For AI agents: the docs index is at https://developer.mercury.global/llms.txt. Append .md to any documentation page URL to get its markdown version.
Import our pre-built Postman collection and start calling the Mercury API in minutes. All endpoints, pre-configured authentication, and example payloads included.
Every REST endpoint, organised in the same folders as the API reference. Generated from the live API definition, so it is always up to date.
HMAC-SHA256 signing handled automatically via a pre-request script. Just add your credentials and go.
Every request comes with example bodies and path values (such as CLIENT-001) that you can modify and send immediately.
2
Open Postman and click Import (top left). Drag the downloaded JSON file into the import window, or click Upload Files and select it. The collection will appear in your sidebar under Collections.
3
Click the Environments tab in the sidebar. Create a new environment called Mercury Sandbox and add these variables:
| Variable |
Value |
Notes |
| base_url |
https://www.api.external.test.mercury.global |
Sandbox. The collection defaults to this, so it is optional here |
| api_key |
Your API Key |
From Mercury team |
| secret_key |
Your Secret Key |
Keep in CURRENT VALUE only |
4
In the top-right corner of Postman, use the environment dropdown to select Mercury Sandbox. This makes your variables available to every request in the collection.
5
Expand the collection in the sidebar, open the Clients folder, select Get all clients (GET /api/v1/client), and click Send. The pre-request script handles HMAC signing automatically. You should get a 200 OK response.
The collection includes a pre-request script at the collection level that runs before every request. It automatically:
Generates a unique nonce (UUID)
Reads the request method, path and body
Builds the string to sign (API key, method, path, body and nonce, joined with newlines)
Signs it with HMAC-SHA256 using your secret_key environment variable
Sets the x-api-key, x-nonce, and Authorization headers automaticallyYou never need to manually compute signatures in Postman. Just set your environment variables and send requests.
| Folder |
Endpoints |
Count |
| Clients |
Get all, onboard, update, get by reference, get accounts |
5 |
| Confirmation of Payee |
Account name check, SRD requirement check |
2 |
| EUR Payments |
Submit a SEPA Credit Transfer |
1 |
| EUR Virtual IBANs |
Get all, create, statements, block, unblock, close |
6 |
| Lookups |
Currencies, countries, natures of business, CoP currencies, countries and legal owner types, risk rating levels, payment return reasons |
8 |
| GBP Payments |
Submit a Faster Payment, return a received payment |
2 |
| GBP Virtual Accounts |
Get all, create, statements, block, unblock, close |
6 |
Secret Key SafetyStore your Secret Key in the CURRENT VALUE column only, not INITIAL VALUE. Current values are local to your machine and never synced to Postman's cloud.
Production EnvironmentDuplicate the Mercury Sandbox environment and name it Mercury Production. Update the base_url and credentials. Switch environments to toggle between sandbox and live.
Inspect the SignatureOpen the Postman Console (bottom left) to see the exact headers sent with each request. Useful for debugging authentication issues.
Modify and TestEdit the example request bodies to test different scenarios. The pre-request script re-signs every request automatically, so you can freely change payloads without worrying about the signature.
401 Unauthorized.Check that Mercury Sandbox is selected in the environment dropdown (top right)
.Verify api_key and secret_key are set in CURRENT VALUE
.Ensure no extra whitespace around your credential values
.If the Console shows "Mercury: set api_key and secret_key", the request was sent unsigned because a credential is missing
Variables Not Resolving.Hover over orange-highlighted variables to check they resolve correctly
.Unresolved variables appear in red. This means the environment is not selected or the variable name is mistyped
.Path values such as :reference and :iban are set in the request's Params tab. Replace the examples with your own values
See full authentication examples in cURL, Python, Node.js, Java, and C#.
