openapi: 3.2.0
info:
  title: PayMate Global Partner Cards API
  version: v1
  description: 'Partner-facing B2B payments API for the PayMate global platform — business (KYB) onboarding, contact onboarding, commercial-card management, vendor payments, payment collection requests and reporting.


    GENERATED, NOT PUBLISHED BY PAYMATE. PayMate does not publish an OpenAPI description. This document was generated by API Evangelist from PayMate''s OWN machine-readable endpoint dataset (MalaysiaData.json / singaporeData.json / AustraliaData.json / UaeData.json / OmanData.json / SouthAfricaData.json), which is bundled into the Partner API documentation app served at https://api.paymate.my/GlobalPartnerAPI. The verbatim datasets are kept alongside this file in openapi/_source/. Every path, method, parameter, data type, required flag, description and example here comes from that dataset; nothing was invented.


    Regional deployments run the same v1 surface on six hosts. In Australia and South Africa the platform is branded DuNoMo. Each operation carries x-regions listing the regional datasets that declare it — POST /v1/VendorPayment is declared only in the Australian dataset.'
  contact:
    name: PayMate partner support
    url: https://api.paymate.my/GlobalPartnerAPI
    email: support@paymate.my
  x-generated-by: API Evangelist enrichment pipeline
  x-generated-on: '2026-08-26'
  x-source: https://api.paymate.my/GlobalPartnerAPI/static/js/main.d40c1507.js
servers:
- url: https://api.paymate.sg
  description: Singapore
- url: https://api.paymate.my
  description: Malaysia
- url: https://api.paymate.ae
  description: United Arab Emirates
- url: https://api.paymate.om
  description: Oman
- url: https://api.dunomo.au
  description: Australia (DuNoMo brand)
- url: https://api.dunomo.co.za
  description: South Africa (DuNoMo brand)
security:
- PartnerApiKey: []
tags:
- name: Cards
  description: Commercial credit card enrolment and management
paths:
  /v1/AddCard:
    post:
      operationId: AddCard
      summary: Add Card
      description: Businesses can tokenize their credit cards for secure transactions through Paymate Tokenize Card API. Only PCI certified customer can use this api
      tags:
      - Cards
      x-regions:
      - ae
      - au
      - my
      - om
      - sg
      - za
      responses:
        '200':
          description: PayMate response envelope. Business outcome is carried in StatusCode; see errors/paymate-error-codes.yml.
          content:
            application/json:
              schema:
                type: object
                properties:
                  RequestID:
                    type: string
                    maxLength: 30
                    description: Sent during request
                  StatusCode:
                    type: string
                    maxLength: 3
                    description: Status of the Request
                  Description:
                    type: string
                    maxLength: 300
                    description: Status Description
                  DetailedSummary:
                    type: object
                    description: This will be used to show Contact status and respond. Refer DetailedSummary Object
                    properties:
                      BusinessCode:
                        type: string
                        maxLength: 30
                        description: Business unique reference no. on partner system.
                      BusinessXpressID:
                        type: string
                        maxLength: 15
                        description: Business Unique Relationship no which was issued at the time of boarding.
                      CardReferenceNo:
                        type: string
                        maxLength: 20
                        description: PayMate Reference number
                      Status:
                        type: string
                        maxLength: 20
                        description: Current status of the Card
                      Message:
                        type: string
                        maxLength: 500
                        description: Status description
                      FomData:
                        type: string
                        x-declared-type: AN
                        description: Form data
              example:
                RequestID: '1234567899876'
                StatusCode: '000'
                Description: Your request has been processed successfully
                DetailedSummary:
                - BusinessXpressID: TDS0223444
                  CardReferenceNo: CR0000001
                  CardNo: '4149011500000527'
                  Status: '716'
                  Message: Token creation in process
                  FormData: <!DOCTYPE html><html><head><title>3D Secure</title></head><body><form id='pageform' action='https://checkoutshoppertest.adyen.com/checkoutshopper/threeDS2.shtml?pspReference=M9MWKVFX77TG5S82' method='post'><input type='hidden' name='MD' value='GPFC74CE741659E6B5'><input type='hidden' name='PaReq' value='BQABAgBD02VwOvs1PHQ7EJNbcgu4pqKVw_fFtuHhB5Mt5kmuGoD4rObq3W8tZIDiptSIG3ZkuBzNXxdwPtSvTHmhz'><input type='hidden' name='TermUrl' value='https://checkoutshoppertest.adyen.com/checkoutshopper/threeDS/return/TUQ9R1BGQzc0Q0U3NDE2NTlFNkI1JmdwaWQ9R1BGQzc0Q0U3NDE2NTlFNkI1JmludGVncmF0aW9uPWFwaV9hdXRoJnBzcFJlZmVyZW5jZT1NOU1XS1ZGWDc3VEc1UzgyJnNpZz1ta1pwNnJQWkxiYmNaZnNqZVc2UEpXV1lGOUZELUhOempORWNpTTd0LXNZ'></form><script>window.onload=function(){document.getElementById('pageform').submit()}</script></body></html>
        '401':
          description: Empty/invalid header credentials (StatusCode 106), observed on an unauthenticated probe.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                RequestID:
                  type: string
                  maxLength: 50
                  description: A unique RequestID for identifying the request.
                BusinessCode:
                  type: string
                  maxLength: 30
                  description: Business unique reference no. on partner system. Parameter is mandatory if business is not sending issued BusinessXpressID
                BusinessXpressID:
                  type: string
                  maxLength: 15
                  description: Business Unique Relationship no issued by PayMate. Parameter is mandatory if business is not sending registered BusinessCode
                CardNumber:
                  type: string
                  pattern: ^[0-9]+$
                  maxLength: 20
                  description: 'Credit/Debit Card: 16 digit card number'
                ExpiryMonth:
                  type: string
                  pattern: ^[0-9]+$
                  maxLength: 2
                  description: Expiry moth of the card
                ExpiryYear:
                  type: string
                  pattern: ^[0-9]+$
                  maxLength: 4
                  description: Card Expiry year
                CVV:
                  type: string
                  pattern: ^[0-9]+$
                  maxLength: 3
                  description: Card verification value
                Network:
                  type: string
                  maxLength: 15
                  description: Network
                  x-possible-values: '[''VISA'', ''MASTERCARD'', ''AMEX'']'
                CardHolderName:
                  type: string
                  maxLength: 50
                  description: Name on Card
                IssuingBank:
                  type: string
                  maxLength: 100
                  description: Name of the card issuer. If CardOrderId is passed then this is optional else required
                IssuingCountryCode:
                  type: string
                  maxLength: 3
                  description: 3 digit country iso code
                CardType:
                  type: string
                  maxLength: 20
                  description: Card Type
                  x-possible-values: '[''CreditCard'', ''DebitCard'']'
                ReturnURL:
                  type: string
                  maxLength: 200
                  description: URL to be redirected after the card addition is completed
              required:
              - RequestID
              - CardNumber
              - ExpiryMonth
              - ExpiryYear
              - CVV
              - Network
              - CardHolderName
              - IssuingBank
              - CardType
              - ReturnURL
            example:
              RequestID: '123456789'
              BusinessCode: ARFC1223
              BusinessXpressID: ''
              CardNumber: 4149XXXXXXXX0527
              CardHolderName: JohnDoe
              ExpiryMonth: XX
              ExpiryYear: XXXX
              CVV: XXX
              Network: VISA
              IssuingBank: affin bank
              IssuingCountryCode: MYS
              CardType: CreditCard
              ReturnURL: ''
  /v1/managecard:
    post:
      operationId: ManageCards
      summary: Manage Cards
      description: Customer can get the card details by using this method
      tags:
      - Cards
      x-regions:
      - ae
      - au
      - my
      - om
      - sg
      - za
      responses:
        '200':
          description: PayMate response envelope. Business outcome is carried in StatusCode; see errors/paymate-error-codes.yml.
          content:
            application/json:
              schema:
                type: object
                properties:
                  RequestID:
                    type: string
                    maxLength: 30
                    description: Sent during request
                  StatusCode:
                    type: string
                    maxLength: 3
                    description: Status of the Request
                  Description:
                    type: string
                    maxLength: 300
                    description: Status Description
                  DetailedSummary:
                    type: object
                    description: Card details summary will come under DetailedSummary Object
                    properties:
                      CardReferenceNo:
                        type: string
                        maxLength: 50
                        description: Card unique key
                      CardDetails:
                        type: string
                        maxLength: 30
                        description: Card hashed details
                      Status:
                        type: string
                        maxLength: 3
                        description: Card Status code
                      Message:
                        type: string
                        maxLength: 500
                        description: Status description
              example:
                RequestID: '123456789'
                StatusCode: '000'
                Description: Card fetch successfully
                DetailedSummary:
                - CardReferenceNo: ' CR000013456'
                  CardDetail: '******3567'
                  Status: ''
                  Message: ''
                - CardReferenceNo: ' CR000013457'
                  CardDetail: '******3569'
                  Status: ''
                  Message: ''
        '401':
          description: Empty/invalid header credentials (StatusCode 106), observed on an unauthenticated probe.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                RequestID:
                  type: string
                  maxLength: 50
                  description: A unique RequestID for identifying the request.
                BusinessCode:
                  type: string
                  maxLength: 30
                  description: Business unique reference no. on partner system. Parameter is mandatory if business is not sending issued BusinessXpressID
                BusinessXpressID:
                  type: string
                  maxLength: 15
                  description: Business Unique Relationship no issued by PayMate. Parameter is mandatory if business is not sending registered BusinessCode
              required:
              - RequestID
            example:
              CardDetails:
                RequestID: '54652165245215'
                BusinessCode: ''
                BusinessXpressID: ''
  /v1/Deletecard:
    post:
      operationId: DeleteCard
      summary: Delete Card
      description: Contact can delete their registered card by delete card method
      tags:
      - Cards
      x-regions:
      - ae
      - au
      - my
      - om
      - sg
      - za
      responses:
        '200':
          description: PayMate response envelope. Business outcome is carried in StatusCode; see errors/paymate-error-codes.yml.
          content:
            application/json:
              schema:
                type: object
                properties:
                  RequestID:
                    type: string
                    maxLength: 30
                    description: Sent during request
                  StatusCode:
                    type: string
                    maxLength: 3
                    description: Status of the Request
                  Description:
                    type: string
                    maxLength: 300
                    description: Status Description
                  DetailedSummary:
                    type: object
                    description: Card details summary will come under DetailedSummary Object
                    properties:
                      CardReferenceNo:
                        type: string
                        maxLength: 50
                        description: Card unique key
                      Status:
                        type: string
                        maxLength: 3
                        description: Card Status code
                      Message:
                        type: string
                        maxLength: 500
                        description: Status description
              example:
                RequestID: '123456789'
                StatusCode: '000'
                Description: Card deleted successfully
                DetailedSummary:
                - CardReferenceNo: ' CR000013456'
                  Status: '000'
                  Message: Success
        '401':
          description: Empty/invalid header credentials (StatusCode 106), observed on an unauthenticated probe.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorEnvelope'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                RequestID:
                  type: string
                  maxLength: 50
                  description: A unique RequestID for identifying the request.
                ReferenceCode:
                  type: string
                  maxLength: 30
                  description: Contact unique reference no. on partner system.
                CardReferenceNo:
                  type: string
                  maxLength: 50
                  description: Card unique key
                Remarks:
                  type: string
                  maxLength: 500
                  description: Reason for card deletion
              required:
              - RequestID
              - ReferenceCode
              - CardReferenceNo
              - Remarks
            example:
              CardDetails:
                RequestID: '54652165245215'
                BusinessCode: '12345'
                BusinessXpressID: ''
                CardReferenceNo: ' CR000013456'
                Remarks: ' Card Expired'
components:
  schemas:
    ErrorEnvelope:
      type: object
      description: Standard PayMate response envelope. Observed verbatim on a live unauthenticated probe of POST https://api.paymate.my/v1/Countrylist on 2026-08-26.
      properties:
        RequestID:
          type:
          - string
          - 'null'
          description: Echo of the partner-supplied request identifier
        StatusCode:
          type: string
          maxLength: 3
          description: PayMate status/error code — see errors/paymate-error-codes.yml (508 codes)
        Description:
          type: string
          description: Human-readable status description
        DetailedSummary:
          type:
          - object
          - array
          description: Operation payload; empty on error
      example:
        RequestID: null
        StatusCode: '106'
        Description: Empty/Invalid header credentials
        DetailedSummary: {}
  securitySchemes:
    PartnerApiKey:
      type: apiKey
      in: header
      name: Authorization
      description: PayMate issues a secret partner API key after onboarding (write to the regional support address, e.g. support@paymate.my). The exact header name is NOT published in the documentation app; an unauthenticated POST to /v1/Countrylist returns StatusCode 106 "Empty/Invalid header credentials", confirming header-carried credentials. Treat this scheme name/location as UNVERIFIED and confirm with PayMate before use.
      x-verified: false