Introduction
The Partner API lets a Master Account manage merchants, gateway settings, receiving accounts, payment routing, and read transactions — programmatically, over HTTPS.
The Partner API (BOAPI) is an API-only surface for partner Master Accounts. It gives you programmatic access to the backoffice tasks you would otherwise perform by hand: onboarding merchants, configuring their EFT gateway settings, managing receiving accounts and payment routing, and querying transactions and FNB Smart Blocked activity.
There is no UI. Every capability is an HTTPS endpoint, authenticated with a bearer token bound to your Master Account.
What you can do
| Area | Capability |
|---|---|
| Merchants | Create merchant profiles (they land pending until Ops activates), list them, read one, update profile fields, and suspend/reactivate. |
| Gateway settings | Read a merchant's EFT gateway settings with their types and validation rules; update the writable ones, or copy them from a sibling merchant. |
| Receiving accounts | List, add, update and remove a merchant's receiving (settlement) accounts. |
| Payment routing | Set, per bank, which receiving account funds settle into, with an optional failover. |
| Transactions | Query EFT transactions across your merchants. |
| FNB Smart Blocked | List Smart Blocked transactions and read bucketed statistics. |
Principles
A few conventions hold across every endpoint. Learn them once and the whole API is predictable.
- One credential, one tenant. Your bearer token identifies a single Master Account. Every merchant-scoped call is constrained to the merchants that belong to it. See Authentication.
- Out of scope is
404, never403. Asking for a merchant that belongs to someone else returns the same "not found" as one that never existed. The API never confirms the existence of records you cannot see. - All-lowercase JSON. Every field name on the wire is lowercase (
businessname,merchantid,copy_settings_from). Unknown fields you send are ignored rather than rejected, so additive changes on your side never break. Numbers are strict — a quoted number ("100"where a number is expected) is rejected. - One error shape. Every failure, at every status code, returns the same error envelope. You write one error handler.
- Pending by default. A merchant you create can never process payments until Ops reviews and activates it. You cannot activate it yourself. See Merchant onboarding.
Where to start
- Getting Started — base URLs, your token, and your first call.
- Authentication — how the bearer token works and how to keep it safe.
- Merchant onboarding — the create-to-active lifecycle.
- API Reference — every endpoint with request/response schemas and a try-it panel.