Get payment intent

GET/v1/payments/{paymentId}

Accepts X-Api-Key · oauthClientCredentials · bearer

Read a payment intent — what a client re-reads after a hosted checkout returns

The intent's current answer: the same PaymentIntentResponse the create, capture and refund routes answer, with `checkout` while a hosted checkout session is active.Show more

The intent's current answer: the same PaymentIntentResponse the create, capture and refund routes answer, with `checkout` while a hosted checkout session is active. This is the read a client makes after the hosted page redirects back; the redirect's `status` query parameter is advisory and never authority. A read of an intent that already exists: it stays up for a SUSPENDED tenant and for a tenant whose production activation is not approved, like capture and refund, so its 403 is only PERMISSION_DENIED for a credential without payments:write. An unknown id and another tenant's id are the same 404. A synchronous state is provisional until the provider's webhook lands.

Path parameters

paymentIdstringRequired
The paymentId returned by POST /v1/payments/intent

Request body

This operation takes no request body.

Responses

200The payment intentPaymentIntentResponse
401
UNAUTHENTICATED — missing or expired token.Show more
UNAUTHENTICATED — missing or expired token. Declared on every operation because `security` is declared globally at the document root: every route is authenticated, so every route can answer 401.
ApiErrorResponse
403PERMISSION_DENIED — the credential lacks payments:writeApiErrorResponse
404NOT_FOUND — no such payment intent for this tenantApiErrorResponse
405
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge).Show more
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge). Not retryable as sent.
ApiErrorResponse
414
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge).Show more
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge). Not retryable as sent: send long input in the body of a POST.
ApiErrorResponse
429
RATE_LIMITED — the API key or its tenant is over a rate limit; wait for Retry-After, then retry.Show more
RATE_LIMITED — the API key or its tenant is over a rate limit; wait for Retry-After, then retry. Every routed request is counted against two token buckets, the key's and the tenant's (all its keys together): 50 requests a second with a burst of 100 on the standard plan. Every travel verb except polling a search also spends from a supplier budget, per key and per tenant: 10 requests a second with a burst of 20, and a plan may add a daily quota of supplier calls. Answers carry the IETF RateLimit header fields for the tightest bucket consulted (RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, RateLimit-Policy); a refusal adds Retry-After and details.scope (KEY or TENANT), details.budget (PLATFORM or SUPPLIER), details.reason (RATE or DAILY_QUOTA), details.tier and details.retryAfterMs. A sandbox may run with the limiter off, in which case none of these headers is sent. A search that is still warming is a different answer with a different meaning (keep polling). with the key-velocity check on, also details.reason VELOCITY_LIMIT, a soft breach of the API key's own scope (components/responses/VelocityLimited), nextAction slow_down.
ApiErrorResponse
500INTERNAL — a bug, and traceId is the support handle.ApiErrorResponse
501
NOT_IMPLEMENTED — this deployment serves no payments: no payment provider is configured (provider=none), so every payment route answers 501.Show more
NOT_IMPLEMENTED — this deployment serves no payments: no payment provider is configured (provider=none), so every payment route answers 501. Not a capabilities-doc bug: payments are deployment configuration.
ApiErrorResponse

Errors you should handle

Branch on code and honour retryable — never on the HTTP status alone.

401	UNAUTHENTICATED The bearer token is expired. Re-authenticate and retry.	not retryable
403	PERMISSION_DENIED Role lacks the required scope: payments:write	not retryable
404	NOT_FOUND No such payment intent.	not retryable
405	VALIDATION This method is not served.	not retryable
414	VALIDATION The request URI is longer than 8 KiB.	not retryable
429	RATE_LIMITED Too many requests for this key on the supplier budget. Wait for the Retry-After interval before trying again.	retryable
500	INTERNAL An unexpected error occurred. Quote the traceId to support.	retryable
501	NOT_IMPLEMENTED This deployment serves no payments: no payment provider is configured.	not retryable