---
title: "Payment"
method: POST
path: "/payment"
---

# Payment

`POST /payment`

This endpoint enables you to process transactions securely and efficiently through our API.

## Request body

- object
  - `api_secret` string, required — This is the credential that Vendo will use to authenticate your request
  - `is_test` integer — Set to 1 if you want to process a test transaction. Check Appendix A for test card details.
  - `merchant_id` integer, required — Your Vendo Merchant ID. This will be provided by your account manager
  - `site_id` integer, required — The Vendo Site ID for which you're processing the transaction.
  - `amount` number, float, required — The amount that you want to charge the user. Example: 39.95
  - `currency` string, required — The 3-letter currency code of the amount to be charged. [Currencies](https://docs.vendoservices.com/docs/data-types#currency-codes)
  - `success_url` string — The URL to which the user must be redirected after a successful verification. If it isn't specified then our platform will fallback to the Success URL configured in Vendo's back office.
  - `mit` boolean — Merchant Initiated Transaction - set this flag to true when performing automatic recurring charges (i.e. rebills). The "mit" flag is false by default, indicating that the customer themselves initiated the transaction.
  - `preauth_only` boolean — Pre-Authorization Only. Set this flag to true when you do not want to capture the transaction amount immediately, but only validate the payment details and block (reserve) the amount. The capture of a preauth-only transaction can be performed with the Capture API. Only available for "card" type of payment
  - `non_recurring` boolean — Flags a payment as non-recurring. Set this to true if no MITs (merchant initiated transactions / rebills) will follow automatically. This may increase the chance of the transaction being accepted by some banks.
  - `external_references` object, required — This parameter has the following 4 child elements. All these values are pass-thru values, meaning that we'll post them back to you.
    - `transaction_reference` string, required — REQUIRED. A transaction reference that you can use to identify payments for specific users
    - `program_id` string — This is an extra parameter that you can use to track transactions for specific program IDs if you run multiple programs. This is specific for some e-commerce markets, it's an optional parameter
    - `campaign_id` string — This is an extra parameter that you can use to track transactions for specific Campaign IDs if you run multiple Marketing Campaigns. This is specific for some e-commerce markets, it's an optional parameter
    - `affiliate_id` string — This is an extra parameter that you can use to track transactions for specific Affiliate IDs if you run an affiliation program. This is specific for some e-commerce markets, it's an optional parameter
  - `items` object — This parameter has the following 4 child elements. The child elements refer to the items that you're charging the user for.
    - `item_id` string, required — REQUIRED. The ID of the item
    - `item_description` string, required — REQUIRED. The description of the item
    - `item_price` number, float, required — REQUIRED. The price of the item
    - `item_quantity` string, required — REQUIRED. The number of items that the user bought.
  - `payment_details` object, required — There are different possible sets of child elements depending on the payment_type: card, [sepa](https://docs.vendoservices.com/docs/sepa), pix, [oxxo](https://docs.vendoservices.com/docs/oxxo) crypto, [paybybank](https://docs.vendoservices.com/docs/pay-by-bank), wallet or tokenized.
    - `payment_method` string, required — REQUIRED for non-tokenized transactions. Supported values: card|[sepa](https://docs.vendoservices.com/docs/sepa)|pix|[oxxo](https://docs.vendoservices.com/docs/oxxo)|crypto|[paybybank](https://docs.vendoservices.com/docs/pay-by-bank)|wallet. Not used for Tokenized payments. Automatic rebills are not supported for some payment methods, f.ex. PIX, Pay by Bank, Crypto.
    - `card_number` string, required — REQUIRED for Card payments only. The credit/debit card number. For test transactions please check Appendix A to get the card details that you must use.
    - `expiration_month` string, required — REQUIRED for Card payments only. The expiration month of the card. Example: 09
    - `expiration_year` string, required — REQUIRED for Card payments only. The expiration year of the card. Example: 2025
    - `cvv` string — The CVV number. We accept 3 or 4 characters only. If you pass in the trace_id then you can't specify the CVV.
    - `name_on_card` string, required — REQUIRED for Card payments only. The name that is printed in the credit/debit card
    - `iban` string — Optional for Sepa payments. The International Bank Account Number. If it is not included in the request, the user will be prompted to provide it on the mandate page.
    - `bic_swift` string — Optional for Sepa payments. The SWIFT Code of the bank. Not required for EU bank accounts.
    - `mandate` object — Optional for Sepa payments. Mandate reference collected on merchant side.
      - `reference` string, required — Unique identifier mandate reference
    - `token` string, required — REQUIRED for tokenized payments only. Contains the tokenized payment data returned from the previous request.
    - `verification_id` integer — Use verification_id to reference verification of the payment method. Optional
    - `trace_id` string — Optional for Card payments. This parameter allows you to reference a previous transaction processed through a card scheme (e.g., Visa, MasterCard).
    - `three_ds` object — A set of authentication 3DS parmeters
      - `version` string, required — 3DS version, example: 2.2.0
      - `ds_transaction_id` string, required — Example: 0902482e-9e4a-5c41-8000-00000e2dce0b
      - `cavv` string, required — cavv, base 64 encoded string. example: jO7WU8G1ZGPhCBEChBQbAigAAAA=
      - `eci` string, required — eci. example: "02"
      - `xid` string, required — xid, base 64 encoded string. example: MjQwNjAzMDQyLTY3YjM1ZmY4YjQ=
      - `enrollment_status` string, required — Example: "Y"
    - `provider` string, required — REQUIRED for wallet payments only (e.g., Google Pay). Supported value: googlepay.
    - `data` object, required — REQUIRED for wallet payments only (e.g., Google Pay). Contains the tokenization parameters returned by the wallet provider.
      - `token` string, required — Token returned by the wallet provider.
  - `customer_details` object, required — REQUIRED for non-tokenized transactions. This node is not allowed for token transactions. This parameter contains the following 10 child elements. Not all of them are mandatory. This element contains the user's personal details.
    - `first_name` string, required — REQUIRED. The user's first name
    - `last_name` string, required — REQUIRED. The user's last name
    - `language` string, required — REQUIRED. The user's language. You must pass a valid ISO-639-1 string. e.g. en, es, de, nl, pt
    - `address` string — The user's address
    - `city` string — The user's city name
    - `state` string — The user's state or country region. eg. FL, CA. (Value can have up to 3 characters)
    - `country` string, required — REQUIRED. The user's country. You must pass a valid ISO 3166-1 alpha-2 Country Code string e.g. US, ES, DE, GB. For PIX must be BR. For Pay by Bank check the [available countries](https://docs.vendoservices.com/docs/pay-by-bank#availability-by-country).
    - `postal_code` string — The user's postal code
    - `email` string, required — REQUIRED. The user's email address
    - `phone` string — The user's phone number
    - `national_identifier` string — Optional for PIX payments, the national identifier (CPF) can be collected either on your checkout page or later in the payment process.
  - `shipping_address` object — Mandatory shipping address details. If you don't use shipping addresses, you don't have to send this at all.
    - `first_name` string, required — REQUIRED. Recipient's first name
    - `last_name` string, required — REQUIRED. Recipient's last name
    - `address` string, required — REQUIRED. Recipient address
    - `city` string, required — REQUIRED. Recipient's city
    - `state` string, required — REQUIRED. Recipient's state. Examples: FL, AKA, CA. (Value can have up to 3 characters)
    - `country` string, required — REQUIRED. Recipient's country. Use ISO 3166-1 alpha-2 Country Code string e.g. US, ES, DE, GB
    - `postal_code` string, required — REQUIRED. Recipient's postal code.
    - `phone` string, required — REQUIRED. Recipient's phone number.
  - `request_details` object, required — This parameter contains 2 child elements. Not all of them are mandatory.
    - `ip_address` string, required — REQUIRED. The user's ip address.
    - `browser_user_agent` string — The user agent of the user's browser
  - `subscription_schedule` object — Use this parameter to start a S2S Sign-up subscription and schedule automatic rebills. Only supported for payment methods that allow automatic rebills. Not supported for f.ex. PIX, Pay by Bank or Crypto.
    - `next_rebill_date` string, date — This field specifies the date for the upcoming first rebill after a limited trial period or a subscription extension is applied. The format must be YYYY-MM-DD (e.g., 2024-03-14). The date must be in the future and use the Central European Time (CET) time zone.
    - `rebill_amount` number, float, required — Amount to bill. Currency is original transaction currency. Example: 10.34. Min: 0, Max: 1 000 000
    - `rebill_duration` integer, required — Time between rebills in days. Example: 30 for a monthly subscription. Min. 1 day. Min: 1, Max: 365
    - `reactivate_subscription` boolean — Optional parameter. It can be used to reactivate an expired subscription.
  - `cross_sale` object — Use this section to create a S2S Cross Sale. Skip it for other types of transactions..
    - `initial_transaction_id` integer — Vendo transaction id from the original signup transaction.

## Response `200`

200

- union
  - object
    - `status` integer
    - `external_references` object
      - `transaction_reference` string
      - `program_id` string
      - `campaign_id` string
      - `affiliate_id` string
    - `transaction` object
      - `id` integer
      - `amount` string
      - `currency` string
      - `datetime` string
    - `card_details` object
      - `auth_code` string
    - `payment_details_token` string
    - `request_id` string
  - object
    - `status` integer
    - `external_references` object
      - `transaction_reference` string
      - `program_id` string
      - `campaign_id` string
      - `affiliate_id` string
    - `transaction` object
      - `id` integer
      - `amount` string
      - `currency` string
      - `datetime` string
    - `sepa_details` object
      - `mandate_id` string
      - `mandate_signed_date` string
    - `payment_details_token` string
    - `request_id` string
  - object
    - `status` integer
    - `external_references` object
      - `transaction_reference` string
      - `program_id` string
      - `campaign_id` string
      - `affiliate_id` string
    - `transaction` object
      - `id` integer
      - `amount` string
      - `currency` string
      - `datetime` string
    - `card_details` object
      - `auth_code` string
    - `request_id` string

## Other responses

- `201` — 201
- `400` — 400

---

[API](https://skmtc.net/vendoservices/apis/s2s-api.md) · [All operations](https://skmtc.net/vendoservices/apis/s2s-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vendoservices/s2s-api/versions/ec9a04326468/schema)