Hosted payments
The two calls the hosted booking flow makes to take payment. Documented, not offered.
These endpoints belong to the hosted booking flow. They are listed here so that the public surface is completely described, not because they are an integration point.
Both require a payment key that is issued inside the flow and never returned by any public
endpoint, and payment/submit will only accept a returnUrl on the booking origin itself. There is
no way to drive them from your own checkout, and that is deliberate — card details are handled by
the organisation's payment provider inside our page, so neither you nor we ever hold them.
If you want to take payment yourself, take it in your own system and book the job as an unpaid
order through POST /orders. The organisation will see it as unpaid and can
reconcile it against your settlement.
POST/api/public/{organisation}/orders/{orderId}/payment
Open or cancel the payment session for an order placed through the hosted booking page.
- Part of the hosted booking flow. Documented for completeness, not as an integration point.
- Browser only — the API requires an allowlisted Origin header.
Path parameters
| Name | Description |
|---|---|
organisation | The organisation's booking slug. |
orderId | The order returned when the booking was placed. |
Headers
| Name | Required | Description |
|---|---|---|
Content-Type | Yes | Must be `application/json`. |
Origin | Yes | Must be an allowlisted origin. |
Body
Generated from the schema the API validates with, so it cannot describe a body the API would reject.
| Field | Type | Required | Notes |
|---|---|---|---|
key | string | Yes | 32–120 characters |
cancel | boolean | No |
Errors
| Status | When |
|---|---|
403 | The payment key does not match the order. |
404 | No such order for this organisation. |
POST/api/public/{organisation}/orders/{orderId}/payment/submit
Submit a payment token against an order, returning where the payer should be sent next.
- Part of the hosted booking flow. Documented for completeness, not as an integration point.
- Browser only — the API requires an allowlisted Origin header.
Path parameters
| Name | Description |
|---|---|
organisation | The organisation's booking slug. |
orderId | The order being paid. |
Headers
| Name | Required | Description |
|---|---|---|
Content-Type | Yes | Must be `application/json`. |
Origin | Yes | Must be an allowlisted origin. |
Body
Generated from the schema the API validates with, so it cannot describe a body the API would reject.
| Field | Type | Required | Notes |
|---|---|---|---|
key | string | Yes | 32–120 characters |
token | string | Yes | 1–2000 characters |
returnUrl | string | Yes | up to 2000 characters |
Errors
| Status | When |
|---|---|
403 | The payment key does not match the order. |
422 | The return URL is not the booking origin. |