Skip to main content
POST
Complete checkout

Headers

X-Checkout-Journey-Id
string

Optional non-authorizing checkout journey UUID. Use with X-Checkout-Attempt-Id. Capture is disabled by default; malformed or incomplete pairs are ignored without changing checkout behavior. Cart scope comes from the authenticated cart token, never these headers.

X-Checkout-Attempt-Id
string

Optional customer-submission UUID paired with X-Checkout-Journey-Id. Retain it for transport retries and originating continuations; use a new UUID for a new customer submission. It does not replace payment or order idempotency keys. Invalid pairs are ignored rather than rejecting payment.

Idempotency-Key
string

Idempotency key for safe retries

Path Parameters

cart_token
string
required

Cart token

Query Parameters

payment_uuid
string

Payment UUID from a prior tokenize/authorize step

Body

application/json

All fields are optional. They carry provider-specific fraud, device, and consent context gathered by the client at submit time; the cart itself already holds the items, addresses, shipping, and payment method.

expected_total and expected_currency are the one pair worth always sending: they name the total the client showed the shopper, and the charge boundary then refuses (409, cart_total_changed) to charge anything else. Without them the cart is charged whatever it says when the request is processed.

kount_session_id
string

Kount fraud session id, persisted onto the cart's metadata for the fraud check.

checkout_from_admin
boolean

Marks the checkout as admin-initiated rather than buyer-initiated.

browser_info
object

Buyer browser fingerprint required by VGS 3DS authentication.

payment_method_data
object

Provider-specific submit-time data — for example Mercado Pago's device_id or BLIK's blik_verification_code.

device_data
string

Braintree Data Collector device fingerprint.

accepted_agreement_ids
integer[]

Ids of the agreements the buyer accepted at checkout.

expected_total
string

The cart total the client showed the shopper, as a decimal string in the cart currency's major unit ("141.74"), taken from amount_total of the cart the client last rendered -- the whole total, including any portion a reward-points balance will cover, not the card line. Requires expected_currency. When the cart's total differs at the charge boundary the response is 409 with meta.code = cart_total_changed and nothing is charged.

Pattern: ^\d{1,12}(\.\d{1,5})?$
Example:

"141.74"

expected_currency
string

ISO 4217 code of the currency the shopper was shown, from currency_code of the same cart. Requires expected_total.

Example:

"USD"

Response

Checkout resolved. Either the order was created, or the provider needs one more step from the buyer before an order can exist — a VGS 3DS challenge, a BLIK agreement awaiting its OTP, or a hosted page to send the buyer to. Branch on the response shape.

CheckoutRedirectResponse is the hosted-page branch (Citcon, PPRO, dLocal, and other auto-assignable providers): send the buyer to redirect_url, and the order is created when the provider's webhook completes the checkout. It answers 200 rather than 302 because the payload is JSON with no Location header — the client navigates itself, so nothing about it is an HTTP redirect.

Single order

order
object
required
meta
object
required