Commerce
Retrieve an order's live payment session
The single, deliberate bridge that surfaces a live client_secret/authorisation_url from the order's payment/mandate to the paying surface — exactly two fields, never the raw external_refs jsonb.
The single, deliberate bridge that surfaces a live client_secret/authorisation_url from the order's payment/mandate to the paying surface — exactly two fields, never the raw external_refs jsonb.
AuthorizationBearer <token>
Present an API key (sb_live_… / sb_test_…), an OAuth2 access token, or a static token as a Bearer credential. The operator is implied by the credential; it is never in the path. Only a SHA-256 hash of an API key is stored server-side.
In: header
Path Parameters
id*string
UUIDv7 identifier of the resource.
Format
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/orders/497f6eca-6276-4993-bfeb-53cbbbba6f08/payment_session"{ "data": { "object": "payment_session", "order_id": "93101167-9065-4b9c-b98b-5d789a3ed9fe", "rail": "card", "status": "none", "payment_id": "d43b87f9-9e28-4802-8eaa-6ee91a40ea71", "mandate_id": "e98a8906-c5df-4f83-89a8-e8197c5fddcb", "client_secret": "string", "authorisation_url": "string", "due_today_minor": 0, "currency": "string" }}{ "error": { "code": "unauthorized", "message": "Missing or invalid credential." }}{ "error": { "code": "insufficient_scope", "message": "The credential lacks a scope required by this endpoint." }}{ "error": { "code": "not_found", "message": "Resource not found." }}{ "error": { "code": "validation_error", "message": "string", "details": [ { "field": "string", "issue": "string" } ] }}