Skip to content
FreeTicketDocs
Esc
↑↓navigate↵open⌘Jpreview

Open payment for a reservation (Bold or MercadoPago, depending on the event)

Requires the X-Customer-Session header. The enterprise service API key is OPTIONAL (with a key, results are additionally scoped to the workspace pinned to it). The payment rail is chosen on the SERVER: Bold-eligible events (legend plan + allowlist) return the SIGNED configuration of the embedded Bold Payment Button (apiKey + renderMode: "embedded" + integritySignature, …), which the landing page mounts with new BoldCheckout({...}); all others return publicKey + amount + currency + reference + payerEmail to mount the MercadoPago Payment Brick (POST .../payment/card to charge, POST .../payment/pse for PSE). The landing page tells the rails apart by the SHAPE of the response (apiKey/renderMode ⇒ Bold, publicKey ⇒ MercadoPago), never by a separate flag. The sale must belong to the session buyer (and, with a key, to the workspace pinned to it): anything else is 404. Responds 409 with code PAYMENT_UNAVAILABLE if the reservation expired, the sale is no longer pending, or (Bold only) the event has no legend plan or a payment attempt is already in flight with another gateway. {id} accepts the sale id or its reference. Limited to 10 opens per minute per buyer (429 with Retry-After).

POST/customer/orders/{id}/payment
Authorization
AuthorizationAPI key · headerrequired

API key prefixed with Bearer . Alternative: the x-api-key header with the raw key. Available scopes: read and write (see /.well-known/oauth-protected-resource).

or
x-api-keyAPI key · headerrequired

Raw API key (without Bearer ), alternative to Authorization.

Path parameters
idstringrequired
Header parameters
X-Workspace-Idstring

Active workspace to operate on. Optional: when omitted, the default workspace of the user who owns the key is used (pickActiveOrg).

X-Purchase-Sessionstring

Purchase session id (POST /customer/purchase-sessions). Required when the event's workspace enforces a single purchase session; if present, it is always validated. The requirement is decided by the EVENT, not the API key: it applies if the owning workspace, a linked artist or a catalog seller of the show has the flag, with or without a key. Rejections (409; uppercase error.code and the slug in error.details.reason): PURCHASE_SESSION_REQUIRED (missing, or belongs to another buyer or another event date), PURCHASE_SESSION_SUPERSEDED (another tab or device replaced it), PURCHASE_SESSION_EXPIRED (the map clock ran out before the order was created), PURCHASE_SESSION_BUSY (an order is already in flight with this session) and, on POST /customer/orders with seats, HOLD_TOKEN_MISMATCH (the holdToken is not the session's, or belongs to a replaced session or another buyer even if the header is absent). Payment POSTs accept the buyer's live session or the session that created THAT order, as long as no other session has been opened since. Rejecting a new payment NEVER affects a payment already in flight.

Responses
200

OK

dataCustomerOrderStartPaymentrequired
Show properties
Any of:
CustomerOrderPayment
orderIdstringrequired

Merchant reference = reference.

amountintegerrequired

Whole pesos, no decimals.

min -9007199254740991 · max 9007199254740991
currencystringrequired
apiKeystringrequired

Bold IDENTITY key (public, sent to the browser).

integritySignaturestringrequired

SHA256 that binds the charge to the amount. Computed on the server.

renderModestringrequired
redirectionUrlstringrequired
descriptionstringrequired
expirationDatenumberrequired

Epoch in NANOSECONDS (what the Bold library expects).

CustomerOrderMercadoPagoConfig
publicKeystringrequired

MercadoPago (Tickets) public key. Sent to the browser: it is what initMercadoPago()/<Payment> from the @mercadopago/sdk-react SDK (or equivalent) receives to mount the Payment Brick. Present ONLY on the MercadoPago rail — it is the marker the landing page uses to tell it apart from the Bold rail (which carries apiKey+renderMode and NEVER publicKey).

amountnumberrequired

Amount to charge, in the currency's major unit (pesos, not cents) — the same total already returned by POST /customer/orders. It is re-read from the sale on every call: do not treat it as final if a long time passes between mounting the Brick and charging.

currencystringrequired
referencestringrequired

Sale reference (FT-…).

payerEmailstringrequired

Buyer email (from the sale, not editable). Informational: the charge ALWAYS uses the sale's email, never one sent by the client.

401

Missing or invalid credential.

errorobjectrequired
Show properties
codestringrequired
messagestringrequired
retryablebooleanrequired
detailsany
403

Insufficient role or resource not accessible.

errorobjectrequired
Show properties
codestringrequired
messagestringrequired
retryablebooleanrequired
detailsany
404

Resource does not exist or is out of scope.

errorobjectrequired
Show properties
codestringrequired
messagestringrequired
retryablebooleanrequired
detailsany
409

Conflict: the resource does not allow this operation in its current state.

errorobjectrequired
Show properties
codestringrequired
messagestringrequired
retryablebooleanrequired
detailsany
422

Request body/parameter validation failed.

errorobjectrequired
Show properties
codestringrequired
messagestringrequired
retryablebooleanrequired
detailsany
429

Too many requests: rate limit exceeded.

errorobjectrequired
Show properties
codestringrequired
messagestringrequired
retryablebooleanrequired
detailsany
Try it
Server
Authorization
Parameters
Request
curl -X POST 'https://admin.appfreeticket.com/api/v1/customer/orders/string/payment' \
  -H 'Authorization: YOUR_API_KEY'
Response
{
  "data": {
    "orderId": "string",
    "amount": -9007199254740991,
    "currency": "string",
    "apiKey": "string",
    "integritySignature": "string",
    "renderMode": "embedded",
    "redirectionUrl": "string",
    "description": "string",
    "expirationDate": 0
  }
}