openapi: 3.2.0
info:
  description: "# Introduction\n\n<p> \n  Monoova has developed a powerful payments engine which allows you to receive, manage and pay funds in AUD in Australia automatically.\n  This service is made available to Monoova’s clients through a set of easy-to-use RESTful APIs with JSON payloads described in this document.\n  The central idea is to reduce the cost, risk and effort normally associated with managing complex money movements so that you can focus on growing your business.\n</p> \n<p> \n Our clients can receive and reconcile funds via Realtime transfers (NPP), direct credits/debits, BPAY and cards. \n They can then manage those funds by building virtual account/wallet hierarchies to get bespoke reporting, reconciliation and much more. \n And finally, our clients can pay funds via Realtime transfers (NPP) direct credits and BPAY. \n As new technologies become available (e.g. NPP Mandated payments) we will make additional methods of receiving, managing and paying available.\n</p> \n<p> \n  All information flows are real-time.\n  Moving money between various Monoova accounts is also real time.\n  All money flows in and out of the Engine are as fast as the banking system allows.\n</p>\n<p> \n  The sandbox environment is open to everyone who signs up on our <a href=\"https://sandbox.monoova.com/user/login\" target=\"_blank\">Sandbox Portal</a> at no cost.\n  The sandbox environment allows you to test out the functionality of our API in a consequence free development environment.\n  Access to the live environment is granted once you have (1) gone through our compliance process and (2) had formal sign-off on your sandbox integration.\n</p>\n<p>\n  Monoova regularly releases additive changes to our API, as well as new versions of the API when a breaking change would occur. \n  To ensure your integration does not break due to these additive changes, we recommend not validating the entire schema, or the position of a parameter within the schema.\n</p>\n<br/><br/>\n<p> <strong> Note&#58;</strong> Please note we do not accept TLS 1.0 or 1.1 connections</p>\n\n# Getting started\n>\n  - Sign on to our <a href=\"https://sandbox.monoova.com/user/login\" target=\"_blank\">Sandbox Portal</a>\n  - Get your sandbox API key under **MANAGE > ACCOUNTS** in the Sandbox Portal\n  - [Authenticate](#section/Authentication)\n  - Browse this document to find the functions you need\n  - Begin experimenting with your first API calls by sending HTTP requests to the endpoints described in this document\n  - Use the provided examples in the document as guidance\n\n# Authentication\n  All RESTful APIs in this document use BASIC Authentication (except those in public/v1) in two scenarios either\n  - <strong> API KEY </strong>\n  - <strong> OneShotSecurityToken </strong><br><br>\n\n> **Sandbox Authentication Credentials**\n<table>\n  <tr>\n    <th>Field</th>\n    <th>Value</th>\n  </tr>\n  <tr>\n    <td>Username</td>\n    <td>API Key (obtained from the <a href=\"https://sandbox.monoova.com/user/login\" target=\"_blank\">Sandbox Portal</a>) </td>\n  </tr>\n  <tr>\n    <td>Password</td>\n    <td>leave blank when using API key; Monoova will provide password for OneShotSecurityToken</td>\n  </tr>\n  <tr>\n    <td>Base URL</td>\n    <td>https://api.m-pay.com.au/</td>\n  </tr>\n</table> <br>\n\n> **Live Authentication Credentials**\nThis will be provided by Monoova after a technical review. <br> \n<table>\n  <tr>\n    <th>Field</th>\n    <th>Value</th>\n  </tr>\n  <tr>\n    <td>Username</td>\n    <td>API Key (obtained from the Production Portal; Production credentials will be supplied by Monoova) </td>\n  </tr>\n  <tr>\n    <td>Password</td>\n    <td>leave blank when using API key; Monoova will provide password for OneShotSecurityToken</td>\n  </tr>\n  <tr>\n    <td>Base URL</td>\n    <td>https://api.mpay.com.au/</td>\n  </tr>\n</table> <br>\n\nWhen using the LIVE Engine, your Sign-In Account is given five (5) attempts to authenticate your credentials. \nOn the fifth failure your Sign-In Account is locked for one (1) hour. \nThe returned data will indicate that your account is locked and the time in UTC that the account will be unlocked. \nIf you require the account to be unlocked on the LIVE system you may contact your Monoova representative and at his or her discretion they will unlock the account.\nSee the API routes in Security to manage Passwords and Tokens. <br><br>\n\n<h3> UserName/Password </h3>\nUsing this scenario, you can configure BASIC Authentication with the following <br> <br>\n<li> <strong> UserName </strong> - API Key (obtained from the <a href=\"https://sandbox.monoova.com/user/login\" target=\"_blank\">Sandbox Portal</a>) Production credentials will be supplied by Monoova when you have demonstrated successful implementation of the API on our Sandbox environment.</li>\n<li> <strong> Password </strong> - When using your API Key, no password is required. \nIf the key is compromised, it can be re-rolled via the <a href=\"https://sandbox.monoova.com/user/login\" target=\"_blank\">Sandbox Portal</a>. </li> <br>\n\n# Feedback\n\nWe value your feedback on our API. Please fill out the form <a href=\"https://ncv.microsoft.com/8eaKX3fsiJ\" target=\"_blank\">here</a> to share your feedback.\n"
  version: v5.29
  title: Monoova Payments Public Endpoints API
  contact:
    name: Monoova Support
    email: support@monoova.com
    url: https://www.monoova.com
  x-logo:
    url: https://movdpwebsiteprodae.blob.core.windows.net/images/Monoova-Primary-Logo-Black-RGB.png
    altText: Monoova logo
servers:
- url: https://api.mpay.com.au
  description: Production URL
- url: https://api.m-pay.com.au
  description: Sandbox URL
security:
- BasicAuth: []
tags:
- name: Public Endpoints
  description: ''
paths:
  /public/v1/ping:
    get:
      tags:
      - Public Endpoints
      summary: Ping
      description: The primary purpose of the ping API is to validate that the system is up and running. No Authentication is required.
      operationId: PublicPing
      security: []
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DTO.PublicPingResponse_V1'
        '400':
          description: Bad request
        '500':
          description: Internal Server Error
  /public/v1/certificate:
    get:
      tags:
      - Public Endpoints
      summary: Webhook Signing Certificate
      description: 'This endpoint returns the current X.509 certificate, which contains the public key that you can use to verify messages sent by Monoova.</br>

        The certificate returned is short-lived (1-year validity) and should be updated accordingly.

        </br></br>

        '
      operationId: PublicCertificate
      security: []
      responses:
        '200':
          description: OK
        '400':
          description: Bad request
        '500':
          description: Internal Server Error
  /public/v1/certificate/public-key:
    get:
      tags:
      - Public Endpoints
      summary: Retrieve Public Key
      description: This endpoint returns the public key used by Monoova to sign messages.The public key is encoded as a hexadecimal string.</br> This public key should be expected to change every 1 year and should be updated accordingly.
      operationId: PublicCertificatePublicKey
      security: []
      responses:
        '200':
          description: OK
          content:
            application/octet-stream:
              examples:
                response:
                  value: 3082010A0282010100D1F5EF12A7C71A12478280DCD7D9C8D62E70A7252A02C88D0F768B9860FB773F3C45E33944DF7824AEDAD990B53F5E58719D39790013375E5895FC05FFE7130FA9003C8072850D8499A9C8A676F7D0F719F8BC8CEA0BD0697D1D5B4856A0A0FAB4F297CB53FD00D62091748E8949ED9395887A1D965DCDD8B648709A3EF3E7F83546015AE8154896391973CF4217D859C4D81C81514A38416BD7E7B2CD75BA643B4F07CE2DF6DFA142AF140E0A1C9E3FA708FEA2BDFA4A8B574CC7C757AD8A7B22801356C45AC338DCF8CFA8DFF662A9D4C81EB120D657F8531977B3178B5365E1FCF87E4A9A30A1D351644D6D62F4CE4346C65C5307BB7840493EFDE175516F0203010001
        '400':
          description: Bad request
        '500':
          description: Internal Server Error
components:
  schemas:
    DTO.PublicPingResponse_V1:
      properties:
        durationMs:
          description: 'This value represents the total time in milliseconds that the Platform took to process the request. '
          type: integer
          format: int64
          example: 20
          uniqueItems: false
        status:
          description: This is the status of executing the request.&nbsp;A code of ‘Ok’ indicates no errors
          type: string
          example: Ok
          uniqueItems: false
        statusDescription:
          description: This is a plain English description of the status.
          type: string
          example: Operation completed successfully
          uniqueItems: false
        version:
          description: A string containing the Version of the Platform engine with the current Date Time at the server
          type: string
          example: 'Monoova Payments Platform Public V1.0.Engine V: 4.74.0.0  Environment: Sandbox DateTime: 19-Nov-2018 06:54:48 AM'
          uniqueItems: false
        environment:
          description: 'The name of the environment you are connected too: ·Live ·Sandbox'
          type: string
          example: Sandbox
          uniqueItems: false
      type: object
      format: DTO.PublicPingResponse_V1
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
x-tagGroups:
- name: Receive and Pay
  tags:
  - Financial
  - Verify
  - Automatcher (Bank Account Receivables)
  - Whitelisting for Automatcher (Bank Account Receivables)
  - Ledger Account
  - Reconciliation Rules
  - PayID
  - Tools
- name: BPAY
  tags:
  - BPAY
  - mWallet
- name: Manage
  tags:
  - Subscriptions
  - Webhooks
  - mAccount
  - Reports
  - Security
  - Token
- name: Public Endpoints
  tags:
  - Public Endpoints