Submit the reviewed quote as a checkout attempt

post

https://apis.kentro.live/store/v1/checkout.start

Places the order from the quote the buyer reviewed: quoteFingerprint from cart.get { quote: true } and expectedRevision of that cart; a quote that changed since is refused (409) and the buyer reviews again. Creates a durable attempt, reserves stock and credits, then charges the saved payment method or opens the hosted payment page (state: "needs_action" with redirectUrl). idempotencyKey is yours (7 to 50 characters): a retry with the same key answers the same attempt. For a card entered on your page send opaqueData and cardMetadata (Authorize.net Accept.js) or nmiPaymentToken and cardMetadata (NMI Collect.js), configured by payments.cardConfig, never both tokens; for a bank debit send bankConsent: true; when the store requires an order review send orderReview with the accepted document ids. Read the attempt with checkout.status until it is complete (the order id) or declined.

Who may call it: A guest (X-Storefront-Guest), or a signed-in buyer (X-Storefront-Buyer) whose account is confirmed; an unconfirmed buyer is refused with 403 CONFIRMATION_REQUIRED.

Body Params

expectedRevision

integer

required

≥ 0

ownershipVersion

string

^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$

idempotencyKey

string

required

^[A-Za-z0-9_-]{7,50}$

quoteFingerprint

string

required

^[a-f0-9]{64}$

bankConsent

boolean

orderReview

object

guestAttempt

boolean

opaqueData

object

nmiPaymentToken

string

length between 1 and 1024

cardMetadata

object

Headers

X-Storefront-Host

string

required

length between 1 and 253

The published storefront host the request serves (shop.example.com, lower case). It must belong to the tenant of the API key; 404 NOT_FOUND when no published storefront answers it, 403 FORBIDDEN when it belongs to another account.

X-Storefront-Buyer

string

The signed-in buyer's access token (accessToken from POST https://apis.kentro.live/auth/login/customer). Absent for a guest or an anonymous visitor.

X-Storefront-Guest

string

The guest token session.guest answered, which identifies a guest cart and a guest checkout. Send it along with X-Storefront-Buyer at sign-in so the buyer can choose between the guest cart and the account cart.

X-Storefront-Client-Ip

string

The end buyer's IP address as your storefront server saw it. Used for per-visitor limits (search typeahead, sign-up); without it the limits apply to your server.

X-Expected-Portal

string

The store id (store.get answers id) your page was rendered for. When the host now resolves to another store the answer is 409 CONFLICT, so a stale page never acts on the wrong store.

X-Expected-Buyer

string

The identity your page was rendered for: the buyer id, guest:<guestId> for a guest, or guest for an anonymous visitor. A mismatch with the tokens sent is 409 CONFLICT, so a stale page never acts for the wrong buyer.

Responses

Language

Credentials

Header

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200The attempt and its state.

defaultThe request was refused or could not be completed; the status says why (400 validation, 401 sign-in needed, 403 not allowed, 404 unknown, 409 stale revision or version, 422 commerce rule, 429 too many, 503 unavailable).