Malga
Malga (formerly Plug / plugpagamentos.com) is a Brazilian intelligent payment infrastructure and orchestration platform. It lets companies route transactions across multiple acquirers, payment providers, methods (card, Pix, boleto, wallets such as PicPay and Apple Pay) and anti-fraud engines from a single API, with smart routing/retry flows, tokenization, 3D Secure 2, subscriptions/recurrence, split payments, sellers/payouts and a GraphQL analytics API. Malga is PCI DSS Level 1 compliant and backed by Lightspeed Venture Partners and QED Investors.
Real signal across most facets with visible, nameable gaps — the contract exists but is thin, or the portal is good while governance and commercial terms are absent.
API Evangelist profiles Malga the way a machine reads it — 42 machine-readable artifacts across 1 API, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Malga scores 49.7/100 (developing), with a separate agent-readiness read of 38/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance. Every facet and dimension name is a link: it opens that measurement's page on APIs.io, where the rating runs across the whole catalog — the exact checks that feed it, how every profiled provider distributes on it, and who is at the top of it.
Kin Score
How this is scored →scored 2026-09-08 · rubric v0.20.0
Put this on your own site. The badge is drawn live from Malga's current Kin Score — paste it once and it updates itself every time the score is recomputed. It follows your visitor's light or dark setting, and it links back here so anyone who sees it can read the full breakdown.
<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/plug/"
title="Malga on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/plug.svg"
alt="Malga Kin Score — API readiness rating by API Evangelist" width="150" height="150" loading="lazy">
</a>[](https://providers.apievangelist.com/providers/plug/)<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/plug/"
title="Malga on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/plug/card.svg"
alt="Malga Kin Score — API readiness rating by API Evangelist" width="340" height="120" loading="lazy">
</a>More shapes, themes and sizes → · Score as JSON · How badges work
How we profile Malga
Each block below is one kind of artifact we hold for Malga. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 19
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Malga Analytics API
GraphQL API for querying processed payment data (charges, cards, authorization rates).
Malga 3DS2 Malga API
The 3DS2 Malga API from Malga — 1 operation(s) for 3ds2 malga.
Malga Cards API
**Dados básicos de um objeto cartão**
Malga Charges API
Para realizar uma cobrança deve criar um objeto `charge`. É possível recuperar detalhes de transações individuais ou listar todas as cobranças realizadas em um determinado `merc...
Malga Client-token API
É possível criar chaves públicas de acesso temporária a API com escopo e tempo de expiração limitados. Recomendamos o uso deste tipo de chave quando você tiver que expor a chave...
Malga Customers API
Através da API de `customers` é possível realizar a criação, edição, listagem e exclusão de dados de compradores para uso nos serviços de tokenização de cartões, cobrança por PI...
Malga Flows API
Através da API de `flows` é possível recuperar detalhes de um Fluxo ou listar todas os Fluxos cadastrados em determinado `clientId`. Os fluxos inteligentes são um recurso dispon...
Malga Merchants API
Através das APIs de `merchants` é possível realizar a criação e configuração de sub contas na Malga. Uma sub conta, ou um `merchant`, é um cadastro de estabelecimento comercial ...
Malga Payouts API
Através das APIs de `payouts` é possível consultar o saldo disponível, listar repasses e visualizar as ordens de pagamento liquidadas para um cliente. Esses endpoints são read-o...
Malga Prepayment API
> **🚧 Beta** — esta API está em fase Beta. Já está disponível para clientes habilitados, mas detalhes do contrato e do fluxo podem evoluir nas próximas versões. **Antecipação av...
Malga Providers API
Através das APIs de Providers você pode realizar a edição e atualização dos provedores vinculados a um merchant já cadastrado na Malga. Essas operações permitem que você mantenh...
Malga Seller Documents API
The Seller Documents API from Malga — 2 operation(s) for seller documents.
Malga Sellers API
Para realizar uma cobrança com Split, antes é necessário criar um `seller`. Os `sellers` são identificados a partir de um id único. Através das APIs de `sellers` é possível real...
Malga Sessions API
Através da API de sessões é possível criar um pedido, composto por itens, métodos de pagamento e outros atributos, que pode ser pago através de um endpoint ou integrado ao Malga...
Malga Settings API
Através da API de `settings` é possível recuperar, criar e atualizar configurações de personalização de link de pagamento de um determinado `clientId`. É possível também configu...
Malga Subscriptions API
Através da API de `subscriptions` é possível realizar a criação, edição, listagem e exclusão de assinaturas. **Dados básicos de um objeto do tipo subscription**
Malga Tokens API
**Dados básicos de uma requisição de criação de card token**
Malga Vendors API
The Vendors API from Malga — 2 operation(s) for vendors.
Malga Webhooks API
A Malga utiliza o serviço de webhooks para notificar o seu sistema sobre os eventos ocorridos na nossa plataforma. Através de webhooks você consegue atualizar seu sistema sempre...
Scroll within the panel for all 19 ·
Open Collections 19
Open, tool-agnostic collections carry the same runnable value as Postman without locking you to one client — the portable, forkable form of the same exercise.
Open, tool-agnostic API collections (OpenAPI-derived and Bruno).
API Collection
OPEN COLLECTIONDocumentação Malga 3DS2 Malga API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Cards API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Charges API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Client-token API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Customers API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Flows API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Merchants API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Payouts API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Prepayment API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Providers API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Seller Documents API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Sellers API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Sessions API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Settings API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Subscriptions API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Tokens API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Vendors API
OPEN COLLECTIONDocumentação Malga 3DS2 Malga Webhooks API
OPEN COLLECTIONScroll within the panel for all 19 ·
Event Specifications 1
Not every API is request/response. AsyncAPI describes the event-driven and streaming side — the webhooks and channels — so the asynchronous half of the interface is documented the same way the synchronous half is.
AsyncAPI definitions for this provider's event-driven and streaming APIs.
Plug Webhooks
ASYNCAPISecurity Posture 2
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Agentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Resources
Every other property we hold for Malga — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 5
Portal, sign-up, and the first successful call
Documentation 3
Reference material describing how the API behaves
Agent Surfaces 5
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 8
Pagination, idempotency, versioning, errors, and events
Scroll within the panel for all 8 ·
Build 5
SDKs, sample code, and the tooling you integrate with
Access & Security 3
Authentication, authorization, and security posture
Operate 4
Status, limits, changes, and where to get help
Company 2
The organization behind the API
Other 1
Properties that don't map to a standard resource type
← All providers · Data indexed from github.com/api-evangelist/plug · machine-readable index on apis.io
This is an independent, third-party profile of Malga, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.