Zepto Validate API (Confirmation of Payee)
Confirmation of Payee (CoP) account validation — verify that a payee's account name matches the account details in real time before initiating a payment, reducing misdirected payments and payment fraud.
OpenAPI Specification
---
openapi: 3.0.1
info:
title: Zepto Validate API (Confirmation of Payee)
version: '20260101'
description: The Zepto Validate API (Confirmation of Payee) endpoints. Access to
this API is limited. Please contact Zepto for more information.
paths:
"/cop/account/validate":
post:
summary: account name validation
tags:
- CoP Account Validations
description: Validates a given name matches a given account.
parameters: []
responses:
'403':
description: forbidden
content:
application/json:
examples:
Forbidden:
summary: Forbidden
value:
errors:
- title: Unauthorised
detail: This user is not permitted to perform the requested
action.
schema:
"$ref": "#/components/schemas/cop.account_validations.errors.forbidden"
'401':
description: unauthorized
content:
application/json:
examples:
Unauthorised access token:
summary: Unauthorised access token
value:
errors:
- title: Unauthorised access token
detail: Access token is expired or not valid
links:
about: https://docs.zeptopayments.com/docs/zepto-api#authentication-and-authorisation
schema:
"$ref": "#/components/schemas/cop.account_validations.errors.unauthorised"
'200':
description: OK
content:
application/json:
schema:
"$ref": "#/components/schemas/cop.account_validations.success"
'404':
description: Not Found
content:
application/json:
examples:
No account found:
summary: No account found
value:
errors:
- code: ZCOPR02
title: No account found
detail: No record of the account can be found.
retryable: false
data:
uid: biz_cop_request_123456
schema:
"$ref": "#/components/schemas/cop.account_validations.errors.not_found"
'422':
description: Unprocessable Entity
content:
application/json:
examples:
Generic error response:
summary: Generic error response
value:
errors:
- code: ZCOPR00
title: Unable to confirm
detail: We could not confirm the account name match.
retryable: false
Invalid account identifier type:
summary: Invalid account identifier type
value:
errors:
- title: Validation Failed
detail: 'params.account_identifier.type must be one of: bban'
Invalid account identifier value:
summary: Invalid account identifier value
value:
errors:
- title: Validation Failed
detail: params.account_identifier.value must be filled
Invalid requester ID:
summary: Invalid requester ID
value:
errors:
- title: Validation Failed
detail: params.requester.id must be filled
Invalid party name:
summary: Invalid party name
value:
errors:
- title: Validation Failed
detail: params.party_name must be filled
BBAN Lookup Failed:
summary: BBAN Lookup Failed
value:
errors:
- code: ZCOPR01
title: BBAN Lookup Failed
detail: Zepto was unable to validate the branch code for the
given BBAN.
retryable: false
Unexpected response:
summary: Unexpected response
value:
errors:
- code: ZCOPR00
title: Unable to confirm
detail: We could not confirm the account name match.
retryable: false
Account no match limit exceeded:
summary: Account no match limit exceeded
value:
errors:
- code: ZCOPR04
title: Daily account no match limit reached
detail: The daily no match limit has been reached for the account.
retryable: true
Requester no match limit exceeded:
summary: Requester no match limit exceeded
value:
errors:
- code: ZCOPR05
title: Daily requester no match limit reached
detail: The daily no match limit has been reached for the requester.
retryable: true
Account request limit exceeded:
summary: Account request limit exceeded
value:
errors:
- code: ZCOPR06
title: Daily account limit reached
detail: The daily request limit has been reached for the account.
retryable: true
Requester request limit exceeded:
summary: Requester request limit exceeded
value:
errors:
- code: ZCOPR07
title: Daily requester limit reached
detail: The daily request limit has been reached for the requester.
retryable: true
schema:
"$ref": "#/components/schemas/cop.account_validations.errors.unprocessable"
'429':
description: Too Many Requests
content:
application/json:
examples:
Rate limited:
summary: Rate limited
value: ''
requestBody:
content:
application/json:
schema:
"$ref": "#/components/schemas/cop.account_validations.request"
parameters:
- "$ref": "#/components/parameters/ZeptoAPIVersion"
servers:
- description: Zepto Sandbox
url: https://api.sandbox.zeptopayments.com
- description: Zepto Production
url: https://api.zeptopayments.com
components:
schemas:
cop.account_validations.errors.forbidden:
type: object
required:
- errors
properties:
errors:
type: array
items:
type: object
required:
- title
- detail
properties:
code:
type: string
description: A code assigned to the type of error received
example: ZCOPR00
title:
type: string
description: A short summary of the error
example: Unauthorised
detail:
type: string
description: A detailed explanation of the error
example: This user is not permitted to perform the requested action.
description: Unsuccessful validation response due to forbidden access
cop.account_validations.errors.not_found:
type: object
required:
- errors
- data
properties:
data:
type: object
required:
- uid
properties:
uid:
type: string
description: Supplied unique identifier for CoP lookup, maximum 64 characters
containing only unreserved characters as defined in RFC3986. This
identifier ensures CoP lookup uniqueness between integrator systems
and Zepto.
example: biz_cop_request_123456
minLength: 1
maxLength: 64
errors:
type: array
items:
type: object
required:
- title
- detail
properties:
code:
type: string
description: A code assigned to the type of error received
example: ZCOPR02
title:
type: string
description: A short summary of the error
example: No account found
detail:
type: string
description: A detailed explanation of the error
example: No record of the account can be found.
retryable:
type: boolean
description: A boolean value indicating whether or not this lookup
may be retried. When retrying, a new unique UID must be supplied
for each attempt.
example: false
description: Account not found error response
cop.account_validations.errors.unauthorised:
type: object
required:
- errors
properties:
errors:
type: array
items:
type: object
required:
- title
- detail
properties:
title:
type: string
description: A short summary of the error
example: Unauthorised access token
detail:
type: string
description: A detailed explanation of the error
example: Access token is expired or not valid
links:
type: object
properties:
about:
type: string
description: A link to more information about the error
example: https://example.com
description: Unsuccessful validation response due to unauthorised access
cop.account_validations.errors.unprocessable:
type: object
required:
- errors
properties:
errors:
type: array
items:
type: object
required:
- title
- detail
properties:
code:
type: string
description: A code assigned to the type of error received
example: ZCOPR00
title:
type: string
description: A short summary of the error
example: Unable to confirm
detail:
type: string
description: A detailed explanation of the error
example: We could not confirm the account name match.
retryable:
type: boolean
description: A boolean value indicating whether or not this lookup
may be retried. When retrying, a new unique UID must be supplied
for each attempt.
example: false
description: Unsuccessful validation response
cop.account_validations.request:
type: object
properties:
uid:
type: string
description: Supplied unique identifier for CoP lookup, maximum 64 characters
containing only unreserved characters as defined in RFC3986. This identifier
ensures CoP lookup uniqueness between integrator systems and Zepto.
example: biz_cop_request_123456
minLength: 1
maxLength: 64
account_identifier:
type: object
properties:
type:
type: string
enum:
- bban
description: The type of account identifier
example: bban
value:
type: string
description: The branch code (BSB) and account number to validate, can
be concatenated or separated with a hyphen.
example: 062000-11111111
required:
- type
- value
party_name:
type: string
description: The party name to validate against the account
example: John Doe
requester:
type: object
properties:
id:
type: string
description: Merchant provided customer ID for uniquely identifying
end user of CoP. Maximum 64 characters containing only unreserved
characters as defined in RFC3986.
example: AdminUser1234
minLength: 1
maxLength: 64
required:
- id
sandbox:
type: object
description: 'SANDBOX ONLY: Parameter that allows you to simulate the confirmation
of payee API responses for certain scenarios to aid integrators while
testing their control flows. Defaults to `match` if not given.'
properties:
simulate:
type: string
enum:
- match
- close_match
- individual_no_match
- non_individual_no_match
- account_closed
- no_account_found
- bic_lookup_failed
- account_daily_no_match_limit_exceeded
- requester_daily_no_match_limit_exceeded
- account_daily_request_limit_exceeded
- requester_daily_request_limit_exceeded
- unable_to_confirm
- rate_limited
example: match
required:
- simulate
required:
- uid
- account_identifier
- party_name
- requester
cop.account_validations.success:
type: object
required:
- data
properties:
data:
type: object
required:
- outcome
properties:
outcome:
type: object
required:
- result
properties:
result:
type: string
enum:
- match
- close_match
- no_match
- account_closed
description: The matching result, 'match' indicates high confidence,
'close_match' indicates reasonable confidence but with potential
variance, 'no_match' indicates the party name could not be confirmed,
'account_closed' indicates the bank account is closed.
match_name:
type: string
description: |
The name matched from the Data Holder. This field returns the
closest matching name registered for the bank account. This may be an individual
name, AKA name, trading name, or a formatted representation.
For successful matches on joint accounts, returns in the format "{Name} and others"
instead of revealing all account holders when names don't equally match.
For privacy reasons, this field is included only for:
- Individual accounts: With 'match' and 'close_match' results
- Business accounts: With 'match', 'close_match', and 'no_match' results
example: John Doe and others
message:
type: string
description: |
Human-readable message with the lookup result.
For successful matches, returns in the format "The account is in the name of {match_name}".
For privacy reasons, this field is included only for:
- Individual accounts: With 'match' and 'close_match' results
- Business accounts: With 'match', 'close_match', and 'no_match' results
example: The account is in the name of John Doe and others
description: The Confirmation of Payee account validation outcome
insights:
type: object
properties:
risk_score:
type: integer
description: "**(Alpha)** Proprietary risk score from 0 to 100,
where 100 indicates the highest risk. The score is calculated
based on account age, and other factors. This field is only present
for 'match' and 'close_match' results."
is_joint:
type: boolean
description: Indicates whether the account is held jointly by multiple
parties.
suggested_payment_channels:
type: array
items:
type: string
enum:
- npp.sct
- de.dc
description: Recommended payment channels for this account based
on its capabilities. 'npp.sct' indicates NPP support, 'de.dc'
indicates Direct Entry support.
description: |
Additional insights about the account and payment recommendations.
For privacy reasons, insights is included only for:
- Individual accounts: With 'match' and 'close_match' results
- Business accounts: With 'match', 'close_match', and 'no_match' results
uid:
type: string
description: Supplied unique identifier for CoP lookup, maximum 64 characters
containing only unreserved characters as defined in RFC3986. This
identifier ensures CoP lookup uniqueness between integrator systems
and Zepto.
example: biz_cop_request_123456
minLength: 1
maxLength: 64
example:
data:
outcome:
result: match
match_name: John Doe and others
message: The account is in the name of John Doe and others
insights:
risk_score: 25
is_joint: true
suggested_payment_channels:
- npp.sct
- de.dc
uid: biz_cop_request_123456
description: Successful validation response
parameters:
ZeptoAPIVersion:
name: Zepto-API-Version
in: header
required: false
schema:
type: string
pattern: "^\\d{8}$"
default: '20250101'
example: '20260101'
description: API version in YYYYMMDD format. Defaults to 20250101 (legacy) when
omitted.
securitySchemes:
bearerAuth:
type: http
scheme: bearer
security:
- bearerAuth: []