List Sales Order Payments
GET/api/sales-orders/:salesOrderId/payments
Lists all payments recorded against a sales order.
orders:readGrant this scope to your token under Settings → Developer → Personal Access Tokens.
Authentication: Requires Bearer token.
Response fields (per payment):
- id (integer): Payment ID.
- amount (number): Payment amount in the payment currency.
- cost (number|null): Processing cost associated with the payment, when tracked.
- payment_date (string): Payment date as a UTC datetime.
- payment_type (object):
{id, name}of the payment type (e.g. Check, Credit Card). - external_reference (string|null): External reference such as a cheque or transaction number.
- type (string|null):
direct,overpayment,prepayment, or null. - currency_code (string): ISO currency code of the payment.
- sales_credit_allocation (object|null):
{id, sales_credit_id, sales_credit_number}— set only on payments that were created by applying a store credit to the order. Such payments cannot be deleted directly; reverse them by unallocating the linked sales credit.
Path parameters:
- salesOrderId (required): Sales Order ID.
Returns 404 when the sales order does not exist.
PayPal payments (external_reference paypal:<capture id>) also carry:
- paypal_refunded_amount (number): How much of this payment has been refunded through PayPal so far.
- paypal_remaining_refundable (number): How much can still be refunded.
- paypal_capture_status (string): PayPal's status for the payment:
COMPLETED,PARTIALLY_REFUNDED,REFUNDED,PENDING,DECLINEDorFAILED.
On an order billed through sales invoices (invoicing per shipment, manually or consolidated), each payment also carries:
- unallocated_amount (string, 2 decimals): how much of the payment is not yet allocated to a sales invoice — the amount still available to apply.
- payment_type_name (string|null): the payment type's name.
- reference (string|null): the payment's external reference.
Request
Responses
- 200
- 401
- 403
- 404
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not Found
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.