StoreBay Developers
Commerce

Start (or idempotently re-read) an order's payment session

Enqueues a card charge or a Bacs Direct Debit mandate setup through the outbox — never a provider call inline. Re-entry with a live session already attached to the order returns that SAME session, never a second charge/mandate intent.

POST
/orders/{id}/pay

Enqueues a card charge or a Bacs Direct Debit mandate setup through the outbox — never a provider call inline. Re-entry with a live session already attached to the order returns that SAME session, never a second charge/mandate intent.

Authorization

AuthorizationBearer <token>

Present an API key (sb_live_… / sb_test_…), an OAuth2 access token, or a static token as a Bearer credential. The operator is implied by the credential; it is never in the path. Only a SHA-256 hash of an API key is stored server-side.

In: header

Path Parameters

id*string

UUIDv7 identifier of the resource.

Formatuuid

Header Parameters

Idempotency-Key?string

A unique key that makes this mutation safe to retry. Repeats replay the stored response; reuse with a different body returns 409 idempotency_conflict.

Lengthlength <= 255

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/orders/497f6eca-6276-4993-bfeb-53cbbbba6f08/pay" \  -H "Content-Type: application/json" \  -d '{    "rail": "card"  }'
{  "data": {    "object": "payment_session",    "order_id": "93101167-9065-4b9c-b98b-5d789a3ed9fe",    "rail": "card",    "status": "none",    "payment_id": "d43b87f9-9e28-4802-8eaa-6ee91a40ea71",    "mandate_id": "e98a8906-c5df-4f83-89a8-e8197c5fddcb",    "client_secret": "string",    "authorisation_url": "string",    "due_today_minor": 0,    "currency": "string"  }}
{  "error": {    "code": "unauthorized",    "message": "Missing or invalid credential."  }}
{  "error": {    "code": "insufficient_scope",    "message": "The credential lacks a scope required by this endpoint."  }}
{  "error": {    "code": "not_found",    "message": "Resource not found."  }}
{  "error": {    "code": "conflict",    "message": "The request conflicts with current resource state."  }}
{  "error": {    "code": "validation_error",    "message": "One or more fields are invalid.",    "details": [      {        "field": "email",        "issue": "must be a valid email address"      }    ]  }}
{  "error": {    "code": "validation_error",    "message": "string",    "details": [      {        "field": "string",        "issue": "string"      }    ]  }}

List subscriptions GET

Previous Page

Place an order POST

A draft order with a contact and at least one unit line moves to awaiting_payment and is assigned an order number. A consumer (B2C) order additionally requires the CCR pre-contract consent recorded via the order's checkout_state.ccr — without it placement is refused with the ccr_consent_required 409 (a total-changing basket edit clears the recorded consent and re-gates).