Payments
List payments
const url = 'https://api.timbro.do/v1/payments?limit=20';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.timbro.do/v1/payments?limit=20' \ --header 'Authorization: Bearer <token>'Returns newest payments first with a deterministic opaque cursor.
Authentication
Section titled “Authentication”Parameters
Section titled “Parameters”Query parameters
Section titled “Query parameters”Rows on one page.
The nextCursor of the previous page. A cursor belongs to the list, tenant, mode, and filter set that minted it.
Repeat the parameter to admit more than one status.
Return only the Payment with exactly this paymentReference.
Return only the Payments that collect this Invoice, in full or in parts.
Responses
Section titled “Responses”A page of merchant Payments with decimal Money.
Response fields and codes
A page of merchant Payments with decimal Money.
object
object
Payment identifier. Opaque; do not parse beyond the prefix.
Only succeeded, canceled, and expired are terminal. A declined attempt returns the Payment to requires_customer_action with lastDecline, so the payer can try again until the Payment expires. partially_authorized means some shares have reserved funds, authorized means every share is reserved and awaits the organizer’s capture command, capturing means capture is running, and releasing means reserved funds are being released. verifying is a real, non-terminal status; it is not an error or decline.
Immutable commercial source coordinate supplied by the merchant adapter.
object
Merchant-owned searchable business reference. It is immutable after create, need not be unique, and does not identify command retries.
Read-only checkout presentation assembled from merchant configuration.
object
Interface language. Amount notation and currency are independent of language.
object
object
object
object
object
Card brands certified for this Payment’s Merchant Account snapshot.
3-D Secure programs selected for this immutable Payment journey. An empty list means card submission does not use 3DS.
Unpredictable bearer handle for the full receipt projection after terminal payment. Possession reveals buyer identity and itemization; keep it private.
The most recent declined attempt. A decline ends the attempt, not the Payment; the payer can try again until the Payment expires. Submitting the next attempt, canceling the Payment, or creating, replacing, or renewing its split clears it; expiry keeps it.
object
Normalized decline code. Raw provider codes are not public.
Customer-safe explanation. Wording may change.
When the gateway recorded the provider’s decline of this attempt.
An approved payment whose settlement evidence needs operator resolution. It does not withdraw the approval.
object
Normalized classification of a settlement problem found after approval.
Retained Invoice instructions and recipient choice. Invoice lifecycle and access credentials are reported separately.
object
One RFC 9457 problem body returned on the /v1 surface.
object
Present only when the rejected request produced a Fiscal operation.
Present only when the authoritative issuance rules refused to issue.
Present only when the rejection points at a value the request carried.
One stable public document problem retained for a rejected admission.
object
object
object
object
Increases each time the Invoice type, buyer, or government eligibility changes.
Reconciliation progress while status is verifying.
object
object
object
object
object
object
object
Presentation metadata. It is excluded from the fiscal canonical content.
object
object
object
object
object
Immutable payment request identity within merchant and TEST/LIVE scope.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
object
Aggregate split state. captured is settled money; authorized is reserved money; releasing and released describe authorization release.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
object
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
Authorization and capture state for one share. authorized means funds are reserved; succeeded means the reservation was captured.
The most recent declined attempt. A decline ends the attempt, not the Payment; the payer can try again until the Payment expires. Submitting the next attempt, canceling the Payment, or creating, replacing, or renewing its split clears it; expiry keeps it.
object
Normalized decline code. Raw provider codes are not public.
Customer-safe explanation. Wording may change.
When the gateway recorded the provider’s decline of this attempt.
object
object
object
object
object
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
object
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
Subscription owning this billing period
object
Merchant web destination offered after Checkout. Payment status must be retrieved from the API.
Merchant-authored context label such as Mesa 12.
Concise description of the product or service being purchased.
Server-computed money composition. The invariant is payableTotalMinorUnits = fiscalDeclaredTotalMinorUnits + nonBillableMinorUnits; legal and voluntary tips are never double-counted.
object
object
object
Fiscal declared total: taxable bases, taxes, exempt lines, and legal tip. Non-billable lines are excluded.
Commercial payable total: fiscalDeclaredTotalMinorUnits plus nonBillableMinorUnits. This is the amount collected before a voluntary tip.
object
Send the customer to the hosted checkout page.
object
Open in a top-level browsing context.
Merchant-owned keys carried with this Payment: at most 20 keys of 1 to 40 characters, each holding a string of at most 500 characters. Checkout stores it opaquely, never branches on it, never sends it to a payment provider, and never repeats it in a webhook body or a payer projection. It lives as long as its Payment and is deleted with it. Never put personal data or card data in it.
object
object
object
Stable identifier for one captured payment allocation.
An exact decimal monetary amount.
object
Example
DOPExact nonnegative decimal amount, with at most two fractional digits.
object
object
object
object
True when a further page follows this one.
Headers
Section titled “Headers”Identifies this request. Quote it when you contact support.
The request could not be understood.
Example
{ "type": "about:blank", "title": "The request could not be understood.", "status": 400, "code": "parameter_invalid", "requestId": "request_000000000000000000000001"}Response fields and codes
RFC 9457 problem details. Every failure of this API is one of these, and each operation narrows code to the subset it can emit.
object
Stable machine-readable code. Branch on this, never on title.
Optional fields
Present only when the rejected request produced a Fiscal operation.
Present only when the authoritative issuance rules refused to issue.
Present only when the rejection points at a value the request carried.
One stable public document problem retained for a rejected admission.
object
Headers
Section titled “Headers”Identifies this request. Quote it when you contact support.
The credential is missing, malformed, or no longer valid.
Example
{ "type": "about:blank", "title": "The credential is missing, malformed, or no longer valid.", "status": 401, "code": "api_key_missing", "requestId": "request_000000000000000000000001"}Response fields and codes
RFC 9457 problem details. Every failure of this API is one of these, and each operation narrows code to the subset it can emit.
object
Stable machine-readable code. Branch on this, never on title.
Optional fields
Present only when the rejected request produced a Fiscal operation.
Present only when the authoritative issuance rules refused to issue.
Present only when the rejection points at a value the request carried.
One stable public document problem retained for a rejected admission.
object
Headers
Section titled “Headers”Identifies this request. Quote it when you contact support.
The credential is valid but not permitted to perform this operation.
Example
{ "type": "about:blank", "title": "The credential is valid but not permitted to perform this operation.", "status": 403, "code": "operation_not_permitted", "requestId": "request_000000000000000000000001"}Response fields and codes
RFC 9457 problem details. Every failure of this API is one of these, and each operation narrows code to the subset it can emit.
object
Stable machine-readable code. Branch on this, never on title.
Optional fields
Present only when the rejected request produced a Fiscal operation.
Present only when the authoritative issuance rules refused to issue.
Present only when the rejection points at a value the request carried.
One stable public document problem retained for a rejected admission.
object
Headers
Section titled “Headers”Identifies this request. Quote it when you contact support.
The request could not complete. Recover by the retained resource reference or retry with the same command identity.
Example
{ "type": "about:blank", "title": "The request could not complete. Recover by the retained resource reference or retry with the same command identity.", "status": 500, "code": "internal_error", "requestId": "request_000000000000000000000001"}Response fields and codes
RFC 9457 problem details. Every failure of this API is one of these, and each operation narrows code to the subset it can emit.
object
Stable machine-readable code. Branch on this, never on title.
Optional fields
Present only when the rejected request produced a Fiscal operation.
Present only when the authoritative issuance rules refused to issue.
Present only when the rejection points at a value the request carried.
One stable public document problem retained for a rejected admission.
object
Headers
Section titled “Headers”Identifies this request. Quote it when you contact support.
A required service is temporarily unavailable. Retry with the same reference or command identity.
Example
{ "type": "about:blank", "title": "A required service is temporarily unavailable. Retry with the same reference or command identity.", "status": 503, "code": "integration_authorization_unavailable", "requestId": "request_000000000000000000000001"}Response fields and codes
RFC 9457 problem details. Every failure of this API is one of these, and each operation narrows code to the subset it can emit.
object
Stable machine-readable code. Branch on this, never on title.
Optional fields
Present only when the rejected request produced a Fiscal operation.
Present only when the authoritative issuance rules refused to issue.
Present only when the rejection points at a value the request carried.
One stable public document problem retained for a rejected admission.
object
Headers
Section titled “Headers”Identifies this request. Quote it when you contact support.
Seconds to wait before repeating this request or reading the resource again.