Create Payment
POST/payments
Start a new Card, Apple Pay, Samsung Pay, Google Pay or STC Pay payment.
The source
object will define what payment is started.
When a payment is started, the status will be one of:
initiated
paid
failed
If the payment is initiated
then you need to complete the payment transaction by completing the payment
challenge found in source.transaction_url
depending on the payment source type.
Request
- application/json
Body
required
- 1.00 SAR = 100
- 1.00 KWD = 1000
- 1 JPY = 1
- CreditCardRequest
- CardTokenPaymentRequest
- GooglePayRequest
- ApplePayRequest
- SamsungPayRequest
- StcPayRequest
- 05xxxxxxxx
- +9665xxxxxxxx
- 009665xxxxxxxx
A positive integer representing the payment amount in the smallest currency unit.
Examples:
ISO-4217 three-letter currency code.
Human readable description for the payment. This is shown to the merchant only and is not shown to the payer.
A valid URL that is used to return the payer back to the merchant website after card payment is done.
This field is required when source.type
is creditcard
or token
.
sourceobjectrequired
A payment source object to be charged, such as Apple Pay, Google Pay, Samsung Pay, Credit Card, Credit Card Token, or STC Pay source.
oneOf
Possible values: [creditcard
]
Possible values: <= 255 characters
, Value must match regular expression ^[\w.-]+(?> [\w.-]+)+$
Card holder name using English charactars. Must be two names at least.
Possible values: Value must match regular expression ^\d{16,19}$
The card number as a string without any separators.
Possible values: >= 1
and <= 12
Card expiry month.
Possible values: >= 2000
Card expiry year.
Possible values: >= 3 characters
and <= 4 characters
, Value must match regular expression ^\d{3,4}$
The card security code. CVV for Visa, CVC for Mastercard or CSC for other brands. Must be 4 digits long for AMEX.
Possible values: <= 255 characters
Allows the merchant to add extra information to the statement descriptor sent to issuer.
Default value: true
Controls if 3DS is used for the payment.
Controls if the payment is authorized only without capturing. If the payment succeeds, the status will be set to authorized
.
If set to true
, a token will be generated and returned along the payment response in source.token
. This
allows the merchant to use the token later for future payments.
This requires Tokenization feature to be enabled for the merchant.
Possible values: [token
]
Possible values: Value must match regular expression ^token_
Possible values: >= 3 characters
and <= 4 characters
, Value must match regular expression ^\d{3,4}$
The card security code. CVV for Visa, CVC for Mastercard or CSC for other brands. Must be 4 digits long for AMEX.
Possible values: <= 255 characters
Allows the merchant to add extra information to the statement descriptor sent to issuer.
Controls if 3DS is used for the payment. The default is null
and is set depending on the token status.
For active
token, the value is set to false
and for save_only
token, the value is set to true
.
Controls if the payment is authorized only without capturing. If the payment succeeds, the status will be set to authorized
.
Possible values: [googlepay
]
The encrypted token payload.
Controls if the payment is authorized only without capturing. If the payment succeeds, the status will be set to authorized
.
Possible values: <= 255 characters
Allows the merchant to add extra information to the statement descriptor sent to issuer.
Possible values: [applepay
]
The encrypted token payload.
Controls if the payment is authorized only without capturing. If the payment succeeds, the status will be set to authorized
.
Possible values: <= 255 characters
Allows the merchant to add extra information to the statement descriptor sent to issuer.
Possible values: [samsungpay
]
The encrypted token payload.
Controls if the payment is authorized only without capturing. If the payment succeeds, the status will be set to authorized
.
Possible values: <= 255 characters
Allows the merchant to add extra information to the statement descriptor sent to issuer.
Possible values: [stcpay
]
Possible values: Value must match regular expression $(0|(00|\+)?966)?(5\d{8})$
Valid Saudi Arabian mobile number in one of the following formats:
Cashier identifier sent to STC Pay during request initiation. This will show in the merchant dashboard.
Branch identifier sent to STC Pay during request initiation. This will show in the merchant dashboard.
metadataobject
A set of key-value pairs where both key and value are strings. Metadata allows you to add more information to the object that will be returned later on in responses and webhook messages. Metadata is searchable using the Payment List API.
Responses
- 201
- 400
- 401
- 403
- application/json
- Schema
- Example (from schema)
Schema
- CreditCardResponse
- ApplePayResponse
- GooglePayResponse
- SamsungPayResponse
- StcPayResponse
- Apple Pay:
ap
- Samsung Pay:
sp
- Google Pay:
gp
- Apple Pay:
ap
- Samsung Pay:
sp
- Google Pay:
gp
- Apple Pay:
ap
- Samsung Pay:
sp
- Google Pay:
gp
Possible values: [initiated
, paid
, authorized
, failed
, refunded
, captured
, voided
, verified
]
Indicates the payment status.
If the payment is in the initiated
status, then an action must be taken (e.g. 3DS challenge) in order to
complete the payment.
The status authorized
is used when a scheme payment is made with manual: true
option which will cause
the system to authorize the payment only without capturing it. The merchant must capture the payment within
time it will be voided automatically by the issuer. Please note that when an issuer voids the payment, the
status will be kept authorized
and WILL NOT BE updated by the system.
Estimated payment fee (including VAT).
ISO-4217 three-letter currency code.
Refunded amount. Less than or equal to the payment amount.
Captured amount. Less than or equal to the payment amount.
Formatted payment amount with currency
Invoice ID that this payment is used to pay.
Payer IPv4 address. This information is collected from the connection that has created the payment.
You must ensure that the payment is created from the client device directly to ensure correct collection of the IP address.
metadataobject
A set of key-value pairs where both key and value are strings. Metadata allows you to add more information to the object that will be returned later on in responses and webhook messages. Metadata is searchable using the Payment List API.
sourceobjectrequired
Source response object
oneOf
Possible values: [creditcard
]
Possible values: [mada
, visa
, master
, amex
]
The scheme through which the payment is processed.
Card holder name
Masked card number showing first six and last four digits.
ID used for the backing acquirer gateway (MPG, MPGS or Cybersource).
Token that is created using this payment.
Human readable string representing the transaction result.
3D Secure challenge URL. Only returned when payment is initiated
.
Possible values: Value must match regular expression ^\d{12}$
The RRN or retrieval reference number. This is a unique number for the transaction generated by the acquirer gateway and is sent to the issuer during the authorization process.
This number is not unique across schemes (e.g. Visa and mada).
This number can be useful in tracking the payment in the card holder account statement.
Possible values: Value must match regular expression ^\d{6}$
A six-digit number returned by the issuer in response to a successful authorization process.
A two-digit string representing the authorization result (ISO 8583).
Response code 00
indicates that the payment is approved by the issuer. Please refer to the response code table
in the documentation for more information.
Name of the card issuing bank. This name is inferred based on the card BIN or IIN.
Origin country of the card issuer. A two-letter ISO 3166 code.
Possible values: [debit
, credit
, charge_card
, unspecified
]
Indicates the card category or product type, e.g., Platinum, Signature, etc.
This field is a human readable text and does not have a defined set of values.
Possible values: [applepay
]
Name will always be null
for Apple Pay payments.
Possible values: [mada
, visa
, master
, amex
]
The scheme through which the payment is processed.
Masked card number showing only last four digits.
Masked card number showing first six and last four digits.
ID used for the backing acquirer gateway (MPG, MPGS or Cybersource).
The xx
part is different based on the payment source:
Possible values: Value must match regular expression ^\d{12}$
The RRN or retrieval reference number. This is a unique number for the transaction generated by the acquirer gateway and is sent to the issuer during the authorization process.
This number is not unique across schemes (e.g. Visa and mada).
This number can be useful in tracking the payment in the card holder account statement.
Human readable string representing the transaction result.
A two-digit string representing the authorization result (ISO 8583).
Response code 00
indicates that the payment is approved by the issuer. Please refer to the response code table
in the documentation for more information.
Possible values: Value must match regular expression ^\d{6}$
A six-digit number returned by the issuer in response to a successful authorization process.
Name of the card issuing bank. This name is inferred based on the card BIN or IIN.
Origin country of the card issuer. A two-letter ISO 3166 code.
Possible values: [debit
, credit
, charge_card
, unspecified
]
Indicates the card category or product type, e.g., Platinum, Signature, etc.
This field is a human readable text and does not have a defined set of values.
Possible values: [googlepay
]
Name will always be null
for Apple Pay payments.
Possible values: [mada
, visa
, master
, amex
]
The scheme through which the payment is processed.
Masked card number showing only last four digits.
Masked card number showing first six and last four digits.
ID used for the backing acquirer gateway (MPG, MPGS or Cybersource).
The xx
part is different based on the payment source:
Possible values: Value must match regular expression ^\d{12}$
The RRN or retrieval reference number. This is a unique number for the transaction generated by the acquirer gateway and is sent to the issuer during the authorization process.
This number is not unique across schemes (e.g. Visa and mada).
This number can be useful in tracking the payment in the card holder account statement.
Human readable string representing the transaction result.
A two-digit string representing the authorization result (ISO 8583).
Response code 00
indicates that the payment is approved by the issuer. Please refer to the response code table
in the documentation for more information.
Possible values: Value must match regular expression ^\d{6}$
A six-digit number returned by the issuer in response to a successful authorization process.
Name of the card issuing bank. This name is inferred based on the card BIN or IIN.
Origin country of the card issuer. A two-letter ISO 3166 code.
Possible values: [debit
, credit
, charge_card
, unspecified
]
Indicates the card category or product type, e.g., Platinum, Signature, etc.
This field is a human readable text and does not have a defined set of values.
Possible values: [samsungpay
]
Name will always be null
for Apple Pay payments.
Possible values: [mada
, visa
, master
, amex
]
The scheme through which the payment is processed.
Masked card number showing only last four digits.
Masked card number showing first six and last four digits.
ID used for the backing acquirer gateway (MPG, MPGS or Cybersource).
The xx
part is different based on the payment source:
Possible values: Value must match regular expression ^\d{12}$
The RRN or retrieval reference number. This is a unique number for the transaction generated by the acquirer gateway and is sent to the issuer during the authorization process.
This number is not unique across schemes (e.g. Visa and mada).
This number can be useful in tracking the payment in the card holder account statement.
Human readable string representing the transaction result.
A two-digit string representing the authorization result (ISO 8583).
Response code 00
indicates that the payment is approved by the issuer. Please refer to the response code table
in the documentation for more information.
Possible values: Value must match regular expression ^\d{6}$
A six-digit number returned by the issuer in response to a successful authorization process.
Name of the card issuing bank. This name is inferred based on the card BIN or IIN.
Origin country of the card issuer. A two-letter ISO 3166 code.
Possible values: [debit
, credit
, charge_card
, unspecified
]
Indicates the card category or product type, e.g., Platinum, Signature, etc.
This field is a human readable text and does not have a defined set of values.
Possible values: [stcpay
]
Mobile number used to authorize the STC Pay payment.
Authorization attempt reference number returned by the STC Pay service.
Cashier identifier sent to STC Pay during request initiation. This will show in the merchant dashboard.
Branch identifier sent to STC Pay during request initiation. This will show in the merchant dashboard.
OTP challenge URL.
You must collect the OTP value from the user and make POST
request to the URL returned here along
with the OTP value in a parameter called: otp_value
.
Human readable string representing the transaction result.
{
"id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"status": "initiated",
"amount": 100,
"fee": 0,
"currency": "SAR",
"refunded": 0,
"refunded_at": "Date and time when the payment was refunded.",
"captured": 0,
"captured_at": "Date and time when the payment was captured.",
"voided_at": "Date and time when the payment was voided.",
"description": "Kindle Whitepaper",
"amount_format": "1.00 SAR",
"fee_format": "0.00 SAR",
"refunded_format": "0.00 SAR",
"captured_format": "0.00 SAR",
"invoice_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"ip": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"callback_url": "https://example.com/checkout/payer-return",
"created_at": "Date and time when the payment was created.",
"updated_at": "Date and time when the payment was last updated.",
"metadata": {
"cart_id": "72e470a5-cbc4-47b3-a52a-e89fda6adb19",
"customer_email": "[email protected]",
"customer_id": "23432"
},
"source": {}
}
- application/json
- Schema
- Example (from schema)
Schema
Contains the error type
Human readable error message for the error
Contains string-array pair representing a field and list of validation errors.
{
"type": "invalid_request",
"message": null,
"errors": {
"foo": "this is returned for validation errors only"
}
}
- application/json
- Schema
- Example (from schema)
Schema
Possible values: [authentication_error
]
Possible values: [Invalid authorization credentials
]
{
"type": "authentication_error",
"message": "Invalid authorization credentials",
"errors": null
}
- application/json
- Schema
- Example (from schema)
Schema
Possible values: [api_error
]
Possible values: [User not authorized
]
{
"type": "api_error",
"message": "User not authorized",
"errors": null
}