openapi: 3.0.1
info:
  title: Openpay BankAccounts Tokens API
  description: REST API for the Openpay online payments platform (BBVA group), available in Mexico and Colombia. Resources are scoped to a merchant under the path /v1/{merchant_id}. The API supports charges against cards, convenience stores (cash), and banks (SPEI); customers and stored cards; client-side tokens; recurring plans and subscriptions; payouts and transfers to bank accounts; commission fees; and webhook notifications. Authentication uses HTTP Basic auth with the merchant private API key as the username and an empty password.
  termsOfService: https://www.openpay.mx/terminos-y-condiciones.html
  contact:
    name: Openpay Support
    url: https://www.openpay.mx
    email: soporte@openpay.mx
  version: '1.0'
servers:
- url: https://api.openpay.mx/v1
  description: Production (Mexico)
- url: https://sandbox-api.openpay.mx/v1
  description: Sandbox (Mexico)
- url: https://api.openpay.co/v1
  description: Production (Colombia)
- url: https://sandbox-api.openpay.co/v1
  description: Sandbox (Colombia)
security:
- basicAuth: []
tags:
- name: Tokens
  description: Client-side tokenization of card data.
paths:
  /{merchant_id}/tokens:
    parameters:
    - $ref: '#/components/parameters/MerchantId'
    post:
      operationId: createToken
      tags:
      - Tokens
      summary: Create a card token.
      description: Tokenizes card data so it does not pass through the merchant server, reducing PCI scope. Typically called with the public API key from the browser or device.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateToken'
      responses:
        '200':
          description: Token created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Token'
  /{merchant_id}/tokens/{token_id}:
    parameters:
    - $ref: '#/components/parameters/MerchantId'
    - name: token_id
      in: path
      required: true
      schema:
        type: string
    get:
      operationId: getToken
      tags:
      - Tokens
      summary: Get a token by id.
      responses:
        '200':
          description: The token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Token'
components:
  schemas:
    CreateToken:
      type: object
      required:
      - card_number
      - holder_name
      - expiration_year
      - expiration_month
      - cvv2
      properties:
        card_number:
          type: string
        holder_name:
          type: string
        expiration_year:
          type: string
        expiration_month:
          type: string
        cvv2:
          type: string
        address:
          $ref: '#/components/schemas/Address'
    Token:
      type: object
      properties:
        id:
          type: string
        card:
          $ref: '#/components/schemas/Card'
    Address:
      type: object
      properties:
        line1:
          type: string
        line2:
          type: string
        line3:
          type: string
        postal_code:
          type: string
        state:
          type: string
        city:
          type: string
        country_code:
          type: string
          example: MX
    Card:
      type: object
      properties:
        id:
          type: string
        type:
          type: string
          enum:
          - debit
          - credit
        brand:
          type: string
          example: visa
        card_number:
          type: string
          description: Masked card number.
        holder_name:
          type: string
        expiration_year:
          type: string
        expiration_month:
          type: string
        bank_name:
          type: string
        bank_code:
          type: string
        creation_date:
          type: string
          format: date-time
  parameters:
    MerchantId:
      name: merchant_id
      in: path
      required: true
      description: The merchant identifier that scopes all resources.
      schema:
        type: string
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic authentication. Use the merchant private API key as the username and leave the password empty.