Get Payment Methods

GET /paymentmethods

Try it

Parameters

siteCode*queryregionqueryX-Forwarded-ForheaderlimitqueryoffsetqueryX-Correlation-IDheader

Request sampleLanguage

curl -X GET 'https://one.ozow.com/v1/paymentmethods?siteCode=string&region=string&limit=50&offset=0' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'X-Forwarded-For: 198.51.100.1' \
  -H 'X-Correlation-ID: 00000000-0000-0000-0000-000000000000'

Response exampleStatus

{
  "links": {
    "self": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=50",
    "first": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=0",
    "last": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=100",
    "prev": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=0",
    "next": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=100"
  },
  "results": [
    {
      "id": "4816019c-3314-4c80-8b6b-b2cd16dcc4ec",
      "name": "FNB",
      "friendlyName": "First National Bank",
      "logo": "https://example.com/logo",
      "available": true,
      "offlineMessage": "Pay by Bank is temporarily unavailable. Choose another payment method to continue.",
      "institutions": [
        {
          "id": "00000000-0000-0000-0000-000000000000",
          "name": "FNB",
          "friendlyName": "First National Bank",
          "logo": "https://example.com/logo",
          "available": true,
          "offlineMessage": "First National Bank is temporarily unavailable. Choose another bank to continue.",
          "conditions": [
            {
              "name": "<name>",
              "operator": "<",
              "value": "<value>"
            }
          ]
        }
      ]
    }
  ],
  "meta": {
    "totalPages": 1,
    "totalItems": 1
  }
}

Built from the response schema. Values are placeholders, not real data.

GEThttps://one.ozow.com/v1/paymentmethodsProduction

Retrieve the list of payment methods available. If region is not specified, IP geolocation will be used to determine an applicable region.

Authentication

OAuth 2.0
scopespayments

Query parameters

siteCode string required
The merchant site code.
region string
The applicable region identifer in ISO 3166-Alpha-2 format.
min length2max length2
limit integer
The maximum number of items to return.
min1max50default50
offset integer
The number of items to discard in this paging operation.
min length0min0default0

Header parameters

X-Forwarded-For string
The IP address of the end-consumer.
X-Correlation-ID string
Optional correlation id for the request, if not supplied a new one will be generated and passed onto all underlying requests and returned as a header.

Responses

200 OK

X-Correlation-ID header
The correlation id for the request that was processed.

links PaginationLinks required
Links for pagination
Fields of PaginationLinks
- self string uri
  The current page of data.
- first string uri
  The first page of data.
- last string uri nullable
  The last page of data. Null when the whole collection fits on one page.
- prev string uri nullable
  The previous page of data. Null on the first page.
- next string uri nullable
  The next page of data. Null on the last page.
Open PaginationLinks on its own page
results array of PaymentMethod required
Fields of PaymentMethod
- id string uuid required
  The unique identifier of the payment method.
- name string required
  The unique name of the payment method.
  max length250
- friendlyName string required
  The display name of the payment method for consumers.
  max length250
- logo string uri required
  A displayable logo or descriptive image of the payment method.
- available boolean required
  Whether the payment method is available to transact with.
- offlineMessage string
  If the payment method is not available to transact with, this user friendly offline message will be returned.
- institutions array of Institution
  The institutions available for this payment method.
  Fields of Institution
  id string uuid required
  The unique identifier of the institution.
  name string required
  The unique name of the institution.
  max length250
  friendlyName string required
  The display name of the institution for consumers.
  max length250
  logo string uri
  A displayable logo or descriptive image of the institution.
  available boolean required
  Whether the institution is available to transact with.
  offlineMessage string
  If the institution is not available to transact with, this user friendly offline message will be returned.
  conditions array of Condition
  Any conditions that govern whether or not the use of this institution is allowed. For example some institutions may have a minimum or maximum allowed value which would need to be considered when using the institution.
  Fields of Condition
  name string required
  The name of the property to which the condition applies.
  operator string required
  The operator indicating how this condition is enforced.
  values"<""<=""==""!="">="">"
  value string required
  The value which the condition will enforce on the property.
  Open Condition on its own page
  Open Institution on its own page
Open PaymentMethod on its own page
meta PaginationMeta required
The pagination meta data available.
Fields of PaginationMeta
- totalPages integer required
  The total number of pages available.
- totalItems integer required
  The total number of items available.
Open PaginationMeta on its own page

400 Bad Request.

X-Correlation-ID header
The correlation id for the request that was processed.

id string uuid required
a unique identifier for this particular occurrence of the problem.
links object nullable
Present on an authentication or authorisation failure, and null otherwise.
- about string uri
  A link that leads to further details about this particular occurrence of the problem. When derefenced, this URI SHOULD return a human-readable description of the error.
- type string uri
  A link that identifies the type of error that this particular error is an instance of. This URI SHOULD be dereferencable to a human-readable explanation of the general error.
code string required
An application-specific error code, expressed as a string value. Key on this rather than on title or detail, which are written for a person. A rejection at the transport level uses the status name, one of BadRequest, Unauthorized, Forbidden, NotFound, NotAllowed, Conflict, UnsupportedMediaType, BadGateway or InternalServerError. An operation refusing a request on its own rules returns a code of its own.
title string required
A short, human-readable summary of the problem that SHOULD NOT change from occurrence to occurrence of the problem, except for purposes of localization.
detail string required
A human-readable explanation specific to this occurrence of the problem. Like title, this field’s value can be localized.
source object nullable
Where in the request the problem was found. All three keys are present whenever source is, with the ones that do not apply set to null. source itself is null where the failure is not about a part of the request.
- pointer string json-pointer nullable
  a JSON Pointer RFC6901 to the value in the request document that caused the error [e.g. "/data" for a primary data object, or "/data/attributes/title" for a specific attribute]. This MUST point to a value in the request document that exists; if it doesn’t, the client SHOULD simply ignore the pointer.
- parameter string nullable
  A string indicating which URI query parameter caused the error.
- header string nullable
  A string indicating the name of a single request header which caused the error.
meta object nullable
A meta object containing non-standard meta-information about the error. Null where the request carried no X-Correlation-ID, and on an authentication failure, which does not echo it.
- correlationId string
  The X-Correlation-ID sent with the request, echoed back so it can be quoted to support. Absent when the request carried no correlation header.

A field in the request body did not validate

{
  "id": "3a6c9e01-5f2b-4d8a-9c47-1e0b7d5a2f83",
  "links": null,
  "code": "BadRequest",
  "title": "Bad Request",
  "detail": "amount: Amount must be greater than 0",
  "source": {
    "pointer": "/amount",
    "parameter": null,
    "header": null
  },
  "meta": {
    "correlationId": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  }
}

401 Unauthorised.

X-Correlation-ID header
The correlation id for the request that was processed.

id string uuid required
a unique identifier for this particular occurrence of the problem.
links object nullable
Present on an authentication or authorisation failure, and null otherwise.
- about string uri
  A link that leads to further details about this particular occurrence of the problem. When derefenced, this URI SHOULD return a human-readable description of the error.
- type string uri
  A link that identifies the type of error that this particular error is an instance of. This URI SHOULD be dereferencable to a human-readable explanation of the general error.
code string required
An application-specific error code, expressed as a string value. Key on this rather than on title or detail, which are written for a person. A rejection at the transport level uses the status name, one of BadRequest, Unauthorized, Forbidden, NotFound, NotAllowed, Conflict, UnsupportedMediaType, BadGateway or InternalServerError. An operation refusing a request on its own rules returns a code of its own.
title string required
A short, human-readable summary of the problem that SHOULD NOT change from occurrence to occurrence of the problem, except for purposes of localization.
detail string required
A human-readable explanation specific to this occurrence of the problem. Like title, this field’s value can be localized.
source object nullable
Where in the request the problem was found. All three keys are present whenever source is, with the ones that do not apply set to null. source itself is null where the failure is not about a part of the request.
- pointer string json-pointer nullable
  a JSON Pointer RFC6901 to the value in the request document that caused the error [e.g. "/data" for a primary data object, or "/data/attributes/title" for a specific attribute]. This MUST point to a value in the request document that exists; if it doesn’t, the client SHOULD simply ignore the pointer.
- parameter string nullable
  A string indicating which URI query parameter caused the error.
- header string nullable
  A string indicating the name of a single request header which caused the error.
meta object nullable
A meta object containing non-standard meta-information about the error. Null where the request carried no X-Correlation-ID, and on an authentication failure, which does not echo it.
- correlationId string
  The X-Correlation-ID sent with the request, echoed back so it can be quoted to support. Absent when the request carried no correlation header.

No usable access token on the request

{
  "id": "1cecc2b7-1c29-418a-b26a-bf7546926083",
  "links": {
    "about": "https://ozow.stoplight.io/docs/one-api/zi18vomr0jm8c-generate-authentication-token",
    "type": "https://tools.ietf.org/html/rfc7235#section-3.1"
  },
  "code": "Unauthorized",
  "title": "Unauthorized Request",
  "detail": "Authorization header is missing or invalid.",
  "source": {
    "pointer": null,
    "parameter": null,
    "header": "Authorization"
  },
  "meta": null
}

403 Forbidden.

X-Correlation-ID header
The correlation id for the request that was processed.

id string uuid required
a unique identifier for this particular occurrence of the problem.
links object nullable
Present on an authentication or authorisation failure, and null otherwise.
- about string uri
  A link that leads to further details about this particular occurrence of the problem. When derefenced, this URI SHOULD return a human-readable description of the error.
- type string uri
  A link that identifies the type of error that this particular error is an instance of. This URI SHOULD be dereferencable to a human-readable explanation of the general error.
code string required
An application-specific error code, expressed as a string value. Key on this rather than on title or detail, which are written for a person. A rejection at the transport level uses the status name, one of BadRequest, Unauthorized, Forbidden, NotFound, NotAllowed, Conflict, UnsupportedMediaType, BadGateway or InternalServerError. An operation refusing a request on its own rules returns a code of its own.
title string required
A short, human-readable summary of the problem that SHOULD NOT change from occurrence to occurrence of the problem, except for purposes of localization.
detail string required
A human-readable explanation specific to this occurrence of the problem. Like title, this field’s value can be localized.
source object nullable
Where in the request the problem was found. All three keys are present whenever source is, with the ones that do not apply set to null. source itself is null where the failure is not about a part of the request.
- pointer string json-pointer nullable
  a JSON Pointer RFC6901 to the value in the request document that caused the error [e.g. "/data" for a primary data object, or "/data/attributes/title" for a specific attribute]. This MUST point to a value in the request document that exists; if it doesn’t, the client SHOULD simply ignore the pointer.
- parameter string nullable
  A string indicating which URI query parameter caused the error.
- header string nullable
  A string indicating the name of a single request header which caused the error.
meta object nullable
A meta object containing non-standard meta-information about the error. Null where the request carried no X-Correlation-ID, and on an authentication failure, which does not echo it.
- correlationId string
  The X-Correlation-ID sent with the request, echoed back so it can be quoted to support. Absent when the request carried no correlation header.

The token is valid but lacks the scope the operation needs

{
  "id": "c47a2e08-9b31-4f6d-85a0-7e2c1d9f3b56",
  "links": {
    "about": "https://ozow.stoplight.io/docs/one-api/zi18vomr0jm8c-generate-authentication-token",
    "type": "https://tools.ietf.org/html/rfc7235#section-3.1"
  },
  "code": "Forbidden",
  "title": "Forbidden Request",
  "detail": "Request is forbidden, most likely scope does not match required scope to perform requested action.",
  "source": {
    "pointer": null,
    "parameter": null,
    "header": "Authorization"
  },
  "meta": {
    "correlationId": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  }
}

500 Internal Server Error.

X-Correlation-ID header
The correlation id for the request that was processed.

id string uuid required
a unique identifier for this particular occurrence of the problem.
links object nullable
Present on an authentication or authorisation failure, and null otherwise.
- about string uri
  A link that leads to further details about this particular occurrence of the problem. When derefenced, this URI SHOULD return a human-readable description of the error.
- type string uri
  A link that identifies the type of error that this particular error is an instance of. This URI SHOULD be dereferencable to a human-readable explanation of the general error.
code string required
An application-specific error code, expressed as a string value. Key on this rather than on title or detail, which are written for a person. A rejection at the transport level uses the status name, one of BadRequest, Unauthorized, Forbidden, NotFound, NotAllowed, Conflict, UnsupportedMediaType, BadGateway or InternalServerError. An operation refusing a request on its own rules returns a code of its own.
title string required
A short, human-readable summary of the problem that SHOULD NOT change from occurrence to occurrence of the problem, except for purposes of localization.
detail string required
A human-readable explanation specific to this occurrence of the problem. Like title, this field’s value can be localized.
source object nullable
Where in the request the problem was found. All three keys are present whenever source is, with the ones that do not apply set to null. source itself is null where the failure is not about a part of the request.
- pointer string json-pointer nullable
  a JSON Pointer RFC6901 to the value in the request document that caused the error [e.g. "/data" for a primary data object, or "/data/attributes/title" for a specific attribute]. This MUST point to a value in the request document that exists; if it doesn’t, the client SHOULD simply ignore the pointer.
- parameter string nullable
  A string indicating which URI query parameter caused the error.
- header string nullable
  A string indicating the name of a single request header which caused the error.
meta object nullable
A meta object containing non-standard meta-information about the error. Null where the request carried no X-Correlation-ID, and on an authentication failure, which does not echo it.
- correlationId string
  The X-Correlation-ID sent with the request, echoed back so it can be quoted to support. Absent when the request carried no correlation header.

The request failed on the Ozow side

{
  "id": "9e0d5a83-6b24-4c19-8f7a-2d1b3e6c0a97",
  "links": null,
  "code": "InternalServerError",
  "title": "Internal Server Error",
  "detail": "Error occurred while processing request.",
  "source": {
    "pointer": "/data",
    "parameter": null,
    "header": null
  },
  "meta": {
    "correlationId": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  }
}

Request

curl -X GET 'https://one.ozow.com/v1/paymentmethods?siteCode=string&region=string&limit=50&offset=0' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'X-Forwarded-For: 198.51.100.1' \
  -H 'X-Correlation-ID: 00000000-0000-0000-0000-000000000000'

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://one.ozow.com/v1/paymentmethods?siteCode=string&region=string&limit=50&offset=0");
request.Headers.Add("Authorization", "Bearer YOUR_ACCESS_TOKEN");
request.Headers.Add("X-Forwarded-For", "198.51.100.1");
request.Headers.Add("X-Correlation-ID", "00000000-0000-0000-0000-000000000000");

var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();

<?php
$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://one.ozow.com/v1/paymentmethods?siteCode=string&region=string&limit=50&offset=0',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_ACCESS_TOKEN',
        'X-Forwarded-For: 198.51.100.1',
        'X-Correlation-ID: 00000000-0000-0000-0000-000000000000',
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

const response = await fetch("https://one.ozow.com/v1/paymentmethods?siteCode=string&region=string&limit=50&offset=0", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_ACCESS_TOKEN",
    "X-Forwarded-For": "198.51.100.1",
    "X-Correlation-ID": "00000000-0000-0000-0000-000000000000",
  },
});

const data = await response.json();

import requests

headers = {
    "Authorization": "Bearer YOUR_ACCESS_TOKEN",
    "X-Forwarded-For": "198.51.100.1",
    "X-Correlation-ID": "00000000-0000-0000-0000-000000000000",
}

response = requests.get(
    "https://one.ozow.com/v1/paymentmethods?siteCode=string&region=string&limit=50&offset=0",
    headers=headers,
)

Response

{
  "links": {
    "self": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=50",
    "first": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=0",
    "last": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=100",
    "prev": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=0",
    "next": "https://one.ozow.com/v1/payments?siteCode=SITE-001&fromDate=2026-01-01&toDate=2026-01-31&limit=50&offset=100"
  },
  "results": [
    {
      "id": "4816019c-3314-4c80-8b6b-b2cd16dcc4ec",
      "name": "FNB",
      "friendlyName": "First National Bank",
      "logo": "https://example.com/logo",
      "available": true,
      "offlineMessage": "Pay by Bank is temporarily unavailable. Choose another payment method to continue.",
      "institutions": [
        {
          "id": "00000000-0000-0000-0000-000000000000",
          "name": "FNB",
          "friendlyName": "First National Bank",
          "logo": "https://example.com/logo",
          "available": true,
          "offlineMessage": "First National Bank is temporarily unavailable. Choose another bank to continue.",
          "conditions": [
            {
              "name": "<name>",
              "operator": "<",
              "value": "<value>"
            }
          ]
        }
      ]
    }
  ],
  "meta": {
    "totalPages": 1,
    "totalItems": 1
  }
}

Built from the response schema. Values are placeholders, not real data.

Bad Request.

{
  "id": "3a6c9e01-5f2b-4d8a-9c47-1e0b7d5a2f83",
  "links": null,
  "code": "BadRequest",
  "title": "Bad Request",
  "detail": "amount: Amount must be greater than 0",
  "source": {
    "pointer": "/amount",
    "parameter": null,
    "header": null
  },
  "meta": {
    "correlationId": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  }
}

Unauthorised.

{
  "id": "1cecc2b7-1c29-418a-b26a-bf7546926083",
  "links": {
    "about": "https://ozow.stoplight.io/docs/one-api/zi18vomr0jm8c-generate-authentication-token",
    "type": "https://tools.ietf.org/html/rfc7235#section-3.1"
  },
  "code": "Unauthorized",
  "title": "Unauthorized Request",
  "detail": "Authorization header is missing or invalid.",
  "source": {
    "pointer": null,
    "parameter": null,
    "header": "Authorization"
  },
  "meta": null
}

Forbidden.

{
  "id": "c47a2e08-9b31-4f6d-85a0-7e2c1d9f3b56",
  "links": {
    "about": "https://ozow.stoplight.io/docs/one-api/zi18vomr0jm8c-generate-authentication-token",
    "type": "https://tools.ietf.org/html/rfc7235#section-3.1"
  },
  "code": "Forbidden",
  "title": "Forbidden Request",
  "detail": "Request is forbidden, most likely scope does not match required scope to perform requested action.",
  "source": {
    "pointer": null,
    "parameter": null,
    "header": "Authorization"
  },
  "meta": {
    "correlationId": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  }
}

Internal Server Error.

{
  "id": "9e0d5a83-6b24-4c19-8f7a-2d1b3e6c0a97",
  "links": null,
  "code": "InternalServerError",
  "title": "Internal Server Error",
  "detail": "Error occurred while processing request.",
  "source": {
    "pointer": "/data",
    "parameter": null,
    "header": null
  },
  "meta": {
    "correlationId": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  }
}