Kentro services only (403 otherwise). Only an applied internal bank charge with a provider transaction (createdSource internally); any other payment is 409 state_conflict. The order and its open fulfillment orders are paused for payment whatever shipBeforePayment says. A canceled payment answers unchanged.

Scope: payments:write, channel:write or admin. A permission group made before the Channel API scopes existed grants it as payments:manage.

Idempotency: send Idempotency-Key; a retry with the same key replays the first answer.

Rate limit: write class, 1,200 requests per minute per tenant by default (read class 6,000). Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; a refusal is 429 rate_limited with Retry-After.