# PayMate

> PayMate India Limited is a Mumbai-headquartered B2B payments and supply-chain finance platform. Enterprises
> use it to pay vendors, GST and utility bills on commercial credit cards, to raise and collect invoice
> payments, and to access working-capital credit and invoice discounting. The platform operates in India and
> across Singapore, Malaysia, the UAE, Oman, Sri Lanka, Saudi Arabia, Australia and South Africa — the
> Australian and South African deployments carry the DuNoMo brand.

This file was GENERATED by API Evangelist from PayMate's public surface on 2026-08-26. PayMate does not
publish an llms.txt (https://paymate.in/llms.txt and https://api.paymate.my/llms.txt both return 404).

## What PayMate publishes

PayMate has two live API generations and does not publish an OpenAPI description for either one.

- **PayMate Global Partner API** — the current surface. 25 JSON-over-POST operations under `/v1/`, deployed
  per region on `api.paymate.sg`, `api.paymate.my`, `api.paymate.ae`, `api.paymate.om`, `api.dunomo.au` and
  `api.dunomo.co.za`. Documentation: https://api.paymate.my/GlobalPartnerAPI
- **PayMate India Business Payments API** — the legacy PMXClients service. 12 JSON-over-POST methods with
  AES-256 encrypted payloads. Documentation: https://paymate.in/paymateapi/APIDoc.html

## Docs

- [Global Partner API reference](https://api.paymate.my/GlobalPartnerAPI): Overview, purpose, development
  environment, authentication, data security, per-operation request/response parameters, and a 508-entry
  error code table.
- [India API documentation](https://paymate.in/paymateapi/APIDoc.html): Purpose, requirements, development
  environment, authentication headers, the 12 methods, and a 58-entry error code table.
- [Fee schedule and subscription plans](https://paymate.in/Pricing_terms.html): Clause 9 carries the full
  plan table including the Basic API and Enterprise API plans. The dedicated pricing page,
  https://paymate.in/pricing.html, returns 404.
- [Security](https://paymate.in/security.html): PCI DSS 3.2.1 validation (ControlCase) and RBI Payment and
  Settlement Systems Act compliance.
- [Terms of service](https://paymate.in/terms.html)
- [Privacy policy](https://paymate.in/privacy.html)
- [Contact and support](https://paymate.in/contactus.html): support@paymate.co.in for the India platform;
  support@paymate.sg / support@paymate.my / support@paymate.ae / support@paymate.om / support@dunomo.au /
  support@dunomo.za for regional partner API keys.
- [Blog](https://paymate.in/blog.html) — last post 8 March 2023.
- [Login](https://paymate.in/login.aspx)

## How to call it

- Every operation is a `POST` with a JSON body. There are no GET/PUT/PATCH/DELETE verbs, no path parameters
  and no query parameters. Deletion is a POST.
- Every response is HTTP 200 — including business failures — with the envelope
  `{RequestID, StatusCode, Description, DetailedSummary}`. `StatusCode` `"000"` is success. HTTP 401 with
  `StatusCode` `106` means credential headers were missing.
- Authentication is a secret partner API key in a request header, issued by PayMate after commercial
  onboarding and KYC. **The header name is not published.** The legacy India API instead uses four headers
  (MerchantIdentification, TerminalIdentification, XpressID, Email) plus AES-256 payload encryption, and
  requires the calling domain or IP to be whitelisted.
- Every operation requires a partner-generated unique `RequestID`. Payment and collection creation also take
  a client `OrderID`; a repeat submission is rejected with `413 OrderId already processed`. That duplicate
  guard is the platform's only idempotency mechanism — there is no `Idempotency-Key` header, no replay
  semantics and no retention window.

## What PayMate does NOT publish

An agent should know these gaps before planning against PayMate:

- No OpenAPI, AsyncAPI, GraphQL schema, gRPC/protobuf or WSDL contract.
- No MCP server and no A2A agent card. `/mcp` returns 404 on every host; every `/.well-known/` path returns
  404 on every host.
- No SDK, no CLI, no Postman collection and no code samples in any language.
- No webhooks, callbacks or event stream. Payment and collection status must be polled.
- No refund, void, cancel, reverse or restore operation. **Every write on this platform is irreversible
  through the API**, including DeleteBusiness, DeleteContact and DeleteCard.
- No rate-limit headers, no documented 429, no Retry-After. Volume ceilings are commercial monthly caps.
- No status page, no SLA, no changelog, no deprecation or sunset policy.
- No test cards, test accounts, magic values or self-service sandbox. The development environment requires a
  paid plan, and the India UAT host does not answer without IP/domain whitelisting.
- No security.txt, no vulnerability disclosure policy, no bug bounty and no trust centre.

## Independent artifacts (API Evangelist)

These are produced by API Evangelist, not by PayMate:

- OpenAPI 3.1.0 generated from PayMate's own endpoint dataset: `openapi/paymate-global-partner-api-openapi.yml`
- Verbatim regional datasets: `openapi/_source/`
- Error catalogs: `errors/paymate-error-codes.yml` (508 codes), `errors/paymate-india-problem-types.yml` (58)
- Conventions and reversibility: `conventions/paymate-conventions.yml`
- Authentication profile: `authentication/paymate-authentication.yml`
- Data model: `data-model/paymate-data-model.yml`
- Plans and fee schedule: `plans/paymate-plans-pricing.yml`
- Rate limits: `rate-limits/paymate-rate-limits.yml`
- Conformance and compliance: `conformance/paymate-conformance.yml`
- Lifecycle: `lifecycle/paymate-lifecycle.yml`
- Agent skills: `skills/`