Report a payment update
POST/payment-updates
One route for every payment step, chosen by type. Send no card data, only your references.
Each update needs its own Idempotency-Key.
type | When | Result |
|---|---|---|
hold_authorized | You placed a hold for exactly expectedPayment. | Creates one booking, waiting for the provider's decision. Reporting the same hold again returns the same booking. |
capture_succeeded | The booking is approved or completed and you captured the hold. | paymentStatus: captured. |
capture_failed | You could not capture. | The booking stays approved: capture again, or cancel the booking. |
hold_released | The booking is declined or cancelled, or no booking was created. | paymentStatus: released. |
amount and currency must equal the quoted or booked amount exactly, whatever you charge your own
customer, or the update is 422 PAYMENT_AMOUNT_MISMATCH (checked first). occurredAt is when the event
happened at your payment provider, in UTC epoch milliseconds; a value in seconds, or more than five
minutes ahead of the current time, is 400.
Capture only an approved or completed booking: otherwise the update is 409 INVALID_PAYMENT_TRANSITION,
the booking is flagged for All Out's operations team, and you must refund your customer. Repeating a report
changes nothing. A capture_failed that arrives after capture_succeeded does not undo it.
If the request can no longer be used (409 AVAILABILITY_NOT_CONFIRMED or 409 AVAILABILITY_EXPIRED),
no booking is created: release the hold.
Request
Responses
- 200
- 201
- 400
- 401
- 403
- 404
- 409
- 413
- 422
- 429
- 503
The update was already applied; the booking is returned unchanged.
Hold reported; the booking was created.
A field is missing or wrong. The message names it. Fix the request.
No token, an expired token, or wrong credentials (UNAUTHORIZED). Get a new token.
Your account is suspended (PARTNER_DISABLED), whatever token you hold. Contact All Out.
Not yours, not assigned to you, or does not exist (NOT_FOUND). Also a path or method that does not exist.
A conflict with the current state. error.code is one of REFERENCE_CONFLICT, AVAILABILITY_NOT_CONFIRMED,
AVAILABILITY_EXPIRED, PAYMENT_REFERENCE_CONFLICT, IDEMPOTENCY_CONFLICT, INVALID_PAYMENT_TRANSITION or
CANCELLATION_NOT_ALLOWED. See the error codes guide.
The JSON body is larger than 100 KB, or a document picture is larger than 5 MB (INVALID_REQUEST).
The amount is not the quoted or booked amount (PAYMENT_AMOUNT_MISMATCH). Release; never hold a different amount.
Too many requests (RATE_LIMITED). Wait the seconds in the Retry-After header.
Response Headers
Seconds to wait.
The service did not answer (UNAVAILABLE). The outcome may be unknown. Retry with the same Idempotency-Key, or read the booking.