01.software Docs

Confirm a custom-provider PaymentSession as a server

Use the SDK for application integration. This read-only reference covers Commerce, Customer Auth, Membership and Events.

All HTTP operations
POST
/api/orders/custom-payment-sessions/confirm

Records caller-verified capture evidence and finalizes the canonical Order. HMAC headers are required only when the tenant runtime policy requires custom-provider proof.

Authorization

publishableKeyserverSecretKey
headerX-Publishable-Key<token>

Tenant publishable key for authentication (sent via X-Publishable-Key header)

headerAuthorizationBearer <token>

Public integration credential: opaque sk01_ secret API key only; PAT and Customer JWT are not supported by this scheme. Requires tenant binding and the read or write scope named by the operation.

Header Parameters

X-Custom-Payment-Timestamp?string

Timestamp used in the policy-gated HMAC proof. Supply together with X-Custom-Payment-Signature.

Length1 <= length
X-Custom-Payment-Signature?string

HMAC-SHA256 over "{timestamp}.{rawBody}" when required by tenant policy.

Match^[A-Fa-f0-9]{64}$

Request Body

application/json
  1. body
provider*string
Match^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$
Length1 <= length <= 64
providerSessionId*string
Match\S
Length1 <= length
providerPaymentId*string
Match\S
Length1 <= length
providerEventId*string
Match\S
Length1 <= length
amount*integer
Range0 <= value <= 9007199254740991
currency*string

Captured amount currency. The Console canonicalizes it to uppercase.

Match^[A-Za-z]{3}$
Length3 <= length <= 3
occurredAt*string
Match\S
Length1 <= length

Response Body

Confirm a custom-provider PaymentSession as a server result

application/json
  1. response
orderId*string
Length1 <= length <= 255
transactionId*string
Length1 <= length <= 255
status*"paid"
Value in"paid"
alreadyConfirmed?boolean

True when the session was already confirmed at observation time; absent from the initial successful confirmation. This does not prove that the current call caused the transition and is not an exactly-once gate, including after a lost initial response.

Examples may be generated from schemas; they are illustrative, not recorded successful API calls. Example snippets may omit required authentication headers.

Example Request
curl -X POST 'https://api.01.software/api/orders/custom-payment-sessions/confirm' \  -H 'Content-Type: application/json' \  -d '{  "provider": "string",  "providerSessionId": "string",  "providerPaymentId": "string",  "providerEventId": "string",  "amount": 0,  "currency": "str",  "occurredAt": "string"}'
Example Response
{  "orderId": "string",  "transactionId": "string",  "status": "paid",  "alreadyConfirmed": true}