Product Manager API
Create and maintain gateway catalog products, with SKU lookup and cursor pagination.
Authentication and sandbox
These operations use a merchant API key in the Authorization header. The published OpenAPI server is https://sandbox.nmi.com/api. Keep the private key on your server. The examples below target sandbox and use placeholders; supply your own sandbox records and an email inbox you control. Source review only. No invoice, product, API request or email was created or sent while preparing this guide.
Create a product
POST /v5/products creates a Product Manager record. Four fields are required. Costs are currency amounts, not integer minor units. Required field Contract product_sku Unique alphanumeric string, maximum 256 characters. product_description String, maximum 255 characters. product_cost Nonnegative number before tax and discount. product_currency Three-character currency string. POST /api/v5/products HTTP/1.1 Host: sandbox.nmi.com Authorization: <sandbox-private-key> Content-Type: application/json { "product_sku": "DEMO001", "product_description": "Sandbox demonstration product", "product_cost": 25.00, "product_currency": "USD" } Optional: product_tax_amount and product_discount_amount are nonnegative fixed amounts. product_category and product_commodity_code allow up to 50 characters; product_unit_of_measure allows three and defaults to NAR. Image upload uses both product_image_name (up to 255 characters) and product_image_data (base64 JPG, PNG or GIF, up to 2 MB). HTTP 200 returns ProductResponseV5; 400 and 401 are documented failures.
List products
GET /v5/products returns a products array, per_page and next_cursor. Pagination differs from invoices: the product cursor is an integer product ID, not an opaque string. Query or response Contract cursor query Integer at least 1; start after this product ID. Omit on the first page. per_page query Integer 1–100; default 20. next_cursor response Integer or null; null ends pagination. products response Array of ProductResponseV5 records. GET /api/v5/products?per_page=20 HTTP/1.1 Host: sandbox.nmi.com Authorization: <sandbox-private-key> Use the returned next_cursor for the following page. HTTP 200 indicates success; HTTP 401 indicates unauthorized access.
Get by SKU and decode the record
GET /v5/products/{sku} selects a product by its SKU. Encode a dynamic path value as one URL path segment. Do not substitute the pagination ID for the SKU. Response field Contract object / id object is product; id is a string. These are the schema-required fields. product_sku / product_description SKU and description strings. product_cost / product_tax_amount / product_discount_amount Decimal strings in responses, although write requests use numbers. product_currency Currency string. product_category / product_commodity_code / product_unit_of_measure Catalog classification strings. product_image_name / product_image_url Image filename and URL strings. GET /api/v5/products/DEMO001 HTTP/1.1 Host: sandbox.nmi.com Authorization: <sandbox-private-key> HTTP 200 returns ProductResponseV5. HTTP 401 and 404 cover unauthorized access and a missing product.
Update by SKU
PUT /v5/products/{sku} accepts optional product fields. Send only the properties you intend to change. product_sku is absent from ProductUpdateRequest; this endpoint is not a documented SKU-renaming operation. PUT /api/v5/products/DEMO001 HTTP/1.1 Host: sandbox.nmi.com Authorization: <sandbox-private-key> Content-Type: application/json { "product_description": "Updated sandbox demonstration product", "product_cost": 30.00 } Update fields: product_description, product_cost, product_currency, product_commodity_code, product_unit_of_measure, product_tax_amount, product_discount_amount, product_image_name, product_image_data and product_category. The update schema preserves the corresponding create-field types and bounds. HTTP 200 returns ProductResponseV5; documented failure statuses are 400, 401 and 404.
Delete by SKU
DELETE /v5/products/{sku} removes the product. Confirm the exact SKU in your application before issuing the request. DELETE /api/v5/products/DEMO001 HTTP/1.1 Host: sandbox.nmi.com Authorization: <sandbox-private-key> No request body is defined. HTTP 200 has an object with success (boolean) and message (string), not ProductResponseV5. HTTP 401 and 404 indicate unauthorized access or a missing product. Recommended application behavior: preserve your own historical order descriptions and amounts; this source does not define effects on previously issued invoices.