![](\"https://zuato.com/Zuato.png\")
\n\nZuato Financial Services is a UAE-based FinTech company specializing in payment acquiring solutions for businesses of all sizes. We partner with leading banks and global payment schemes to deliver reliable, fast, and secure payment processing.
\nOur mission is simple: make accepting payments effortless, flexible, and accessible for every merchant across the region.
\nFrom Mini-POS machines to SoftPOS apps, payment links, QR codes, and recurring payment solutions, Zuato offers a complete suite of acquiring tools. With a single integration, you unlock access to multiple banks, payment networks, and digital wallets — no complexity, no delays, just seamless transactions.
\nThis Postman collection is organized into 8 categories covering everything you need to integrate with the Zuato Payment Gateway:
\nhttps://payments.zuato.com\n\nAll API requests require two custom headers:
\nX-ACCESS-KEY: ak_live_xxxxxxxxx\nX-SECRET-KEY: sk_live_xxxxxxxxx\nContent-Type: application/json\n\nEmail: support@zuato.com
\nSecurity: Never expose your Secret Key in client-side code
\nVersion: v101.0
\nLast Updated: January 2026
\nConfidential — For Integration Partners Only © 2024 Zuato Financial Services. All rights reserved.
\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"53730376","collectionId":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","publishedId":"2sBXwsKpBi","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"fff","highlight":"1a4c49"},"publishDate":"2026-06-10T17:49:17.000Z"},"item":[{"name":"1. Gateway Integration","item":[{"name":"Create Payment Link","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":["// Auto-generate a unique order ID if not set","// This prevents duplicate order ID rejections (HTTP 409)","const timestamp = Date.now();","const randomSuffix = Math.random().toString(36).substring(2, 7).toUpperCase();","const uniqueOrderId = `ORD-${timestamp}-${randomSuffix}`;","","// Only auto-generate if the variable is using the placeholder","if (!pm.collectionVariables.get('merchant_order_ref') || "," pm.collectionVariables.get('merchant_order_ref') === 'ORD-13001') {"," pm.collectionVariables.set('merchant_order_ref', uniqueOrderId);"," console.log('Auto-generated unique order reference:', uniqueOrderId);","}","","console.log('Pre-request: Using merchant_order_ref =', pm.collectionVariables.get('merchant_order_ref'));","console.log('Pre-request: Sending to', pm.collectionVariables.get('base_url') + '/api/payment-links/create/');"],"id":"896cbaf3-0478-4a7e-9483-c446a306a06c"}},{"listen":"test","script":{"type":"text/javascript","exec":["// ─── STATUS CODE VALIDATION ───","pm.test('Status code is 200 OK', function () {"," pm.response.to.have.status(200);","});","","// ─── RESPONSE TIME ───","pm.test('Response time is under 5000ms', function () {"," pm.expect(pm.response.responseTime).to.be.below(5000);","});","","// ─── CONTENT TYPE ───","pm.test('Content-Type is application/json', function () {"," pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json');","});","","// ─── PARSE RESPONSE ───","let jsonResponse;","pm.test('Response body is valid JSON', function () {"," jsonResponse = pm.response.json();"," pm.expect(jsonResponse).to.be.an('object');","});","","if (jsonResponse) {"," // ─── SUCCESS FLAG ───"," pm.test('Response contains success: true', function () {"," pm.expect(jsonResponse).to.have.property('success');"," pm.expect(jsonResponse.success).to.be.true;"," });",""," // ─── ORDER OBJECT ───"," pm.test('Response contains order object', function () {"," pm.expect(jsonResponse).to.have.property('order');"," pm.expect(jsonResponse.order).to.be.an('object');"," });",""," // ─── ORDER ID ───"," pm.test('Order ID is present and is a string', function () {"," pm.expect(jsonResponse.order).to.have.property('id');"," pm.expect(jsonResponse.order.id).to.be.a('string');"," pm.expect(jsonResponse.order.id).to.not.be.empty;"," });",""," // ─── ORDER STATUS ───"," pm.test('Order status is CREATED', function () {"," pm.expect(jsonResponse.order.status).to.equal('CREATED');"," });",""," // ─── CHECKOUT URL ───"," pm.test('checkoutUrl is present and is a valid URL', function () {"," pm.expect(jsonResponse).to.have.property('checkoutUrl');"," pm.expect(jsonResponse.checkoutUrl).to.be.a('string');"," pm.expect(jsonResponse.checkoutUrl).to.include('https://');"," });",""," // ─── SAVE ORDER ID FOR SUBSEQUENT REQUESTS ───"," if (jsonResponse.order && jsonResponse.order.id) {"," pm.collectionVariables.set('order_id', jsonResponse.order.id);"," console.log('✅ Saved order_id to collection variable:', jsonResponse.order.id);"," console.log('✅ checkoutUrl:', jsonResponse.checkoutUrl);"," console.log('ℹ️ Redirect your customer to the checkoutUrl above.');"," console.log('ℹ️ After payment, call GET /api/orders/details/{order_id}/ to verify.');"," }","}","","// ─── AMOUNT VALIDATION ───","pm.test('Order amount matches request', function () {"," if (jsonResponse && jsonResponse.order) {"," pm.expect(jsonResponse.order.amount).to.equal(250);"," }","});","","// ─── CURRENCY VALIDATION ───","pm.test('Order currency is AED', function () {"," if (jsonResponse && jsonResponse.order) {"," pm.expect(jsonResponse.order.currency).to.equal('AED');"," }","});"],"id":"2b70bf06-41f7-4657-aeaf-6413f585ab55"}}],"id":"de7009a2-1a74-406f-b252-7e55b2c92f22","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"X-ACCESS-KEY","value":"ak_live_xxxxxxxxx","description":"Your production Access Key from the Zuato dashboard. Prefixed with ak_live_. Required on every request.
\n","type":"text"},{"key":"X-SECRET-KEY","value":"sk_live_xxxxxxxxx","description":"Your production Secret Key from the Zuato dashboard. Prefixed with sk_live_. Keep this confidential — never expose in client-side code. Required on every request.
\n","type":"text"},{"key":"Content-Type","value":"application/json","description":"Must always be set to application/json for all Zuato API requests.
\n","type":"text"}],"body":{"mode":"raw","raw":"{\n \"order\": {\n \"id\": \"ORD-13001\",\n \"amount\": 250,\n \"currency\": \"AED\"\n },\n \"customer\": {\n \"firstName\": \"John\",\n \"lastName\": \"Doe\",\n \"email\": \"john@example.com\",\n \"phone\": \"+971501234567\"\n },\n \"returnUrl\": \"https://payments.zuato.com/payment/returnHome/\",\n \"returnSuccUrl\": \"https://yoursite.com/payment/success/\",\n \"returnErrorUrl\": \"https://yoursite.com/payment/failed/\"\n}","options":{"raw":{"language":"json"}}},"url":"https://payments.zuato.com/api/payment-links/create/","description":"Creates a new payment order and returns a hosted checkout URL. Share this URL with your customer or redirect them to it to complete payment on Zuato's secure, PCI DSS certified checkout page.
\nPOST https://payments.zuato.com/api/payment-links/create/\n\n{\n \"success\": true,\n \"order\": {\n \"id\": \"ord_abcd1234\",\n \"amount\": 250,\n \"currency\": \"AED\",\n \"status\": \"CREATED\"\n },\n \"checkoutUrl\": \"https://payments.zuato.com/payment/process/ord_abcd1234/\"\n}\n\nRedirect your customer to the checkoutUrl
Customer completes payment on Zuato's hosted checkout
\nCustomer is redirected to your returnSuccUrl (success) or returnErrorUrl (failure)
Immediately call GET /api/orders/details/{order_id}/ server-side to verify the payment status
Only fulfil the order when status is paid
The order.id (your merchant reference) must be unique per transaction
The returnUrl must always be https://payments.zuato.com/payment/returnHome/ — do not modify
Never fulfil an order based solely on the client-side redirect — always verify server-side
\nThe test script in this request auto-saves the returned order_id to the collection variable for use in the Get Order Details request
Your production Access Key. Required on every request.
\n","type":"text"},{"key":"X-SECRET-KEY","value":"sk_live_xxxxxxxxx","description":"Your production Secret Key. Required on every request. Keep confidential.
\n","type":"text"},{"key":"Content-Type","value":"application/json","description":"Must be application/json for all Zuato API requests.
\n","type":"text"}],"url":"https://payments.zuato.com/api/orders/details/ord_abcd1234/","description":"Retrieve the complete payment and order details for a given order ID. This endpoint should always be called server-side after the customer returns from the hosted checkout to verify the payment status before fulfilling the order.
\n⚠️ Critical: Never rely solely on the client-side redirect to confirm payment. Server-side verification is mandatory.
\nGET https://payments.zuato.com/api/orders/details/{order_id}/\n{\n \"success\": true,\n \"data\": {\n \"order_id\": \"ord_abcd1234\",\n \"order_no\": \"ORD-13001\",\n \"amount\": 250,\n \"status\": \"paid\",\n \"customer\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\",\n \"phone\": \"+971501234567\"\n },\n \"created_at\": \"2024-01-15T10:30:00Z\"\n }\n}\nThe order_id collection variable is automatically populated when you run the Create Payment Link request. If you are calling this endpoint independently, replace ord_abcd1234 with a valid Zuato order ID in the format ord_xxxx.
The Zuato Payment Gateway API enables merchants to programmatically create payment links, redirect customers to a secure hosted checkout, and retrieve order details to verify payment status. All communication is over HTTPS using JSON.
\nOur Hosted Payment Pages handle the entire card capture and payment process on Zuato's PCI DSS certified infrastructure.
\nKey Features:
\nResponsive layout optimized for mobile devices
\nEasy customization using CSS
\nOption to save cards for returning customers
\nSupports Google Analytics tracking
\nNo PCI DSS certification required on your end
\nCreate simple one-click payment links for single products or events.
\nSpecify availability dates and stock control
\nPublishable on website, email, social media, or as QR codes
\nProcess payments from mobile applications via the Hosted Payment Page API interface.
\nDirect server-to-server transaction processing.
\nPCI certification required for card capture
\n3D Secure (MPI) integration required
\nRefunds, voids, and recurring transaction management available without PCI certification
\n\n\nNote: Remote API is not enabled by default. Contact support@zuato.com to request access.
\n
[1] Get API Keys → [2] Create Payment Link → [3] Customer Pays → [4] Verify Order\n\nStep 1: Obtain your Access Key and Secret Key from https://payments.zuato.com/api-reference/
\nStep 2: POST order and customer data to /api/payment-links/create/ to generate a hosted checkout URL
Step 3: Redirect the customer to the checkoutUrl returned in the response
Step 4: After the customer returns, call GET /api/orders/details/{order_id}/ server-side to verify payment status
https://payments.zuato.com\n\n{\n \"X-ACCESS-KEY\": \"ak_live_xxxxxxxxx\",\n \"X-SECRET-KEY\": \"sk_live_xxxxxxxxx\",\n \"Content-Type\": \"application/json\"\n}\n\nAlways verify server-side. Never rely on client-side redirects to confirm payment. Call the order details endpoint from your backend.
\nUse unique order IDs. Generate a unique order.id for every request — duplicates are rejected with HTTP 409.
Do not modify returnUrl. Must always be https://payments.zuato.com/payment/returnHome/
Handle all statuses. Implement logic for paid, pending, and failed.
Secure your credentials. Store in environment variables or a secrets manager. Never commit to version control.
\nUse HTTPS. All returnSuccUrl and returnErrorUrl values must use HTTPS.
Implement idempotency. Check if an order already exists before creating a duplicate on network timeout.
\nSandbox Access Key. Prefixed with ak_test_. Provided by Zuato upon sandbox account creation.
\n","type":"text"},{"key":"X-SECRET-KEY","value":"sk_test_xxxxxxxxx","description":"Sandbox Secret Key. Prefixed with sk_test_. Keep confidential even in test environments.
\n","type":"text"},{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\n \"order\": {\n \"id\": \"{{sandbox_merchant_order_ref}}\",\n \"amount\": 100,\n \"currency\": \"AED\"\n },\n \"customer\": {\n \"firstName\": \"Test\",\n \"lastName\": \"User\",\n \"email\": \"testuser@sandbox.com\",\n \"phone\": \"+971509999999\"\n },\n \"returnUrl\": \"https://payments.zuato.com/payment/returnHome/\",\n \"returnSuccUrl\": \"https://yoursite.com/sandbox/success/\",\n \"returnErrorUrl\": \"https://yoursite.com/sandbox/failed/\"\n}","options":{"raw":{"language":"json"}}},"url":"https://sandbox.payments.zuato.com/api/payment-links/create/","description":"Test the payment link creation flow in the sandbox environment using test credentials and test card numbers. No real money is charged.
\nsandbox_access_key and sandbox_secret_key set in collection variablescheckoutUrl from the responsesandbox_order_id variable is automatically saved for use in the Get Order Details sandbox requestSandbox Access Key.
\n","type":"text"},{"key":"X-SECRET-KEY","value":"sk_test_xxxxxxxxx","description":"Sandbox Secret Key.
\n","type":"text"},{"key":"Content-Type","value":"application/json","type":"text"}],"url":"https://sandbox.payments.zuato.com/api/orders/details/{{sandbox_order_id}}/","description":"Retrieve order details in the sandbox environment. Use this after completing a test payment on the sandbox checkout to verify your status handling logic.
\nsandbox_order_id)paidfailedpending or CREATEDThe Zuato Sandbox environment is an isolated test environment that mirrors production functionality without processing real money. Use the sandbox to:
\nSandbox credentials are not automatically provisioned. To request access:
\nThe Zuato technical team will provision your sandbox account and send credentials within 1–2 business days.
\nSet your sandbox keys in the collection variables:
\nsandbox_access_key → your ak_test_ keysandbox_secret_key → your sk_test_ keyAll requests in this folder use the https://sandbox.payments.zuato.com variable so you can switch environments without changing individual requests.
Your production Access Key.
\n","type":"text"},{"key":"X-SECRET-KEY","value":"sk_live_xxxxxxxxx","description":"Your production Secret Key.
\n","type":"text"},{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\n \"order\": {\n \"id\": \"ORD-13001\",\n \"amount\": 350,\n \"currency\": \"AED\"\n },\n \"customer\": {\n \"firstName\": \"Ahmed\",\n \"lastName\": \"Al Rashid\",\n \"email\": \"ahmed@example.ae\",\n \"phone\": \"+971501234567\"\n },\n \"returnUrl\": \"https://payments.zuato.com/payment/returnHome/\",\n \"returnSuccUrl\": \"https://yoursite.com/payment/success/\",\n \"returnErrorUrl\": \"https://yoursite.com/payment/failed/\"\n}","options":{"raw":{"language":"json"}}},"url":"https://payments.zuato.com/api/payment-links/create/","description":"This request is identical to the standard Create Payment Link request. No additional parameters are needed to enable wallet payments.
\nWhen the customer opens the checkoutUrl returned in this response, Zuato's hosted checkout automatically detects the customer's device and browser and presents all applicable wallet options alongside standard card payment.
None beyond sending this standard payment link request. All wallet handling, authentication, and processing is managed by Zuato's platform.
\nRegardless of whether the customer paid via wallet or card, the order verification flow is identical:
\nGET /api/orders/details/{order_id}/\nThe response data.status will reflect paid, pending, or failed for all payment methods.
Zuato supports all major digital wallets out of the box. When you integrate using the standard payment link flow (Create Payment Link endpoint), wallet options are automatically presented to the customer on the hosted checkout page — no separate integration is required for each wallet.
\nWith a single cURL request to /api/payment-links/create/, your customers will automatically see all supported wallet options on the checkout page. Our system handles the entire wallet interaction, authentication, and payment processing on your behalf.
You do not need to:
\nRegister separately with each wallet provider
\nWrite separate integration code per wallet
\nHandle wallet authentication or tokens
\nManage wallet-specific SDKs
\nWe handle everything for you.
\n[1] You call POST /api/payment-links/create/\n ↓\n[2] Zuato generates a hosted checkout URL\n ↓\n[3] Customer opens the checkoutUrl\n ↓\n[4] Checkout detects device capabilities and displays:\n → Apple Pay (Safari/iOS)\n → Google Pay (Chrome/Android)\n → Samsung Pay (Samsung devices)\n → BOTIM Wallet\n → PayBy Wallet\n → Alipay\n → Standard card payment\n ↓\n[5] Customer selects their preferred wallet and authenticates\n ↓\n[6] Zuato processes the transaction and updates order status\n ↓\n[7] Customer redirected to your returnSuccUrl or returnErrorUrl\n ↓\n[8] You verify via GET /api/orders/details/{order_id}/\n\nCustomer must be on an Apple device with Safari
\nApple Pay must be set up with at least one card on the device
\nYour returnSuccUrl domain must use HTTPS
No additional merchant registration required when using Zuato's hosted checkout
\nCustomer must be on Android or Chrome browser
\nA Google account with a saved payment method
\nAutomatically rendered on compatible devices
\nSamsung device with Samsung Pay configured
\nSupports NFC and MST (Magnetic Secure Transmission)
\nCustomer must have the BOTIM app installed and wallet funded
\nAvailable primarily in the UAE
\nCustomer must have the PayBy app installed
\nAccount must be verified and funded
\nAvailable in the UAE
\nCustomer must have the Alipay app
\nPrimarily used by Chinese nationals and tourists in the UAE
\nQR-code based flow on the checkout page
\nThe wallet payment request below uses the exact same endpoint as a standard card payment. The only difference is that the customer selects a wallet on the checkout page instead of entering card details. Everything else is handled by Zuato's platform.
\n","_postman_id":"5cec995d-f1af-401e-92ea-cec50763a902","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ACCESS-KEY"},{"key":"value","value":"ak_live_xxxxxxxxx"}]},"isInherited":true,"source":{"_postman_id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","name":"Zuato's API Integration Reference","type":"collection"}}},{"name":"4. Website Checklist","item":[{"name":"Website Compliance Check (Informational)","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":["// This is an informational request — it does not call a live API endpoint.","// It serves as a structured checklist reference within the collection.","console.log('📋 ZUATO WEBSITE COMPLIANCE CHECKLIST');","console.log('=====================================');","console.log('');","console.log('✅ GENERAL CONTENT');","console.log(' □ Business activity matches licensed activity');","console.log(' □ URL matches Zuato application URL');","console.log(' □ No prohibited products/services');","console.log(' □ Product descriptions + pricing + currency displayed');","console.log(' □ Visa/Mastercard logos on homepage');","console.log('');","console.log('✅ REQUIRED PAGES');","console.log(' □ About Us — business nature described');","console.log(' □ Terms & Conditions — UAE domicile, OFAC, minors, cards');","console.log(' □ Privacy Policy — data protection, no third-party sharing');","console.log(' □ Delivery Policy — shipping, fees, timelines (physical goods)');","console.log(' □ Payment Confirmation — how customer is notified (services)');","console.log(' □ Refund Policy — 10-45 day timeline, scenarios covered');","console.log(' □ Cancellation Policy — conditions and timeframes');","console.log(' □ Contact Us — name, email, phone, PO Box, address, UAE');","console.log('');","console.log('📧 Questions? Contact support@zuato.com');"],"id":"f0e5804b-4eb7-4298-9000-4a8b6f7688ca"}},{"listen":"test","script":{"type":"text/javascript","exec":["// This request is informational — it targets a placeholder URL.","// Check the Postman console (View > Console) to see the full checklist output.","pm.test('Website checklist reference loaded', function () {"," console.log('✅ Checklist displayed in Postman console.');"," console.log('ℹ️ This is an informational folder — no live API is called.');"," console.log('ℹ️ Review the folder description for the full compliance checklist.');"," pm.expect(true).to.be.true;","});"],"id":"bb5ef109-721c-4d44-8f94-a9761a953fa6"}}],"id":"df3b6c45-a2d9-4fc5-877a-2a6c21515660","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"https://zuato.com","description":"This request is informational only and does not call a Zuato payment API endpoint.
\nIt exists within the collection as a structured reference to the card scheme website compliance requirements that all merchants must meet before going live.
\nEmail support@zuato.com for compliance guidance.
\n","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ACCESS-KEY"},{"key":"value","value":"ak_live_xxxxxxxxx"}]},"isInherited":true,"source":{"_postman_id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","name":"Zuato's API Integration Reference","type":"collection"}},"urlObject":{"protocol":"https","host":["zuato","com"],"query":[],"variable":[]}},"response":[],"_postman_id":"df3b6c45-a2d9-4fc5-877a-2a6c21515660"}],"id":"64f3c040-c918-43c7-bbeb-3043b2aaff32","description":"\n\n⚠️ Please ensure your website meets ALL requirements listed below as per credit card scheme regulations (Visa, Mastercard).
\n
Website content requirements provide a smooth shopping experience for consumers and minimise cardholder disputes and chargebacks. Non-compliance may result in your merchant account being suspended or terminated.
\nWebsite content reflects your licensed business activity
\nWebsite URL matches the one provided in your Zuato application — no other URL permitted
\nWebsite does not contain prohibited products or services
\nWebsite displays item/product/service descriptions, pricing, and transaction currency
\nWebsite displays accepted card logos (Visa, Mastercard, etc.) on the Home page
\nMust include:
\n\"United Arab Emirates is our country of domicile\" — with governing law stated as local UAE law
\nAccepted card types (Visa, Mastercard) and transaction currencies
\nStatement: \"We will not trade with or provide services to OFAC or sanctioned countries\"
\nMinors under 18 may not register or transact on the website
\nCardholders must retain transaction records and comply with merchant policies
\nUsers are responsible for maintaining the confidentiality of their accounts
\nCardholder details and personally identifiable information will not be stored, sold, shared, rented, or leased to third parties
\nMerchant will not pass card details to third parties
\nMerchant ensures data privacy and security through hardware and software measures, but cannot guarantee absolute online security
\nMerchant is not responsible for privacy policies of linked third-party websites
\nWebsite policies and T&C may be updated occasionally — customers should check frequently for updates
\nClearly describes the shipping process and conditions for items/goods
\nStates delivery fees or free delivery options
\nStates delivery times for local and international orders
\nProof of delivery receipt signed or confirmed by the registered customer must be kept
\nRefunds are issued to the original payment method within 10–45 days (depending on issuing bank)
\nClearly details return, refund, and cancellation policies
\nCovers scenarios: wrong product sent, defective product, damaged in shipping, product tampered
\nIf no refund policy exists, this must be clearly communicated BEFORE purchase
\nSpecifies the time frame and conditions for reporting cancellations or replacements
\nStates conditions under which cancellation or replacement is allowed
\nIf no cancellation policy exists, this must be clearly communicated before purchase
\nMust display ALL of the following:
\nCompany name
\nEmail address
\nPhone numbers
\nP.O. Box
\nOffice address
\nCountry: UAE
\nFailure to meet card scheme website requirements may result in:
\nIncreased chargeback ratios
\nMerchant account suspension
\nTermination of payment processing services
\nFines from card schemes (Visa/Mastercard)
\nBefore submitting your website for review, ensure:
\nAll 8 sections above are complete
\nAll policies are accessible from the website footer
\nCard logos are visible on the homepage
\nContact details are accurate and up to date
\nThe website URL matches your Zuato application exactly
\nIf you have questions about compliance requirements, contact: support@zuato.com
\n","_postman_id":"64f3c040-c918-43c7-bbeb-3043b2aaff32","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ACCESS-KEY"},{"key":"value","value":"ak_live_xxxxxxxxx"}]},"isInherited":true,"source":{"_postman_id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","name":"Zuato's API Integration Reference","type":"collection"}}},{"name":"5. Response Codes","item":[{"name":"Response Codes Reference (Informational)","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":["console.log('📊 ZUATO API RESPONSE CODES REFERENCE');","console.log('=====================================');","console.log('');","console.log('HTTP STATUS CODES:');","console.log(' 200 — OK → Request successful');","console.log(' 400 — Bad Request → Fix request parameters');","console.log(' 401 — Unauthorized → Check API keys');","console.log(' 404 — Not Found → Check order_id / refund_id');","console.log(' 409 — Conflict → Duplicate order ID or refund');","console.log(' 500 — Server Error → Retry with backoff');","console.log('');","console.log('ORDER STATUS VALUES:');","console.log(' CREATED → Link generated, customer not yet paid');","console.log(' pending → Payment processing, do not fulfil yet');","console.log(' paid → ✅ Payment confirmed, safe to fulfil');","console.log(' failed → ❌ Payment failed, prompt retry');","console.log('');","console.log('REFUND STATUS VALUES:');","console.log(' pending → Refund submitted, awaiting admin review');","console.log(' approved → ✅ Refund approved, funds being returned');","console.log(' rejected → ❌ Refund declined, check dashboard');"],"id":"55c6a1df-1d33-419f-baf4-48da7726e2d6"}},{"listen":"test","script":{"type":"text/javascript","exec":["pm.test('Response codes reference loaded', function () {"," console.log('✅ Response codes reference displayed in Postman console.');"," pm.expect(true).to.be.true;","});"],"id":"56813cc3-add3-426d-becd-bf17a2e8c9b0"}}],"id":"a121b760-327a-4a66-9e6b-8e39bd16df81","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[],"url":"https://zuato.com","description":"This request is informational only. It outputs the complete Zuato API response code and status reference to the Postman console when run.
\nAlternatively, refer to the folder description above for the full reference table.
\n","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ACCESS-KEY"},{"key":"value","value":"ak_live_xxxxxxxxx"}]},"isInherited":true,"source":{"_postman_id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","name":"Zuato's API Integration Reference","type":"collection"}},"urlObject":{"protocol":"https","host":["zuato","com"],"query":[],"variable":[]}},"response":[],"_postman_id":"a121b760-327a-4a66-9e6b-8e39bd16df81"}],"id":"1fdffec4-e280-4080-8691-5a75b15a9d32","description":"All Zuato API responses follow standard HTTP status codes combined with a JSON response body containing a success boolean and either a data object (on success) or an error message (on failure).
{\n \"success\": true,\n \"data\": { ... }\n}\n\n{\n \"success\": false,\n \"error\": \"Human-readable error message explaining what went wrong\"\n}\n\n400 errors: Do not retry — fix the request parameters first
\n401 errors: Do not retry — verify and regenerate your API keys
\n404 errors: Do not retry — verify the order_id is correct
\n409 errors: Do not retry — check if the order already exists before creating a new one
\n500 errors: Retry with exponential backoff (wait 1s, 2s, 4s between retries); contact support@zuato.com if persistent
\nThis request outputs the complete Zuato sandbox test card reference to the Postman console when run.
\nRefer to the folder description for the full formatted reference table.
\n","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ACCESS-KEY"},{"key":"value","value":"ak_live_xxxxxxxxx"}]},"isInherited":true,"source":{"_postman_id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","name":"Zuato's API Integration Reference","type":"collection"}},"urlObject":{"protocol":"https","host":["zuato","com"],"query":[],"variable":[]}},"response":[],"_postman_id":"8d1d522e-3b04-4d97-ae91-7df31da6f2e6"}],"id":"52e92a1a-0dab-4293-b11c-21ad54cdc629","description":"Use the following test card details in the sandbox environment only to simulate various payment scenarios. These cards will not work in the production environment and do not charge real money.
\nTest cards are only valid in the sandbox environment (https://sandbox.payments.zuato.com)
Never use real card numbers in the sandbox environment
\nNever use test card numbers in the production environment
\nUse any future expiry date (e.g., 12/26, 01/27)
\nUse any 3-digit CVV (e.g., 123) unless a specific CVV is listed
\nUse any name for the cardholder name field
\nUse any valid UAE or international billing address
\nRun Sandbox — Create Payment Link (Section 2) to generate a checkout URL
\nOpen the checkoutUrl in your browser
On the checkout page, select Card Payment
\nEnter the test card details:
\nCard Number: from the table above
\nExpiry Date: any future date (e.g., 12/26)
\nCVV: 123 (or as specified)
\nName: any name (e.g., Test User)
\nComplete the payment
\nRun Sandbox — Get Order Details to check the resulting status
\nContact support@zuato.com for additional test scenarios or if test cards are not behaving as expected in the sandbox environment.
\n","_postman_id":"52e92a1a-0dab-4293-b11c-21ad54cdc629","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ACCESS-KEY"},{"key":"value","value":"ak_live_xxxxxxxxx"}]},"isInherited":true,"source":{"_postman_id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","name":"Zuato's API Integration Reference","type":"collection"}}},{"name":"7. Refund / Payout API","item":[{"name":"Submit Refund Request","event":[{"listen":"prerequest","script":{"type":"text/javascript","exec":["// Pre-request validation for refund submission","const orderId = pm.collectionVariables.get('order_id');","","if (!orderId || orderId === 'ord_abcd1234') {"," console.warn('⚠️ order_id is using the placeholder value.');"," console.warn('⚠️ Before submitting a refund:');"," console.warn(' 1. Run Section 1 > Create Payment Link');"," console.warn(' 2. Complete payment on the checkoutUrl');"," console.warn(' 3. Verify status is paid via Get Order Details');"," console.warn(' 4. Then run this refund request');","} else {"," console.log('✅ Submitting refund for order_id:', orderId);"," console.log('ℹ️ Ensure the order status is paid before submitting.');"," console.log('ℹ️ Endpoint:', pm.collectionVariables.get('base_url') + '/api/refunds/create/');","}"],"id":"fc07bed6-f80a-42f0-92f7-bcee0438edd4"}},{"listen":"test","script":{"type":"text/javascript","exec":["// ─── STATUS CODE ───","pm.test('Status code is 200 OK', function () {"," pm.response.to.have.status(200);","});","","// ─── RESPONSE TIME ───","pm.test('Response time is under 5000ms', function () {"," pm.expect(pm.response.responseTime).to.be.below(5000);","});","","// ─── PARSE RESPONSE ───","let jsonResponse;","pm.test('Response body is valid JSON', function () {"," jsonResponse = pm.response.json();"," pm.expect(jsonResponse).to.be.an('object');","});","","if (jsonResponse) {"," // ─── SUCCESS FLAG ───"," pm.test('Response contains success: true', function () {"," pm.expect(jsonResponse.success).to.be.true;"," });",""," // ─── MESSAGE ───"," pm.test('Response contains a message', function () {"," pm.expect(jsonResponse).to.have.property('message');"," pm.expect(jsonResponse.message).to.be.a('string');"," });",""," // ─── DATA OBJECT ───"," pm.test('Response contains data object', function () {"," pm.expect(jsonResponse).to.have.property('data');"," pm.expect(jsonResponse.data).to.be.an('object');"," });",""," if (jsonResponse.data) {"," // ─── REFUND ID ───"," pm.test('data.refund_id is present and is a number', function () {"," pm.expect(jsonResponse.data).to.have.property('refund_id');"," pm.expect(jsonResponse.data.refund_id).to.be.a('number');"," });",""," // ─── ORDER ID ───"," pm.test('data.order_id matches the submitted order', function () {"," pm.expect(jsonResponse.data).to.have.property('order_id');"," });",""," // ─── REFUND AMOUNT ───"," pm.test('data.refund_amount is a positive number', function () {"," pm.expect(jsonResponse.data.refund_amount).to.be.a('number');"," pm.expect(jsonResponse.data.refund_amount).to.be.above(0);"," });",""," // ─── TRANSACTION AMOUNT ───"," pm.test('data.transaction_amount is present', function () {"," pm.expect(jsonResponse.data).to.have.property('transaction_amount');"," });",""," // ─── REFUND AMOUNT ≤ TRANSACTION AMOUNT ───"," pm.test('Refund amount is not greater than transaction amount', function () {"," pm.expect(jsonResponse.data.refund_amount).to.be.at.most(jsonResponse.data.transaction_amount);"," });",""," // ─── STATUS ───"," pm.test('data.status is pending', function () {"," pm.expect(jsonResponse.data.status).to.equal('pending');"," });",""," // ─── CREATED AT ───"," pm.test('data.created_at is a valid ISO 8601 timestamp', function () {"," const date = new Date(jsonResponse.data.created_at);"," pm.expect(date.toString()).to.not.equal('Invalid Date');"," });",""," // ─── LOG REFUND DETAILS ───"," console.log('✅ Refund submitted successfully');"," console.log('📋 Refund ID:', jsonResponse.data.refund_id);"," console.log('📋 Order ID:', jsonResponse.data.order_id);"," console.log('💰 Refund Amount:', jsonResponse.data.refund_amount);"," console.log('💰 Original Amount:', jsonResponse.data.transaction_amount);"," console.log('📊 Status:', jsonResponse.data.status);"," console.log('⏰ Created At:', jsonResponse.data.created_at);"," console.log('ℹ️ Refund is pending admin review. Do not resubmit.');"," console.log('ℹ️ Inform your customer that the refund is under review.');"," console.log('ℹ️ Timeline: 10-45 business days depending on issuing bank.');"," }","}"],"id":"56fe9a74-bb99-437f-afac-67abadd0857e"}}],"id":"d61c2cef-341b-464a-bc62-ae8a38656cd1","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"X-ACCESS-KEY","value":"ak_live_xxxxxxxxx","description":"Your production Access Key from the Zuato dashboard.
\n","type":"text"},{"key":"X-SECRET-KEY","value":"sk_live_xxxxxxxxx","description":"Your production Secret Key. Keep confidential — never expose in client-side code.
\n","type":"text"},{"key":"Content-Type","value":"application/json","description":"Must be application/json.
\n","type":"text"}],"body":{"mode":"raw","raw":"{\n \"order_id\": \"ord_abcd1234\",\n \"amount\": 50,\n \"description\": \"Customer requested refund for partial return — Order ORD-13001\"\n}","options":{"raw":{"language":"json"}}},"url":"https://payments.zuato.com/api/refunds/create/","description":"Submits a refund request against a successfully paid order. The refund is reviewed by the Zuato admin team before funds are returned to the customer's original payment method.
\nPOST https://payments.zuato.com/api/refunds/create/\n\nThe order must have status: paid — verify via GET /api/orders/details/{order_id}/
You must use the Zuato-generated order ID (ord_xxxx), not your merchant reference
Valid API credentials in the request headers
\n✅ Full refund: amount = original transaction amount (e.g., 250 for a 250 AED order)
✅ Partial refund: amount < original transaction amount (e.g., 50 for a partial return)
❌ Over-refund: amount > original transaction amount → returns HTTP 400
❌ Zero amount: amount = 0 → returns HTTP 400
❌ Negative amount: amount < 0 → returns HTTP 400
The refund currency is automatically inherited from the original order. You do not need to specify the currency in the refund request.
\n{\n \"success\": true,\n \"message\": \"Refund request submitted successfully\",\n \"data\": {\n \"refund_id\": 1,\n \"order_id\": \"ord_abcd1234\",\n \"refund_amount\": 50,\n \"transaction_amount\": 250,\n \"description\": \"Customer requested refund for partial return\",\n \"status\": \"pending\",\n \"created_at\": \"2024-01-15T11:00:00Z\"\n }\n}\n\n{\n \"success\": false,\n \"error\": \"Refund amount must be less than or equal to transaction amount (AED 250)\"\n}\n\nDo not resubmit — duplicate requests return HTTP 409 Conflict
\nInform the customer that their refund is under review
\nMonitor status via the Zuato admin dashboard
\nTimeline: 10–45 business days depending on the customer's issuing bank
\nStore the refund_id in your database for audit and tracking purposes
The Zuato Refund API allows merchants to programmatically submit refund requests against successfully completed transactions. Once submitted, refund requests are reviewed and processed by the Zuato admin team before funds are returned to the customer's original payment method.
\n[1] Verify order status is 'paid' via GET /api/orders/details/{order_id}/\n ↓\n[2] Submit refund via POST /api/refunds/create/\n ↓\n[3] Refund enters 'pending' status — queued for admin review\n ↓\n[4] Zuato admin team reviews the request in the admin panel\n ↓\n[5] Refund approved → funds returned to customer's original payment method\n OR Refund rejected → check dashboard for reason\nstatus: paid before a refund can be submittedord_xxxx) — not your merchant referenceamount must be > 0 and ≤ original transaction amountFor refund-related issues: support@zuato.com
\n","_postman_id":"72596dae-f07c-4631-9421-c01997fcdfad","auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-ACCESS-KEY"},{"key":"value","value":"ak_live_xxxxxxxxx"}]},"isInherited":true,"source":{"_postman_id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","id":"b2a4a16f-6b92-403b-b409-1f4a8e7350cc","name":"Zuato's API Integration Reference","type":"collection"}}},{"name":"8. E-Commerce Platforms","item":[],"id":"824a61e2-f4d0-4290-85f8-64a02203052e","description":"Zuato supports seamless integration with major e-commerce platforms. For platform-based integrations (Shopify, WooCommerce, WordPress), please email us at support@zuato.com with the details below and our team will reach out with the necessary integration files, plugins, and setup guide.
\nEmail: support@zuato.com
\nSubject: E-Commerce Platform Integration Request — [Your Platform Name]
\nInclude the required details for your platform (see below)
\nOur team will respond within 1–2 business days with:
\nPlatform-specific plugin or app files
\nStep-by-step setup guide
\nTest credentials for your sandbox environment
\nA dedicated onboarding call if required
\nFor Shopify, everything is app-based. Please provide:
\nNote: The Shopify integration is fully app-based. Once the app is installed, Zuato handles the OAuth flow and payment routing automatically.
\nFor WooCommerce, we provide a WordPress plugin. Please provide:
\nNote: After receiving your details, we will provide a .zip plugin file that you install directly in your WordPress Admin → Plugins → Add New → Upload Plugin.
For generic WordPress integrations or custom plugin/API embed setups:
\nNote: For custom WordPress integrations, our team will provide direct API credentials and documentation tailored to your setup. A developer briefing call may be arranged.
\nEmail: support@zuato.com
Subject format: E-Commerce Integration Request — [Shopify / WooCommerce / WordPress] — [Your Store Name]