Skip to main content
POST
Complete checkout

Headers

X-Checkout-Journey-Id
string

Optional non-authorizing checkout journey UUID. Use with X-Checkout-Attempt-Id. Capture is disabled by default; malformed or incomplete pairs are ignored without changing checkout behavior. Cart scope comes from the authenticated cart token, never these headers.

X-Checkout-Attempt-Id
string

Optional customer-submission UUID paired with X-Checkout-Journey-Id. Retain it for transport retries and originating continuations; use a new UUID for a new customer submission. It does not replace payment or order idempotency keys. Invalid pairs are ignored rather than rejecting payment.

Idempotency-Key
string

Idempotency key for safe retries

Path Parameters

cart_token
string
required

Cart token

Query Parameters

payment_uuid
string

Payment UUID from a prior tokenize/authorize step

Body

application/json

All fields are optional. They carry provider-specific fraud, device, and consent context gathered by the client at submit time; the cart itself already holds the items, addresses, shipping, and payment method.

expected_total and expected_currency are the one pair worth always sending: they name the total the client showed the shopper, and the charge boundary then refuses (409, cart_total_changed) to charge anything else. Without them the cart is charged whatever it says when the request is processed.

kount_session_id
string

Kount fraud session id, persisted onto the cart's metadata for the fraud check.

checkout_from_admin
boolean

Admin MOTO claim. Takes effect only when the request carries an admin JWT for the cart's company; otherwise it is ignored and the checkout runs as a customer checkout.

browser_info
object

Buyer browser fingerprint required by VGS 3DS authentication.

payment_method_data
object

Provider-specific submit-time data — for example Mercado Pago's device_id or BLIK's blik_verification_code.

device_data
string

Braintree Data Collector device fingerprint.

accepted_agreement_ids
integer[] | null

Ids of the agreements the buyer accepted at checkout, from the cart's agreements array. Required whenever the cart has a required agreement: checkout refuses with 422 and errors.agreements when any agreement the cart marks required is missing from this list, unless the cart's payment is already authorized or captured. null reads as an omitted list.

accepted_agreement_versions
object[]

The version of each accepted agreement's text the client showed the shopper: the agreement's id with the content_digest from the same entry of the cart's agreements array. Optional. When present, checkout refuses with 422 and errors.agreements if any named version is no longer the agreement's live text (the merchant edited the terms after the shopper saw them), so the shopper is shown the new wording before being charged. Omit it to skip that check; entries for agreements not in accepted_agreement_ids are ignored. Like the ids, the check stands down once the cart's payment is authorized or captured.

phone
string

Phone number to save on the cart before the checkout runs, for a company whose checkout settings require one. Intended for a cart that cannot take a PATCH: once a wallet payment is approved the cart is authorized and every cart mutation answers 410, so a shopper finishing such a cart supplies the number here instead. Ignored on an already-completed cart. A number that is still not dialable leaves the checkout refused with phone in errors.

Example:

"+12125551005"

ach
object

Bank account (ACH) completion details. Send it only when the provider's collector returns something for the server to debit.

expected_total
string

The cart total the client showed the shopper, as a decimal string in the cart currency's major unit ("141.74"), taken from amount_total of the cart the client last rendered -- the whole total, including any portion a reward-points balance will cover, not the card line. Requires expected_currency. When the cart's total differs at the charge boundary the response is 409 with meta.code = cart_total_changed and nothing is charged.

Pattern: ^\d{1,12}(\.\d{1,5})?$
Example:

"141.74"

expected_currency
string

ISO 4217 code of the currency the shopper was shown, from currency_code of the same cart. Requires expected_total.

Example:

"USD"

Response

Checkout resolved. Either the order was created, or the provider needs one more step from the buyer before an order can exist — a VGS 3DS challenge, a BLIK agreement awaiting its OTP, or a hosted page to send the buyer to. Branch on the response shape.

CheckoutAchActionRequiredResponse hands a bank account (ACH) step to the provider's collector to run, and CheckoutAchProcessingResponse says the confirmed debit is still processing; complete again with payment_uuid to read it.

CheckoutRedirectResponse is the hosted-page branch (Citcon, PPRO, dLocal, and other auto-assignable providers): send the buyer to redirect_url, and the order is created when the provider's webhook completes the checkout. It answers 200 rather than 302 because the payload is JSON with no Location header — the client navigates itself, so nothing about it is an HTTP redirect.

Single order

order
object
required
meta
object
required