Revolut Apple Pay merchant registration API

openapi: 3.0.1
info:
  version: '1.0'
  title: Business Accounting Apple Pay merchant registration API
  description: "As a Revolut Business customer with a Business Account, you can use the Business API to automate your own business processes.\nSave time, reduce your costs, and avoid errors by using the Business API. \n\n:::tip[Before you get started]\nTo learn more about the Business API and its features, check the [**user guides**](https://developer.revolut.com/docs/guides/manage-accounts/introduction).\n\nYou can reach them at any time from the main navigation bar **→ Guides → Business**.\n:::\n\nYou can view accounts, manage counterparties, make payments or currency exchanges without manual effort in the Web UI:\n\n- Accounting: [Account management](https://developer.revolut.com/docs/api/business#get-account), [Accounting settings](https://developer.revolut.com/docs/api/business#tag-accounting), [Expense management](https://developer.revolut.com/docs/api/business#get-expense), [Transactions](https://developer.revolut.com/docs/api/business#get-transactions) \n- Payments: \n  - [Counterparty management](https://developer.revolut.com/docs/api/business#get-counterparties)\n  - Payment management: [Payment drafts](https://developer.revolut.com/docs/api/business#delete-payment-draft), [Payout links](https://developer.revolut.com/docs/api/business#get-payout-link), [Transfers](https://developer.revolut.com/docs/api/business#tag-transfers)\n  - [Foreign exchange](https://developer.revolut.com/docs/api/business#tag-foreign-exchange)\n- Business team: [Card management](https://developer.revolut.com/docs/api/business#delete-card), [Card invitation management](https://developer.revolut.com/docs/api/business#update-card-invitation), [Team member management](https://developer.revolut.com/docs/api/business#delete-team-member)\n- Developer tools: [Sandbox simulations](https://developer.revolut.com/docs/api/business#tag-simulations), [Webhook management](https://developer.revolut.com/docs/api/business#tag-webhooks-v2)\n\nTo see the reference for the specific endpoints and operations of this API, browse the menu on the left.\n\n### Test the Business API\n\nYou can test the Business API in Postman by forking this collection:\n\n[![View in Postman](https://run.pstmn.io/button.svg)](https://www.postman.com/revolut-api/workspace/revolut-developers/overview)"
  contact: {}
servers:
- url: https://b2b.revolut.com/api/1.0
  description: Production server (uses live data)
- url: https://sandbox-b2b.revolut.com/api/1.0
  description: Sandbox server (uses test data)
tags:
- name: Apple Pay merchant registration
  description: 'Operations for managing a merchant''s domain registration and configuration with Apple for integration of Apple Pay via Revolut.


    This includes initiating domain validation with Apple, a necessary step for merchants to offer Apple Pay as a payment method on their websites or apps.


    These endpoints interact with Apple''s [Apple Pay Web Merchant Registration services](https://developer.apple.com/documentation/applepaywebmerchantregistrationapi).'
paths:
  /api/apple-pay/domains/register:
    parameters:
    - $ref: '#/components/parameters/Authorization'
    post:
      summary: Register domain for Apple Pay
      operationId: registerDomainApplePay
      description: "Register your website's domain to accept payments via Apple Pay. \n\nBefore you call this endpoint, make sure that you have completed the following steps:\n\n1. Download the latest [domain validation file](https://assets.revolut.com/api-docs/merchant-api/files/apple-developer-merchantid-domain-association).\n1. Upload the domain validation file to your website in the following folder `/.well-known/`. For example, if your website is `example.com`, the file should be available on `example.com/.well-known/apple-developer-merchantid-domain-association`, where `apple-developer-merchantid-domain-association` indicates the name of the file."
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                domain:
                  type: string
                  description: Domain name of your website without the scheme (i.e. without `http://` or `https://`).
                  example: revolut.com
              required:
              - domain
            examples:
              example_request:
                summary: Example domain registration request for Apple Pay
                value:
                  domain: revolut.com
      responses:
        '204':
          description: Domain registered successfully
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: 'An identifier that can be used to determine what went wrong.


                      Error codes are not globally unique, but uniqueness is guaranteed within endpoints.'
                  message:
                    type: string
                    description: Human readable text describing what went wrong.
                required:
                - code
              examples:
                error_message:
                  summary: Error message
                  value:
                    code: validation
                    message: Exactly one value must be supplied for client_id
      security:
      - Api-Key: []
      tags:
      - Apple Pay merchant registration
  /api/apple-pay/domains/unregister:
    parameters:
    - $ref: '#/components/parameters/Authorization'
    - $ref: '#/components/parameters/Revolut-Api-Version-Optional'
    post:
      summary: Unregister domain for Apple Pay
      operationId: unregisterDomainApplePay
      description: 'Unregister your website from Apple Pay''s registered domains. '
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                domain:
                  type: string
                  description: Domain name of your website without the scheme (i.e. without `http://` or `https://`).
                  example: revolut.com
                reason:
                  type: string
                  description: A short explanation why you remove the domain.
                  maxLength: 1024
              required:
              - domain
              - reason
            examples:
              example_request:
                summary: Example domain registration request for Apple Pay
                value:
                  domain: revolut.com
                  reason: Unregister due to domain change.
      responses:
        '204':
          description: Domain ungistered successfully
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  code:
                    type: string
                    description: 'An identifier that can be used to determine what went wrong.


                      Error codes are not globally unique, but uniqueness is guaranteed within endpoints.'
                  message:
                    type: string
                    description: Human readable text describing what went wrong.
                required:
                - code
              examples:
                error_message:
                  summary: Error message
                  value:
                    code: validation
                    message: Exactly one value must be supplied for client_id
      security:
      - Api-Key: []
      tags:
      - Apple Pay merchant registration
components:
  parameters:
    Authorization:
      name: Authorization
      in: header
      schema:
        type: string
        format: Bearer <yourSecretApiKey>
        example: Bearer sk_1234567890ABCdefGHIjklMNOpqrSTUvwxYZ_1234567890-Ab_cdeFGHijkLMNopq
      required: true
      description: "This parameter accepts the [Merchant API Secret key](https://business.revolut.com/settings/apis?tab=merchant-api) to authorise requests coming from the merchant's backend. \n\nIt ensures that ensures that each request is authenticated and authorised by verifying the secret key. The secret key should be included in all request headers as a `Bearer` token.\n\n:::info\nFor more information, see: [Authentication](https://developer.revolut.com/docs/api/merchant#authentication)\n:::"
    Revolut-Api-Version-Optional:
      name: Revolut-Api-Version
      in: header
      schema:
        type: string
        format: date
        example: '2026-04-20'
        enum:
        - '2023-09-01'
        - '2024-05-01'
        - '2024-09-01'
        - '2025-10-16'
        - '2025-12-04'
        - '2026-03-12'
        - '2026-04-20'
      description: 'The version of the Merchant API, specified in `YYYY-MM-DD` format.


        :::info

        For more information about API versioning, see: [API versions](https://developer.revolut.com/docs/guides/merchant/reference/versioning/api-versions).

        :::'
      x-config-always-visible-in-example: true
  securitySchemes:
    AccessToken:
      type: http
      scheme: bearer
      description: "Each Business API request must contain an authorization header in the following format to make a call: `Bearer <your_access_token>`.\n\nThe access token will be obtained the first time you set up your application and has an expiration of 40 minutes. \nDuring setup, a `refresh_token` will also be obtained which allows to obtain a new `access_token`.\n\n:::danger\nNever share your client-assertion JWT (JSON web token), `access_token` and `refresh_token` with anyone, as these can be used to access your banking data and initiate transactions.\n:::\n\nAccess tokens can be issued with four security scopes and require a JWT (JSON Web Token) signature to be obtained:\n- `READ`: Permissions for `GET` operations.\n- `WRITE`: Permissions to update counterparties, webhooks, and issue payment drafts.\n- `PAY`: Permissions to initiate or cancel transactions and currency exchanges.    \n- `READ_SENSITIVE_CARD_DATA`: Permissions to retrieve sensitive card details.\n\n  :::warning\n  If you enable the `READ_SENSITIVE_CARD_DATA` scope for your access token, you must set up IP whitelisting. \n  Failing to do so will prevent you from accessing **any** Business API endpoint. \n\n  IP whitelisting means that you must specify an IP or a set of IPs which will be the only IPs from which requests to the API will be accepted. \n  To do so:\n  1. Go to the Revolut Business web app [settings](https://business.revolut.com/settings) → **APIs** → **Business API**.\n  2. Select the corresponding API certificate.\n  3. In **Production IP whitelist**, provide the IP(s) which should be whitelisted.\n      Make sure that the IPs you provide are **not** [local (i.e. private) IP addresses](https://www.okta.com/en-sg/identity-101/understanding-private-ip-ranges/). \n  4. Save the new settings.\n  :::\n\nTo configure your JWT and obtain the refresh and first access tokens, complete the following steps:\n\n  1. [Sign up for a Revolut Business account](https://developer.revolut.com/docs/guides/manage-accounts/get-started/sign-up-for-revolut-business-account)\n  2. [Prepare your Sandbox environment](https://developer.revolut.com/docs/guides/manage-accounts/get-started/prepare-sandbox-environment)\n  3. [Make your first API request](https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request)"