Checkout
Runs active + validity window + max_uses + min_order_amount + vendor-store scope checks. Returns computed discount (clamped to cartSubtotal).
Authorization
better-auth.session_token In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/api/v1/checkout/validate-voucher" \ -H "Content-Type: application/json" \ -d '{ "voucherId": "6cb0661e-2e4e-4995-b716-8eb270216a9e", "tier": "string", "cartSubtotal": 0 }'{ "voucher": { "id": "string", "code": "string", "tier": "string", "discount_type": {}, "discount_value": "string", "min_order_amount": "string" }, "discount": "string"}Lookup by code (unique) + is_active check. Returns summary.
Authorization
better-auth.session_token In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/api/v1/checkout/validate-kol-code" \ -H "Content-Type: application/json" \ -d '{ "code": "string" }'{ "kolCode": { "id": "string", "code": "string", "discount_type": "string", "discount_value": "string", "category_id": "string" }}Customer-only role guard, address ownership check, server-side buyer TIN regex+normalize, then atomic Postgres RPC handles stock/voucher/loyalty/KOL+order/items in one transaction. Phase 17 buyer_tin written back to orders + soft-saved to profiles.tin (only if previously unset).
Authorization
better-auth.session_token In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
curl -X POST "https://example.com/api/v1/checkout/submit" \ -H "Content-Type: application/json" \ -d '{}'Authorization
better-auth.session_token In: cookie
Response Body
application/json
curl -X GET "https://example.com/api/v1/checkout/pending-order"{}MOCK_FIUU=true short-circuits to /payment/return?status=success in non-prod. Otherwise builds the canonical hosted-page URL with vcode signature.
Authorization
better-auth.session_token In: cookie
Path Parameters
Response Body
curl -X POST "https://example.com/api/v1/checkout/payment/initiate/string"All requests must belong to caller company and be in approved status. Phase-17 TIN+MSIC gate. After RPC success, requests flip to paid with order_id and the parent order is stamped is_b2b=true + buyer_tin from company.tin.
Authorization
better-auth.session_token In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
curl -X POST "https://example.com/api/v1/checkout/b2b/submit" \ -H "Content-Type: application/json" \ -d '{}'Server-side price snapshot (variant override > base price). Family address sourced from family_accounts. Cart-item IDs persisted to admin_notes for IPN cleanup. family_id + auto buyer_tin (family_accounts.owner_tin) stamped on the parent.
Authorization
better-auth.session_token In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
curl -X POST "https://example.com/api/v1/checkout/family/submit" \ -H "Content-Type: application/json" \ -d '{}'Authorization
better-auth.session_token In: cookie
Path Parameters
Response Body
curl -X POST "https://example.com/api/v1/checkout/payment/retry/string"