{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/payments-ai/json-schema/payments-ai-public-api-create-merchant-request-schema.json",
  "title": "PublicApiCreateMerchantRequest",
  "x-generated": "2026-10-30",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/payments-ai-mor-openapi.json#/components/schemas/PublicApiCreateMerchantRequest",
  "type": "object",
  "required": [
    "name",
    "email"
  ],
  "properties": {
    "name": {
      "type": "string",
      "maxLength": 145,
      "description": "Business name displayed to customers. `'s Merchant` is appended when stored. Capped at 145 so the provider company title fits."
    },
    "email": {
      "type": "string",
      "format": "email",
      "description": "Owner email. If a user with this email already exists, they are assigned as Owner; otherwise the merchant is created without a membership and `ownerAttached` is false."
    },
    "phone": {
      "type": "string",
      "pattern": "^\\+[1-9]\\d{1,14}$",
      "description": "Optional E.164 phone. If omitted, the merchant provides it during KYC."
    },
    "merchantId": {
      "type": "string",
      "description": "Optional client-supplied UUID v7 idempotency key. Re-submitting the same id with the same details is safe and returns `created: false`."
    },
    "websiteUrl": {
      "type": "string",
      "maxLength": 255,
      "pattern": "^https://",
      "format": "uri",
      "description": "Optional HTTPS website URL for the sub-merchant. Used to validate checkout `returnUrl` hosts. Must start with `https://`. Max 255 characters."
    },
    "allowedReturnHosts": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 20,
      "description": "Optional. Exact hostnames, besides the `websiteUrl` host and the checkout host, that a checkout `returnUrl` may point to. Each entry is a bare hostname such as `shop.example.com`: no scheme, path, port, wildcard, IP address or `localhost`. Entries are lowercased, converted to punycode and de-duplicated. Matching is exact: a listed host does not cover its subdomains. At most 20 entries. Sending the list replaces the stored list; `[]` clears it. An invalid entry returns 400 naming the entry. On idempotent replay the list is applied only when the stored list is still empty; a replay with a different list returns 409."
    }
  }
}