Skip to content
Docs
Open Backstage
Operation

Confirm a sandbox payment

POST/payments/{paymentId}/sandbox/confirm
Confirms a payment taken on a 'sandbox' provider, standing in for the card form a buyer would fill in. The test token decides the outcome: 'tl_test_pm_success' captures it, so the order is confirmed and its tickets are issued; 'tl_test_pm_decline', 'tl_test_pm_insufficient_funds' and 'tl_test_pm_expired_card' decline it with that failure code, so the order stays unpaid and nothing is issued. Defaults to 'tl_test_pm_success'. The outcome is raised as a provider webhook into the same ingress a real PSP posts to, so the whole path is the real one - and, like a redelivered PSP event, confirming the same token twice is a no-op. Only payments on a sandbox provider for a TEST order can be confirmed: the sandbox settles pretend money only. Needs payments.create, or orders.pay (taking payment for an order, which a channel secret key holds for its own channel's orders).

Path parameters

paymentIdstringRequired
Payment ID

Headers

X-Ticketlayer-ChannelstringOptional
Slug of the sales channel to act through. A channel-scoped credential supplies its own channel and this header, when sent, must agree with it. On a read it filters to what that channel sells, at its resolved prices; on a cart it is required; on an order operation it is derived from the order and may only confirm it, never contradict it.
Idempotency-KeystringOptional
Makes the write safe to retry. The first request with a key does the work and its response is stored for 24 hours; a repeat with the same key and the same request (method, path, query, X-Ticketlayer-Channel, TL-Version and body) gets that stored status and body back, marked `Idempotent-Replay: true`, without running again. The key is scoped to your organisation and your credential. The same key with a different request is 422 IDEMPOTENCY_KEY_REUSED; a repeat while the first is still running waits for it, then answers 409 IDEMPOTENT_REQUEST_IN_PROGRESS if it has not finished. Only a 2xx is stored: after an error the key is free again. Omit the header and the request behaves as it always has.

Body

tokenstringThe sandbox test token to confirm with. 'tl_test_pm_success' captures the payment; 'tl_test_pm_decline', 'tl_test_pm_insufficient_funds' and 'tl_test_pm_expired_card' decline it with that failure code. Defaults to 'tl_test_pm_success'.

Returns

Sandbox payment confirmed; the outcome has been raised

Errors

400
Bad Request - Invalid input
401
Unauthorized - Authentication required
403
Forbidden - Insufficient permissions
404
Not Found - Resource not found
500
Internal Server Error

Every error names its code and links to it. All error codes

curl -X POST "https://api.ticketlayer.com/v1/payments/pay_abc123xyz789/sandbox/confirm" \  -H "Authorization: Bearer tlak_..." \  -H "X-Ticketlayer-Org: your-org-slug" \  -H "Content-Type: application/json" \  -d '{    "token": "tl_test_pm_decline"  }'
Response 200
{
  "paymentId": "pay_abc123xyz789",
  "token": "tl_test_pm_decline",
  "outcome": "failed",
  "webhookEventId": "iwh_abc123",
  "ingestStatus": "received",
  "failureCode": "card_declined",
  "failureMessage": "The card was declined by the issuer (sandbox)."
}

Try it in test mode

Path parameters
Payment ID
Body
The sandbox test token to confirm with. 'tl_test_pm_success' captures the payment; 'tl_test_pm_decline', 'tl_test_pm_insufficient_funds' and 'tl_test_pm_expired_card' decline it with that failure code. Defaults to 'tl_test_pm_success'.