ZTABS builds APIs for Lisbon businesses — RESTful services, GraphQL endpoints, third-party integrations, PSD2 open banking connectors, and Portuguese payment system APIs. Scalable, documented, and GDPR-compliant.
API development in Lisbon serves a market at a specific inflection point: Portuguese businesses digitising rapidly but still running on systems that weren't designed to talk to each other. Primavera and PHC — the dominant Portuguese ERP systems — have APIs, but they're SOAP-based, poorly documented, and designed for an era when integrations meant point-to-point connections between two systems. A modern Lisbon business needs its ERP talking to its eCommerce platform, its eCommerce platform talking to its shipping provider, its shipping provider talking to its CRM, its CRM talking to its marketing automation — all in real-time, all reliably, all securely. Without APIs: each of these connections is a custom integration project, fragile and expensive to maintain. With well-designed APIs: each system exposes its capabilities through a standardised interface, and new connections can be built in hours rather than weeks. The Portuguese API landscape has specific requirements that make it distinct from other European markets. Portuguese payment infrastructure: SIBS (the interbank services company) operates Multibanco and MB Way — Portugal's dominant payment networks. Any Portuguese eCommerce business needs API integration with SIBS for payment processing. The SIBS API: well-documented but with specific authentication requirements, webhook patterns, and certification processes that developers unfamiliar with the Portuguese market may not navigate efficiently. PSD2 and open banking: Portugal's implementation of the EU Payment Services Directive requires banks to expose APIs for account information and payment initiation. Portuguese banks (CGD, Millennium BCP, Novo Banco, BPI, Santander Totta) have implemented PSD2 APIs — but with varying levels of quality, documentation, and reliability. Building a fintech product that aggregates data from multiple Portuguese banks means integrating with 5-6 different PSD2 API implementations, each with its own quirks. Portuguese fiscal requirements: AT (Autoridade Tributária) requires certified invoicing software to communicate with the tax authority's systems. The AT webservices for e-fatura reporting have specific XML formats, digital certificate requirements, and validation rules. Any Portuguese business issuing invoices programmatically needs API integration with the AT. GDPR compliance: every API that processes personal data must comply with GDPR — including data minimisation in API responses (not returning more personal data than necessary), consent management (tracking and enforcing data subject consent), and data subject rights (APIs supporting data export and deletion requests). The API design itself must consider GDPR: what data fields are included in responses, how long data is cached, and how access is controlled.
Lisbon's API development demand comes from fintech, eCommerce, SaaS, and enterprise integration projects. Fintech: Lisbon's growing fintech ecosystem building on top of Portuguese banking infrastructure. Fintech API needs: PSD2 aggregation (connecting to Portuguese banks' PSD2 APIs to retrieve account balances, transaction histories, and initiate payments. Each bank's API: slightly different implementation — different authentication flows, different data formats, different error handling. A fintech product needs an abstraction layer that normalises these differences), SIBS payment integration (MB Way for mobile payments, Multibanco for reference-based payments — the two payment methods that Portuguese consumers actually use. Integrating these via SIBS API: including certification, testing in sandbox, and production deployment), and regulatory reporting (APIs for reporting to Banco de Portugal, CMVM for securities, and AT for tax — each with specific data formats, submission schedules, and authentication requirements). eCommerce: Lisbon eCommerce businesses needing APIs to connect their storefronts with Portuguese fulfilment infrastructure. eCommerce API needs: shipping APIs (CTT Expresso — Portugal's national postal service, DPD, GLS, UPS — each with their own shipment creation, label generation, and tracking APIs. A Lisbon eCommerce business: integrating with 2-3 shipping providers for price comparison and delivery flexibility), marketplace APIs (connecting to Worten Marketplace, KuantoKusta, Amazon ES/PT — each marketplace with its own product listing, order management, and inventory sync API), and inventory and fulfilment (connecting the eCommerce platform to warehouse management, stock management, and dropshipping providers — APIs enabling real-time inventory visibility and automated order routing). SaaS: Lisbon's SaaS companies building products that other businesses use through APIs. SaaS API needs: public API design (the API that your customers use to integrate your product into their systems — the API is your product's interface to the world. Good API design: intuitive, well-documented, backwards-compatible, and performant. Bad API design: creates support burden, frustrates customers, and limits adoption), webhook systems (enabling real-time notifications to customer systems when events occur in your product — order placed, payment received, status changed. Webhook reliability: retry logic, dead letter queues, and signature verification for security), and partner integrations (connecting your SaaS product with complementary products — CRM to email marketing, project management to invoicing, HR to payroll. Each integration: expanding your product's value proposition and reducing customer churn). Enterprise: Portuguese enterprises needing APIs to connect legacy systems with modern applications. Enterprise API needs: legacy system exposure (wrapping SOAP-based Primavera or PHC APIs in modern REST/GraphQL interfaces — enabling modern applications to access ERP data without dealing with SOAP complexity), data synchronisation (APIs enabling real-time data flow between systems — customer data from CRM to marketing automation, order data from eCommerce to ERP, employee data from HR to payroll), and mobile enablement (exposing existing system functionality through mobile-friendly APIs — enabling field workers, sales teams, and management to access enterprise data from mobile devices).
Our Lisbon API development covers design, implementation, documentation, and Portuguese system integration. API design (week 1): architecture decisions. REST vs. GraphQL: we choose based on the use case. REST: for simple CRUD operations, public APIs where broad compatibility matters, and integrations with systems that expect REST (most Portuguese systems). GraphQL: for complex data requirements where clients need flexibility in what data they request, mobile applications where bandwidth matters, and internal APIs serving multiple frontend applications. API design principles: resource-oriented design (URLs representing resources — /customers, /orders, /invoices — with HTTP methods representing operations), consistent error handling (standardised error response format with error codes, messages, and guidance — the same pattern across all endpoints), pagination (cursor-based for large datasets — more reliable than offset-based for datasets that change frequently), versioning (URL-based versioning — /v1/customers, /v2/customers — enabling API evolution without breaking existing integrations), and rate limiting (protecting the API from abuse and ensuring fair usage — implemented at the API gateway level with configurable limits per API key). API specification: OpenAPI 3.1 (formerly Swagger) — the API fully specified before implementation begins. The specification: serving as the contract between API provider and consumer, the basis for documentation generation, and the input for client SDK generation. Implementation (weeks 2-5): building the API. Technology stack: Node.js with Express or Fastify (for REST APIs — fast, well-supported, large ecosystem of middleware), or Node.js with Apollo Server (for GraphQL — type-safe, excellent developer experience), PostgreSQL (relational data — the default for most business data), Redis (caching, rate limiting, session management), and TypeScript throughout (type safety from database to API response — catching errors at compile time rather than runtime). Authentication: OAuth 2.0 with JWT tokens for user-facing APIs (supporting the authorization code flow for web applications and the client credentials flow for server-to-server integrations). API keys for simpler integrations (with rate limiting and usage tracking). Security: input validation (every API input validated against the OpenAPI specification — rejecting malformed requests before they reach business logic), SQL injection prevention (parameterised queries exclusively — never string concatenation for database queries), CORS configuration (restrictive CORS policies — only allowing requests from authorised origins), and HTTPS exclusively (TLS 1.3, HSTS headers, certificate management via Let's Encrypt or cloud provider). Portuguese system integrations (weeks 3-6): connecting to Portuguese infrastructure. SIBS integration: MB Way (mobile payment initiation and status checking — the API supporting payment requests, refunds, and payment status webhooks), Multibanco references (generating payment references that customers pay at ATMs or through home banking — the API generating references, tracking payments, and reconciling), and SIBS checkout (the hosted checkout page for card payments — integrating via redirect or iframe with customisable styling). AT fiscal integration: e-fatura (electronic invoicing — submitting invoice data to the Portuguese tax authority's webservices. XML document generation following AT specifications, digital certificate signing, and submission via SOAP webservice), SAF-T (Standard Audit File for Tax — generating the XML export file required for annual tax reporting. The SAF-T file: containing all invoicing, customer, product, and tax data in the AT-specified format), and QR code (Portuguese invoices requiring a QR code containing structured invoice data — generating the QR code according to AT specifications and including it in printed/PDF invoices). CTT and shipping: integration with CTT Expresso API (shipment creation, label generation in PDF format, tracking number retrieval, and delivery status webhooks) and other Portuguese shipping providers. Testing and documentation (weeks 5-7): ensuring quality and usability. Testing: unit tests (every function tested in isolation), integration tests (API endpoints tested with real database interactions), contract tests (verifying that the API matches its OpenAPI specification — ensuring documentation and implementation stay synchronised), and load tests (verifying performance under expected load — using K6 to simulate realistic traffic patterns). Documentation: auto-generated from OpenAPI specification (Redoc or Swagger UI — interactive documentation where developers can test API calls directly), getting started guide (step-by-step guide for the most common integration scenarios — from authentication to first API call), code examples (in JavaScript, Python, PHP, and cURL — the languages most commonly used by Lisbon developers integrating with APIs), and changelog (documenting every API change — enabling consumers to understand what changed and when).
SaaS / Business Management
A Lisbon SaaS company building a business management platform for Portuguese SMEs (invoicing, CRM, project management — targeting restaurants, small retailers, and service businesses) needed to integrate with Portuguese payment and fiscal systems. Problems: (1) AT certification: the platform needed AT certification for its invoicing module — a mandatory requirement for any software issuing invoices in Portugal. AT certification required: generating invoices in the AT-specified format, communicating with the AT e-fatura webservice to report invoices in real-time, generating SAF-T XML exports for annual tax reporting, including AT-compliant QR codes on all invoices, and implementing the sequential numbering and hash-chain requirements for invoice integrity. The founder had attempted to build the AT integration in-house — after 3 months of development, the integration was still failing AT validation tests. The AT documentation: extensive but dense, with critical requirements buried in appendix documents and edge cases not covered in examples. (2) Payment integration: Portuguese SMEs needed to accept payments via Multibanco (the most common payment method — customers paying at ATMs or through home banking using a reference number), MB Way (mobile payments — increasingly popular, especially among younger customers), and card payments (Visa/Mastercard via SIBS). The SIBS integration: requiring certification, sandbox testing, and specific webhook handling for payment confirmations. (3) Multi-channel invoicing: the platform needed to generate invoices triggered by multiple events — POS sale (in-store sale at a restaurant or shop), online order (eCommerce sale through the platform's integrated online store), and recurring subscription (monthly service fees for subscription-based businesses). Each channel: generating invoices with different requirements (POS invoices needing simplified format, online invoices needing shipping information, subscription invoices needing automatic generation). (4) Banking integration: the platform wanted to offer bank reconciliation — automatically matching bank transactions with invoices. Using PSD2 APIs: connecting to the merchant's bank account, retrieving transactions, and matching them against outstanding invoices. Portuguese bank PSD2 APIs: each bank with different implementation quality, response formats, and authentication flows. (5) Public API for integrations: the platform's customers (restaurants, retailers) used other tools that needed to connect — POS hardware vendors, accounting software (for accountants who used different tools), and delivery platforms (UberEats, Glovo — needing to push orders into the platform and trigger invoices).
We built the API infrastructure over 12 weeks. (1) AT fiscal engine: a dedicated microservice handling all Portuguese fiscal requirements. Invoice generation: PDF invoices generated with all AT-required fields (NIF, sequential number, hash chain, QR code, tax summary, AT certification number). QR code: generated using AT's ATCUD specification — encoding invoice data in the specific format the AT requires, verifiable by AT inspectors using the official AT verification app. E-fatura communication: SOAP client connecting to AT's webservice — submitting invoice data in real-time (within 5 seconds of invoice generation). Error handling: retry logic for AT service unavailability (the AT webservice: occasionally slow or unavailable — the engine queuing failed submissions and retrying with exponential backoff), validation error handling (AT rejecting invoices for specific data issues — the engine parsing AT error codes and providing clear guidance to the user), and duplicate prevention (ensuring invoices aren't reported twice to the AT, even if the initial submission status was unclear). SAF-T generation: monthly and annual SAF-T XML generation — the complete file containing all invoicing, customer, and product data in the AT-specified XML schema. File validation: running the SAF-T through AT's validation tool before making it available for download. Hash chain: each invoice containing a hash of the previous invoice — maintaining an unbroken chain that proves invoice integrity. The hash algorithm: SHA-1 as specified by AT (despite SHA-1's deprecation for other purposes, AT specifically requires it for invoice hashing). AT certification: submitted the platform for AT certification after development — passed on the first submission (the AT reviewing the test invoice set and confirming compliance with all requirements). (2) SIBS payment APIs: Multibanco references: generating payment references via SIBS API — the reference tied to the invoice amount, with an expiration date. When the customer paid (at an ATM, through home banking, or via mobile app): SIBS sending a webhook notification to the platform, which automatically marked the invoice as paid and triggered a receipt. MB Way: payment request sent to the customer's phone — the customer approving in the MB Way app. Real-time confirmation via webhook. For restaurants and retailers: MB Way replacing manual card terminal operations for small transactions. Card payments: SIBS acquiring API for Visa/Mastercard — the platform handling card payments through SIBS's payment page (PCI-DSS compliant — the platform never handling raw card data). Unified payment dashboard: all payment methods visible in a single interface — the merchant seeing Multibanco, MB Way, and card payments in one place, reconciled against invoices. (3) PSD2 bank reconciliation: integrated with PSD2 APIs from CGD, Millennium BCP, Novo Banco, BPI, and Santander Totta. Abstraction layer: normalising the differences between bank APIs (each bank: different authentication flows, different transaction data formats, different pagination approaches) into a consistent internal format. Auto-matching: algorithm matching bank transactions against outstanding invoices — matching by amount, reference number, and date. Match confidence: high (exact amount + reference match), medium (amount match, no reference), or low (approximate amount). High-confidence matches: automatically reconciled. Medium and low: presented to the user for manual confirmation. (4) Public REST API: designed for third-party integrations. Endpoints: customers (CRUD operations on the merchant's customer database), products (product catalogue management — for POS and eCommerce sync), invoices (create, read, credit note — enabling POS systems and delivery platforms to trigger invoicing), payments (initiate Multibanco/MB Way payments, check payment status), and reports (revenue summaries, tax summaries, payment reconciliation — for accounting software integration). Authentication: OAuth 2.0 with API keys — third-party developers registering applications and receiving API credentials. Rate limiting: 100 requests/minute for standard plans, 500 for premium. Documentation: interactive API documentation (Swagger UI) with getting started guides, code examples in Python and JavaScript, and webhook documentation with payload examples. (5) Webhook system: real-time notifications for integrating systems. Events: invoice.created, payment.received, payment.failed, bank.transaction.matched. Webhook delivery: HTTP POST with JSON payload, HMAC signature for verification, automatic retry (3 attempts over 24 hours with exponential backoff), and webhook logs (merchants viewing delivery history, payload contents, and response codes for debugging).
Results over 8 months. AT certification: obtained on first submission — the platform certified for Portuguese invoicing within 12 weeks of project start. The AT fiscal engine: processing 45,000+ invoices per month across 340 merchant accounts. E-fatura submission success rate: 99.7% (0.3% requiring retry — all eventually submitted within AT's required timeframe). SAF-T generation: 100% accuracy — zero validation errors in monthly and annual SAF-T files across all merchants. Payment processing: Multibanco: 12,000+ payment references generated per month, 89% paid within 48 hours (the remaining 11% expiring — normal for Multibanco references). MB Way: 8,400 transactions per month, 97% success rate (3% user-cancelled or timeout). Card payments: 15,000 transactions per month via SIBS. Total payment volume: EUR 2.3M/month processed through the platform. Bank reconciliation: auto-match rate: 78% of bank transactions automatically reconciled against invoices (high-confidence matches). Time savings: merchants previously spending 2-4 hours/week on manual reconciliation — reduced to 15-20 minutes reviewing medium-confidence matches. Public API adoption: 14 third-party integrations built within 6 months — including 3 POS hardware vendors, 2 accounting software providers, and 4 delivery platforms (UberEats, Glovo, Bolt Food, and a local Portuguese delivery service). API calls: 2.8M per month from third-party integrations. Developer experience: API documentation rated 4.6/5 by integrating developers (surveyed via in-documentation feedback). Platform growth: the API infrastructure enabling the platform to scale from 120 to 340 merchants over 8 months — the AT certification, payment integration, and public API removing the technical barriers that had limited adoption. Revenue impact: EUR 28,000/month in subscription revenue from the 220 new merchants (average EUR 127/month per merchant). Development cost: EUR 52,000 (12-week project). Annual operating cost: EUR 8,400 (SIBS fees passed through to merchants; infrastructure and API management costs). Annual value: EUR 336,000 (new merchant revenue enabled by the API infrastructure). ROI: 6.5x in the first year.
REST and GraphQL APIs designed for clarity, performance, and developer experience.
JWT, OAuth2, API keys, and role-based access control for secure access.
OpenAPI specs, interactive docs, and client SDKs so consumers can integrate quickly.
Rate limits, versioning, and deprecation strategies for stable, scalable APIs.
Connect with Stripe, Twilio, SendGrid, and custom systems via unified API layers.
Lisbon's API development market includes Portuguese software houses (Mindera, Blip, Subvisual — strong technical capability, understanding of Portuguese systems. May have waiting lists due to high demand), freelance developers (abundant in Lisbon — cost-effective for small integrations but potentially lacking the architecture expertise for complex API systems), enterprise integrators (offering middleware solutions like MuleSoft or Boomi — appropriate for large enterprises with complex integration landscapes, but expensive and over-engineered for most Lisbon businesses), and offshore development (lower rates but lacking knowledge of Portuguese payment systems, AT requirements, and PSD2 specificities). ZTABS provides API development with Portuguese system expertise (SIBS, AT, PSD2, CTT), modern architecture (REST, GraphQL, event-driven), and GDPR compliance built in.
API development in Lisbon ranges from EUR 8,000-20,000 for single-purpose APIs (one integration, basic CRUD, standard authentication) to EUR 30,000-70,000 for API platforms (multiple integrations, Portuguese payment/fiscal systems, public API with documentation, webhook system). SIBS certification: typically included in payment integration projects. AT certification support: EUR 5,000-10,000 as a standalone project. ZTABS provides fixed-price API development with milestone-based delivery.
Verified reviews from real client engagements — sourced from our public testimonial archive and Clutch profile.
My experience is throughout positive. Communication, service, the short response times and the flawless execution of a challenging topic was absolutely great. ZTABS is definitely my first choice again.
Christian Neff
Bank Software Advisory · Bank Software Advisory
Fintech
Fantastic Agency! I couldn't fault them even if I tried. They always go above and beyond to meet your expectations and always produces quality work. Thank you ZTABS.
Stephanie Kal
CEO · Beauty Finder Australia
Marketplace
It has been great working with ZTABS. They bounce off the ideas along the way. Amazing Experience.
Joel Rowe
CEO · Drill Quoter
Marketplace
We don't just contract — we ship and operate our own software. 17 products in production.
Common questions about API development for Lisbon businesses
Yes. We build modern REST/GraphQL wrappers around Primavera and PHC's APIs — exposing ERP data and operations through clean, well-documented interfaces that modern applications can consume easily. This enables mobile apps, web dashboards, and third-party integrations to access ERP data without dealing with legacy SOAP complexity.
ZTABS is a remote-first API development agency serving Houston businesses — including rest & graphql apis, authentication & authorization, documentation & sdks. We work with Energy & Oil/Gas, Healthcare & Biotech, Aerospace & Defense companies in Houston, TX via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
API Development in New York, NYZTABS is a remote-first API development agency serving New York businesses — including rest & graphql apis, authentication & authorization, documentation & sdks. We work with Finance & Fintech, Media & Advertising, Fashion & Retail companies in New York, NY via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
API Development in Los Angeles, CAZTABS is a remote-first API development agency serving Los Angeles businesses — including rest & graphql apis, authentication & authorization, documentation & sdks. We work with Entertainment & Media, E-commerce & DTC Brands, Gaming & AR/VR companies in Los Angeles, CA via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Development in Lisbon, PortugalZTABS is a remote-first web development agency serving Lisbon businesses — including full-stack development, progressive web apps, api development. We work with Tourism Tech, FinTech, PropTech companies in Lisbon, Portugal via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Design in Lisbon, PortugalZTABS is a remote-first web design agency serving Lisbon businesses — including ui/ux design, responsive design, custom interfaces. We work with Tourism Tech, FinTech, PropTech companies in Lisbon, Portugal via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
AI Development in Lisbon, PortugalZTABS is a remote-first AI development agency serving Lisbon businesses — including llm integration & fine-tuning, ai agents & automation, rag & knowledge systems. We work with Tourism Tech, FinTech, PropTech companies in Lisbon, Portugal via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
API DevelopmentLearn more about our API development services nationwide.
Partner with ZTABS for expert API development in Lisbon. Get a free consultation today.
