APG PayAPG Paydocs

Payments

Take a payment

Turn a card into a payment, in two calls.

Two calls. Tokenise the card, then create the transaction that charges it.

The split is not ceremony: the first call is the only one that touches card data, so it is the only one with PCI obligations. Everything after it names a token.

POST /payment-tokens is the one operation on this surface that accepts a card number, and it exists so nothing else has to. It answers with a token you can store.

Request
curl -X POST "$VAULT_BASE_URL/payment-tokens" \
  -H "Authorization: Bearer $API_PUBLISHABLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "amount": {
    "minorCurrencyUnits": 9500,
    "currency": "AUD"
  },
  "cardNumber": "4111111111111111",
  "cvc": "123",
  "expiryMonth": 12,
  "expiryYear": 2030,
  "cardHolderName": "Priya Raman",
  "threeDsSessionId": null,
  "surcharge": null,
  "type": "PtknCmdCreateFromCard"
}'

One call creates the transaction and takes the money. status on the response is the outcome, don't infer success from the HTTP code, which only tells you the request was understood.

Request
curl -X POST "https://api.tst.au.apgpay.dev/bezel/transactions" \
  -H "Authorization: Bearer $API_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "orderId": "ordr_7hK3nQwV2xRtY9pM",
  "paymentTokenId": "ptkn_4bXcZ8mNqL1vT6sR",
  "authoriseOnly": null,
  "requestThreeDS": null,
  "returnUrl": "https://example.com/checkout/complete",
  "offSession": null,
  "cardStatementName": null,
  "cardStatementCity": null,
  "referenceTransactionId": "order-1042",
  "type": "TranCmdCreate"
}'
Authorised is not Captured. An authorisation holds the funds; a capture takes them. If you meant to take the money now, check you got Captured, see authorise-then-capture for the two-step flow and why you would want it.

The transaction carries its own refunds and disputes, so this one read answers most later questions.

Request
curl -X GET "https://api.tst.au.apgpay.dev/bezel/transactions/<useTransactionIdFromStep2>" \
  -H "Authorization: Bearer $API_SECRET_KEY"