Refund one attempt

POST

/api/attempts/{attemptId}/refund

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "idempotency-key: refund-EP-123456-01");
headers = curl_slist_append(headers, "Authorization: Bearer <token>");
headers = curl_slist_append(headers, "Content-Type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{ \"amount\": 2500, \"extraData\": \"EP-123456 partial refund\" }");

CURLcode ret = curl_easy_perform(hnd);

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Post,
    RequestUri = new Uri("https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund"),
    Headers =
    {
        { "idempotency-key", "refund-EP-123456-01" },
        { "Authorization", "Bearer <token>" },
    },
    Content = new StringContent("{ \"amount\": 2500, \"extraData\": \"EP-123456 partial refund\" }")
    {
        Headers =
        {
            ContentType = new MediaTypeHeaderValue("application/json")
        }
    }
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund"

  payload := strings.NewReader("{ \"amount\": 2500, \"extraData\": \"EP-123456 partial refund\" }")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("idempotency-key", "refund-EP-123456-01")
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund"))
    .header("idempotency-key", "refund-EP-123456-01")
    .header("Authorization", "Bearer <token>")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("{ \"amount\": 2500, \"extraData\": \"EP-123456 partial refund\" }"))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{ \"amount\": 2500, \"extraData\": \"EP-123456 partial refund\" }");
Request request = new Request.Builder()
  .url("https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund")
  .post(body)
  .addHeader("idempotency-key", "refund-EP-123456-01")
  .addHeader("Authorization", "Bearer <token>")
  .addHeader("Content-Type", "application/json")
  .build();

Response response = client.newCall(request).execute();

import axios from 'axios';

const options = {
  method: 'POST',
  url: 'https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund',
  headers: {
    'idempotency-key': 'refund-EP-123456-01',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  data: {amount: 2500, extraData: 'EP-123456 partial refund'}
};

try {
  const { data } = await axios.request(options);
  console.log(data);
} catch (error) {
  console.error(error);
}

const url = 'https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund';
const options = {
  method: 'POST',
  headers: {
    'idempotency-key': 'refund-EP-123456-01',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{"amount":2500,"extraData":"EP-123456 partial refund"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{ \"amount\": 2500, \"extraData\": \"EP-123456 partial refund\" }")
val request = Request.Builder()
  .url("https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund")
  .post(body)
  .addHeader("idempotency-key", "refund-EP-123456-01")
  .addHeader("Authorization", "Bearer <token>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

use serde_json::json;
use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund";

    let payload = json!({
        "amount": 2500,
        "extraData": "EP-123456 partial refund"
    });

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("idempotency-key", "refund-EP-123456-01".parse().unwrap());
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());
    headers.insert("Content-Type", "application/json".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.post(url)
        .headers(headers)
        .json(&payload)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

curl --request POST \
  --url https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'idempotency-key: refund-EP-123456-01' \
  --data '{ "amount": 2500, "extraData": "EP-123456 partial refund" }'

wget --quiet \
  --method POST \
  --header 'idempotency-key: refund-EP-123456-01' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --body-data '{ "amount": 2500, "extraData": "EP-123456 partial refund" }' \
  --output-document \
  - https://example.com/api/attempts/0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c/refund

An attempt holds exactly ONE refundable operation, so naming the attempt says everything naming its capture would. An absent amount refunds what remains; extraData tags the credit line for reconciliation.

Authorizations

apiToken

Parameters

Path Parameters

attemptId

required

string format: uuid

/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/

The attempt, as a search returned it. A lowercase UUID — the ones we mint are v7.

Example

0193f6c1-8b3f-7c5e-a012-3d4e5f6a7b8c

Header Parameters

idempotency-key

string

>= 1 characters <= 64 characters

Makes the gesture replayable: a retry presenting a key already recorded on this attempt gets the recorded refund back — never a second one. Recommended whenever amount travels; optional (full refunds converge on their own).

Example

refund-EP-123456-01

Request Body^required

Send {} (or omit amount) for a full refund of what remains.

application/json

Send {} (or omit amount) for a full refund of what remains.

object

amount

Minor units to give back — a slice, when the method’s contract refunds partially. Absent: everything that remains refundable on the attempt.

integer

>= 1

Example

extraData

Your reconciliation tag for THIS refund — echoed in the PSP’s reporting where supported, and back on the refund transaction here.

string

>= 1 characters <= 255 characters

Example

EP-123456 partial refund

Responses

202

The refund operations this gesture produced, with their PSP verdicts — read each status.

application/json

object

refunds

required

The refund operations this call started, with the attempt and session each belongs to.

Array<object>

>= 1 items

The transaction, with the home that gives it meaning — session, order, attempt.

object

sessionId

required

The session this belongs to.

string format: uuid

merchantId

required

The merchant it belongs to.

string

orderId

required

Their own order reference.

string

attemptId

required

The attempt it belongs to.

string format: uuid

method

required

What the attempt behind this operation was paid with — card, paypal, wero… An operation alone does not say it, and reading a list of PSP operations without it means opening each one.

string

cardScheme

The card network that attempt ran on, when the PSP named one we could place — see the same field on an attempt.

string

transaction

required

The operation itself.

object

transactionId

required

Our handle for this PSP operation — what a refund door addresses.

string format: uuid

createdAt

required

When the operation was opened — epoch milliseconds (Q13).

integer

updatedAt

required

The last event that touched it — for a terminal transaction, its verdict’s instant.

integer

type

required

What this operation asked the PSP: hold the money, take it in one go, capture a hold, release a hold, or send money back.

string

Allowed values: authorization payment capture void refund

amount

required

What this operation moved, in minor units.

object

amount

required

Amount in the MINOR unit of the currency — 1000_00 is one thousand euros, never 1000.

integer

currency

required

ISO 4217 code, uppercase. One currency per session.

string

/^[A-Z]{3}$/

providerRef

The PSP’s reference — what their dashboard greps (D-047).

string

status

required

The VERDICT facet: what the PSP finally decided about this operation — as opposed to the ack facet below, which is what the driving call answered on the spot.

object

kind

required

Where the operation stands. pending means the verdict is still due — it always arrives out-of-band.

string

Allowed values: pending succeeded failed cancelled

statusCode

The PSP’s own code, split at the source — successes carry theirs too.

string

statusMessage

The PSP’s own sentence, as they said it — never glued to the code.

string

category

What a refusal means, when the PSP’s answer could be read.

string

Allowed values: bank-refusal insufficient-funds invalid-card-data authentication-failed expired method-unavailable

ackCode

What the driving call answered (the ack facet).

string

ackMessage

What the driving call said — a transport failure’s raw cause included.

string

ackHttpStatus

Absent beside a present ackMessage = no HTTP response ever came.

integer

extraData

The caller’s reconciliation tag, on refunds only (lot 5) — echoed verbatim.

string

Example

{
  "refunds": [
    {
      "method": "card",
      "cardScheme": "visa",
      "transaction": {
        "type": "authorization",
        "status": {
          "kind": "pending",
          "category": "bank-refusal"
        }
      }
    }
  ]
}

400

InvalidRequest — the request could not be read: a missing or malformed field, a bad pattern, or a property this door does not declare (the message names it). Every door with a schema can answer this, before any business rule is consulted. Most often here: InvalidRequestedAmount — the DOMAIN’s own refusal of a refund amount that is not a positive number of minor units (REFUND_STATUS), raised after validation has passed. Unreachable through this door as it stands: the schema bounds amount, and an omitted one resolves to what remains refundable. Declared because the code can answer it — a contract that hides a possible answer is the one that surprises.

application/json

object

code

required

Stable machine-readable code — the one thing to branch on. Never parse the message.

string

message

required

English sentence for logs and operators. Wording may change; the code will not.

string

Example

{
  "code": "InvalidRequestedAmount",
  "message": "the refund amount cannot be used"
}

401

Unauthorized — the only code this response carries: no usable access token (absent, malformed, expired). One answer for every failure shape, so nothing can be learned by watching which one comes back.

application/json

object

code

required

Stable machine-readable code — the one thing to branch on. Never parse the message.

string

message

required

English sentence for logs and operators. Wording may change; the code will not.

string

Example

{
  "code": "Unauthorized",
  "message": "a valid access token is required"
}

404

NotFound — the only code this response carries: unknown, or belonging to another merchant. The two are deliberately indistinguishable.

application/json

object

code

required

Stable machine-readable code — the one thing to branch on. Never parse the message.

string

message

required

English sentence for logs and operators. Wording may change; the code will not.

string

Example

{
  "code": "NotFound",
  "message": "no such resource"
}

409

Nothing to refund NOW: nothing taken or all refunded (NothingToRefund), a refund already in flight (RefundInFlight), more than what remains (RefundExceedsRefundable), or the session has not ended (SessionNotEnded).

application/json

object

code

required

Stable machine-readable code — the one thing to branch on. Never parse the message.

string

message

required

English sentence for logs and operators. Wording may change; the code will not.

string

Example

{
  "code": "NothingToRefund",
  "message": "no money was taken on this attempt — or it was all refunded already"
}

422

The method cannot: no refund at this PSP (RefundNotSupported), a full-only contract (PartialRefundNotSupported) — or the Idempotency-Key already names a refund of a DIFFERENT amount (IdempotencyKeyConflict).

application/json

object

code

required

Stable machine-readable code — the one thing to branch on. Never parse the message.

string

message

required

English sentence for logs and operators. Wording may change; the code will not.

string

Example

{
  "code": "PartialRefundNotSupported",
  "message": "this method refunds in full or not at all"
}

Refund one attempt

Authorizations

Parameters

Path Parameters

Example

Header Parameters

Example

Request Bodyrequired

Example

Example

Responses

202

Example

400

Example

401

Example

404

Example

409

Example

422

Example

Request Body^required