Confirm a pending attempt with the payment provider

post

https://apis.kentro.live/store/v1/checkout.confirm

Asks the payment provider what happened to the attempt (attemptId) and completes the order when the payment succeeded, for example when the buyer returns from the hosted payment page. Safe to repeat; it never charges again.

Who may call it: The identity that started the attempt: the signed-in buyer, or the guest (send the same X-Storefront-Guest and guestAttempt: true). A signed-in buyer recovering an attempt started as a guest sends both tokens.

Body Params

attemptId

string

required

^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$

guestAttempt

boolean

Headers

X-Storefront-Host

string

required

length between 1 and 253

The published storefront host the request serves (shop.example.com, lower case). It must belong to the tenant of the API key; 404 NOT_FOUND when no published storefront answers it, 403 FORBIDDEN when it belongs to another account.

X-Storefront-Buyer

string

The signed-in buyer's access token (accessToken from POST https://apis.kentro.live/auth/login/customer). Absent for a guest or an anonymous visitor.

X-Storefront-Guest

string

The guest token session.guest answered, which identifies a guest cart and a guest checkout. Send it along with X-Storefront-Buyer at sign-in so the buyer can choose between the guest cart and the account cart.

X-Storefront-Client-Ip

string

The end buyer's IP address as your storefront server saw it. Used for per-visitor limits (search typeahead, sign-up); without it the limits apply to your server.

X-Expected-Portal

string

The store id (store.get answers id) your page was rendered for. When the host now resolves to another store the answer is 409 CONFLICT, so a stale page never acts on the wrong store.

X-Expected-Buyer

string

The identity your page was rendered for: the buyer id, guest:<guestId> for a guest, or guest for an anonymous visitor. A mismatch with the tokens sent is 409 CONFLICT, so a stale page never acts for the wrong buyer.

Responses

Language

Credentials

Header

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200The attempt and its state.

defaultThe request was refused or could not be completed; the status says why (400 validation, 401 sign-in needed, 403 not allowed, 404 unknown, 409 stale revision or version, 422 commerce rule, 429 too many, 503 unavailable).