API reference
The PAID API is REST-style, returns JSON, and uses standard HTTP verbs. Base URL: https://api.trustfabric.ai.
Authentication
Authenticate every request with your secret key:
Authorization: Bearer sk_live_yourkey
Endpoint catalog
PAID exposes about 1,200 production routes. The most commonly used endpoints are listed below. The complete catalog is available at api.trustfabric.ai/openapi.json.
Checkout
| Method | Path | Description |
|---|---|---|
| POST | /v1/checkout/sessions | Create a checkout session. |
| GET | /v1/checkout/sessions/{id} | Retrieve a checkout session (includes its hosted url). |
| POST | /v1/checkout/sessions/{id}/expire | Expire an open session. 409 while a payment on it is in flight; an expired session is final. |
Payment intents
| Method | Path | Description |
|---|---|---|
| POST | /v1/payment_intents | Create a payment intent directly. |
| GET | /v1/payment_intents | List payment intents with filters. |
| GET | /v1/payment_intents/{id} | Retrieve a payment intent. |
| POST | /v1/payment_intents/{id}/capture | Capture a previously authorized intent. |
| POST | /v1/payment_intents/{id}/void | Void an authorized, uncaptured intent. |
| POST | /v1/payment_intents/{id}/refund | Refund a captured payment. idempotency_key in the JSON body is required (a fresh random key for each refund); add amount for a partial refund. |
Accounts
| Method | Path | Description |
|---|---|---|
| GET | /v1/accounts/{id} | Retrieve account details. |
Reconciliation
| Method | Path | Description |
|---|---|---|
| GET | /v1/reconciliation/reports | List reconciliation reports. |
| GET | /v1/reconciliation/reports/{id} | Retrieve a report and its mismatches. |
| POST | /v1/reconciliation/mismatches/{id}/resolve | Resolve a mismatch. |
Errors
| Status | Meaning |
|---|---|
| 400 | Validation error. Inspect the error.code for the specific field. |
| 401 | Missing or invalid API key. |
| 402 | The card was declined. error.decline_code explains why. |
| 403 | Authenticated but not permitted for this resource. |
| 404 | Resource not found. |
| 429 | Rate-limited. Back off according to the Retry-After header. |
| 5xx | Server-side. Retry idempotently with exponential backoff. |
Idempotency
Money-moving POSTs take an idempotency key. Payment-intent calls (create, authorize, capture,
refund, void) require idempotency_key in the JSON body; the Idempotency-Key header is taken from the body field when it is absent. Creating a
checkout session requires the Idempotency-Key header.
Generate a fresh random key (a UUID) for each operation, and send it again only to retry that
same operation. Never build a key from an order number or anything else that can be guessed:
payment-intent keys are one namespace for the whole platform, not one per account. Check that
the id in the response is the payment you acted on. If a retry answers anything
but 200, read GET /v1/payment_intents/{id} and compare captured_amount and refunded_amount before sending a new key.