Skip to main content
POST
Submit a typed SPT payment with Idempotency-Key, or a legacy flat Shared Payment Token
Typed submissions require a jnk_ API key via X-API-Key (ApiKeyAuth) or Authorization: Bearer (BearerAuth), a tenant-bound booking scope, quoted_cart_id and Idempotency-Key, and return a PaymentAttemptOutcome (200 known outcome / 202 pending). OAuth/JWT bearer tokens are supported only for the legacy flat token body, which keeps its existing authorization response. Request bodies are limited to 16 KiB.

Authorizations

X-API-Key
string
header
required

Headers

Idempotency-Key
string

Required when payment is present: 1–255 printable ASCII characters. Reuse only for the same payment submission.

Required string length: 1 - 255
Pattern: ^[ -~]+$(?![\s\S])

Body

application/json
trip_id
string
required
quoted_cart_id
integer
required
payment
object
required

Response

Legacy authorization result or typed payment outcome

payment_attempt_id
string
required
trip_id
string
required
quoted_cart_id
integer
required
payment_status
enum<string>
required
Available options:
not_started,
pending,
requires_authentication,
authorized,
captured,
declined,
cancelling,
cancelled,
expired,
failed
booking_status
string
required
payment_error
object | null
required
recovery
object
required
recovery_status
enum<string>
required
Available options:
automatic,
manual_review
fulfillment_cart_id
integer
failure_reason
string | null

Why the booking failed, when it failed after payment and the cause is known: offer_not_available, price_changed, booking_not_created (the supplier holds no booking; nothing was booked and no money was taken), booking_cancelled_at_provider, ticketing_refused. Null otherwise. For offer_not_available, the supplier no longer sells the priced offer. Nothing was booked and the card authorisation was released. Search again and book a new offer. The booking.failed webhook carries the same reason with a sentence to show the traveller (failure_message).

Example:

"booking_not_created"

items
object[]
booking_ref
string
quote_expires_at
string<date-time>
retry_after_seconds
integer
authentication
object

Where the customer authenticates when recovery.action is authenticate: open url before expires_at. For a Shared Payment Token (spt), url is a Jinko-hosted page that needs the token's hashed value: read the issued token's next_action.use_stripe_sdk.value with your own Stripe secret key and open url + "#hv=" + <value>, passing the value unchanged. The value travels in the URL fragment, which keeps it out of server logs.

money
object