codes.yml.
content:
application/json:
schema:
type: object
properties:
RequestID:
type: string
maxLength: 30
description: Sent during request
StatusCode:
type: string
maxLength: 3
description: Status of the Request
Description:
type: string
maxLength: 300
description: Status Description
DetailedSummary:
type: object
description: Card details summary will come under DetailedSummary Object
properties:
CardReferenceNo:
type: string
maxLength: 50
description: Card unique key
Status:
type: string
maxLength: 3
description: Card Status code
Message:
type: string
maxLength: 500
description: Status description
example:
RequestID: '123456789'
StatusCode: '000'
Description: Card deleted successfully
DetailedSummary:
- CardReferenceNo: ' CR000013456'
Status: '000'
Message: Success
'401':
description: Empty/invalid header credentials (StatusCode 106), observed on an unauthenticated probe.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
RequestID:
type: string
maxLength: 50
description: A unique RequestID for identifying the request.
ReferenceCode:
type: string
maxLength: 30
description: Contact unique reference no. on partner system.
CardReferenceNo:
type: string
maxLength: 50
description: Card unique key
Remarks:
type: string
maxLength: 500
description: Reason for card deletion
required:
- RequestID
- ReferenceCode
- CardReferenceNo
- Remarks
example:
CardDetails:
RequestID: '54652165245215'
BusinessCode: '12345'
BusinessXpressID: ''
CardReferenceNo: ' CR000013456'
Remarks: ' Card Expired'
components:
schemas:
ErrorEnvelope:
type: object
description: Standard PayMate response envelope. Observed verbatim on a live unauthenticated probe of POST https://api.paymate.my/v1/Countrylist on 2026-08-26.
properties:
RequestID:
type:
- string
- 'null'
description: Echo of the partner-supplied request identifier
StatusCode:
type: string
maxLength: 3
description: PayMate status/error code — see errors/paymate-error-codes.yml (508 codes)
Description:
type: string
description: Human-readable status description
DetailedSummary:
type:
- object
- array
description: Operation payload; empty on error
example:
RequestID: null
StatusCode: '106'
Description: Empty/Invalid header credentials
DetailedSummary: {}
securitySchemes:
PartnerApiKey:
type: apiKey
in: header
name: Authorization
description: PayMate issues a secret partner API key after onboarding (write to the regional support address, e.g. support@paymate.my). The exact header name is NOT published in the documentation app; an unauthenticated POST to /v1/Countrylist returns StatusCode 106 "Empty/Invalid header credentials", confirming header-carried credentials. Treat this scheme name/location as UNVERIFIED and confirm with PayMate before use.
x-verified: false