curl --request POST \
--url https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"payment_method_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payer_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"amount": 1,
"idempotency_key": "<string>",
"card_acquiring_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination_wallet_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"currency": "USD",
"metadata": {}
}
'import requests
url = "https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant"
payload = {
"payment_method_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payer_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"amount": 1,
"idempotency_key": "<string>",
"card_acquiring_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination_wallet_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"currency": "USD",
"metadata": {}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
payment_method_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
payer_user_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
amount: 1,
idempotency_key: '<string>',
card_acquiring_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
destination_wallet_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
currency: 'USD',
metadata: {}
})
};
fetch('https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'payment_method_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'payer_user_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'amount' => 1,
'idempotency_key' => '<string>',
'card_acquiring_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'destination_wallet_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'currency' => 'USD',
'metadata' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant"
payload := strings.NewReader("{\n \"payment_method_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"payer_user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"amount\": 1,\n \"idempotency_key\": \"<string>\",\n \"card_acquiring_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"destination_wallet_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"currency\": \"USD\",\n \"metadata\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"payment_method_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"payer_user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"amount\": 1,\n \"idempotency_key\": \"<string>\",\n \"card_acquiring_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"destination_wallet_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"currency\": \"USD\",\n \"metadata\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"payment_method_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"payer_user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"amount\": 1,\n \"idempotency_key\": \"<string>\",\n \"card_acquiring_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"destination_wallet_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"currency\": \"USD\",\n \"metadata\": {}\n}"
response = http.request(request)
puts response.read_body{
"status_code": 123,
"data": "<unknown>",
"query_generated_time": 123
}{
"detail": {
"code": "card_declined",
"message": "The card was declined.",
"payment_intent_id": "7f3c1b2a-9d84-4e15-8c26-0b7a5d3e1f90",
"failure_reason": "card_security_check_failed",
"last4": "2420",
"brand": "Visa"
}
}Charge a Saved Card into a Card-Acquiring Merchant
Charge a saved card and park the payment for review. The card is identified by payment_method_id and the receiving card-acquiring account by card_acquiring_id. The payment lands at pending_review for a Finogate admin to approve or reject.
By default the funds land in the card-acquiring account owner’s primary wallet for the currency. Send destination_wallet_id to credit one specific wallet instead — any wallet under your tenant, primary or not, whose currency matches currency (which defaults to USD). The resolved wallet comes back as destination_wallet_id on the response. A 409 means the wallet cannot take the credit (closed, suspended or frozen), or that the card-acquiring account settles to an external bank account and so has no wallet leg to redirect; a 422 means the wallet belongs to another tenant or holds a different currency.
How the card is billed depends on its configured charge mode, returned as charge_mode on the response. auth_capture authorizes (holds) the card now and screens AVS/CVV, then captures on approval — a rejection voids the hold. sale places no hold: nothing reaches the card until an admin approves, and then it is charged once.
A card whose manual review is still open (verification_status of awaiting_documents or pending) can be charged here, unlike on any other saved-card surface: this payment parks for an operator anyway, so that approval covers the open card review too. The payment comes back with needs_review: true. Its AVS/CVV rules stay strict, and a card an admin has rejected is still refused with a 409.
A 201 always means a live payment was recorded. The two outcomes that collect nothing are errors, keyed by detail.code:
-
422 card_declined— the issuer declined, or the card failed the AVS/CVV policy (any held authorization is voided). -
400 card_processor_error— the charge could not be attempted at all: the processor was unreachable, misconfigured, or answered something unusable. Nothing was established about the card, so this is a retry rather than a reason to ask the cardholder for another one.
Both carry the same body: the payment record exists at failed, its id is on the error as payment_intent_id, the collapsed cause as failure_reason, and message is the processor’s own wording for what happened. The key is consumed, so a replay returns this same error.
Supply a unique idempotency_key — a replay returns the same record.
curl --request POST \
--url https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"payment_method_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payer_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"amount": 1,
"idempotency_key": "<string>",
"card_acquiring_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination_wallet_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"currency": "USD",
"metadata": {}
}
'import requests
url = "https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant"
payload = {
"payment_method_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payer_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"amount": 1,
"idempotency_key": "<string>",
"card_acquiring_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination_wallet_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"currency": "USD",
"metadata": {}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
payment_method_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
payer_user_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
amount: 1,
idempotency_key: '<string>',
card_acquiring_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
destination_wallet_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
currency: 'USD',
metadata: {}
})
};
fetch('https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'payment_method_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'payer_user_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'amount' => 1,
'idempotency_key' => '<string>',
'card_acquiring_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'destination_wallet_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'currency' => 'USD',
'metadata' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant"
payload := strings.NewReader("{\n \"payment_method_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"payer_user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"amount\": 1,\n \"idempotency_key\": \"<string>\",\n \"card_acquiring_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"destination_wallet_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"currency\": \"USD\",\n \"metadata\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"payment_method_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"payer_user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"amount\": 1,\n \"idempotency_key\": \"<string>\",\n \"card_acquiring_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"destination_wallet_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"currency\": \"USD\",\n \"metadata\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.finogates.com/v1/platform/payments/card-to-merchant")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"payment_method_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"payer_user_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"amount\": 1,\n \"idempotency_key\": \"<string>\",\n \"card_acquiring_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"destination_wallet_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"currency\": \"USD\",\n \"metadata\": {}\n}"
response = http.request(request)
puts response.read_body{
"status_code": 123,
"data": "<unknown>",
"query_generated_time": 123
}{
"detail": {
"code": "card_declined",
"message": "The card was declined.",
"payment_intent_id": "7f3c1b2a-9d84-4e15-8c26-0b7a5d3e1f90",
"failure_reason": "card_security_check_failed",
"last4": "2420",
"brand": "Visa"
}
}Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Body
Request body for POST /v1/platform/payments/card-to-merchant.
The card is identified by payment_method_id (a card already vaulted
for a user under the tenant). card_acquiring_id selects the NMI
merchant (MID) the funds deposit into; it must match the merchant the
card was vaulted under (vault tokens are MID-namespaced). Omit it to use
the tenant's first approved card-acquiring account.
Public id of the saved card to charge.
Public id of the payer (cardholder) user being charged.
Amount to hold, major units.
x > 0Caller-chosen unique key; a replay returns the same record.
1 - 120Public id of the card-acquiring merchant to deposit into. Optional — when omitted the tenant's first approved (oldest created) card-acquiring account is used. When supplied it is always honoured; there is no fallback, and a card vaulted under a different account is refused.
Public id of the exact wallet to credit. Optional — when omitted the funds land in the card-acquiring account owner's primary wallet for the currency. The wallet must belong to this tenant and its currency must match currency; it does not have to be a primary wallet. Not accepted when the card-acquiring account settles to an external bank account.
3Optional caller metadata stored on the record.
Response
Successful Response
Standard response wrapper for single-object responses and errors.
Generic over the payload type. A route that declares
CommonResponse[SomeModel] gets the real data schema rendered in
OpenAPI/Swagger; a bare CommonResponse leaves data untyped.

