Record Sales Order Payment
POST/api/sales-orders/:salesOrderId/payments
Record a manual payment against a sales order and recalculate the order's payment_status.
orders:writeGrant this scope to your token under Settings → Developer → Personal Access Tokens.
Request body:
payment_type_id(integer, required) — must exist in payment_types.amount(numeric, required, < 100,000,000) — positive records a payment; negative records a refund (creates a Refund sales credit and a matching positive payment against it); an amount exceeding the order balance creates an Overpayment sales credit for the excess.payment_date(date, optional) — defaults to today (Y-m-d) when omitted.external_reference(string, optional, max 255) — e.g. a cheque or transaction number.currency_id(integer, optional) — defaults to the sales order's currency when omitted.
Duplicate handling: payments are unique on (payment_type_id, external_reference). Re-submitting an identical payment for the same order is idempotent (the existing payment is returned, no duplicate created). Reusing the same type+reference for a different payment (different owner/amount/date) returns 422 with an external_reference error — it no longer 500s.
Validation: returns 422 if the order is already fully paid (positive amount), or if a refund exceeds the amount already paid.
Authentication: Requires Bearer token.
Requires permission: sales_orders.manage_payments
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.