POST

Authorizations

Authorization
string
header
required

The caller's id_token from authentication — the ID token, not the access_token. The program and environment come from the token.

Body

application/json
action
enum<string>
required

Required — initiate, passkey-challenge or submit. verify is rejected with 403; it belongs to the /batch-payments/verify route.

Available options:
initiate,
passkey-challenge,
submit
payments
object[]

The payment items. Required for initiate and submit, and must be identical between them or SCA verification fails.

scaChallenge
object

The strong-customer-authentication challenge from initiate. Pass it back on submit.

confirmation
Passkey · object

Step-up confirmation (for submit). Set method to passkey, totp, or pin and include that method's fields. pin is a program capability — see Program capabilities.

idempotencyKey
string<uuid>

Optional UUID. Reuse the same key to make submit safe to retry — batch and item IDs are then derived deterministically, so a retry cannot double-pay.

batchId
string<uuid>

Required. The draft returned by verify. This route only pays a batch that was verified first, so initiate and submit both need it. It is checked for expiry and ownership and cannot be paid twice.

Response

Result for the requested step — initiatetotalAmount/currency/scaChallenge; passkey-challengepasskeySession/fido2options; submitbatchId/status/counts.

The response is of type object.