OpenAPI and Postman

The whole API as a machine-readable document, and a Postman collection built from it at every release.

OpenAPI 3.1	/openapi.json
Postman collection	/pamopay.postman_collection.json

The document is held to the API's own route tables by a test that runs on every commit: every route the API serves is in it, every path in it is served, and every operation's x-scope is the scope the router checks. The error codes it names are the catalogue's, in both directions.

Postman

Import the collection, then set two variables:

• key — your test key, from the Developers screen.
• base — already the sandbox URL. Switch it to the live URL to go live.

Every request that takes an Idempotency-Key sends a fresh GUID, so pressing Send twice makes two charges. To test a retry, pin the header to a fixed value.

Generating a client

Any OpenAPI 3.1 generator will produce a client from the document. Two things worth checking in what it produces:

• Idempotency. A generated client will treat Idempotency-Key as a plain header parameter. Wrap it so the key is derived from your order id rather than passed by hand at every call site.
• Retries. Retry 503 and 429 with the same key and a backoff; never retry a 4xx unchanged. Read Retry-After on a 429.

Vendor extensions in the document: x-scope (the scope the operation needs), x-faults (the codes it can answer beyond the common ones), x-sandbox (whether the sandbox serves it), and x-common-faults at the top level.