Public checkout API#

These endpoints power the hosted checkout at gateway_url. You only need them if you are building your own checkout UI on top of CasaPay sessions - the hosted flow calls them for you.

The session ID is a bearer credential

These endpoints take no API key: anyone holding the session_id can view the session and pay it, or cancel it. Treat the ID like a password - send it over HTTPS, keep it out of logs and analytics, and never put it in a shared or indexable URL.

All routes are prefixed /api/v1/gateway/public and rate limited to 30 requests per minute.

Retrieve the session

GET/api/v1/gateway/public/sessions/{session_id}

Returns everything the checkout UI needs: amounts, branding, the current step, and which payment methods are available. No API key - the session ID is the credential.

Submit a step

POST/api/v1/gateway/public/sessions/{session_id}/submit

Advances the session through the current step - for example recording the tenant's deposit choice. The response reports the next current_step, or null when the session is finished.

Start identity verification

POST/api/v1/gateway/public/sessions/{session_id}/verification/initialize

Creates a Didit verification session and returns the URL the tenant must visit. Poll the status endpoint, or wait for the tenant to be redirected back.

Check verification status

GET/api/v1/gateway/public/sessions/{session_id}/verification/status

Returns whether verification has completed and, if so, its outcome.

Initiate payment

POST/api/v1/gateway/public/sessions/{session_id}/payment/initiate

Creates the payment at EveryPay and returns the URL to send the tenant to. In test mode this returns the simulator URL instead.

Body

payment_methodenumREQUIRED

card or bank.

countrystring

Two-letter country for bank links, e.g. EE, LV, LT. Required for bank.

{
  "payment_url": "https://pay.every-pay.eu/...",
  "payment_reference": "a1b2c3d4"
}

Cancel from the checkout

POST/api/v1/gateway/public/sessions/{session_id}/cancel

Called when the tenant abandons checkout. Returns the cancel_url to redirect to.

Body

reasonenum

customer_cancelled or operator_cancelled. Defaults to customer_cancelled.

notestring

Optional detail. Max 500.

{
  "success": true,
  "redirect_url": "https://your-app.com/cancelled"
}

Drive the simulator

POST/api/v1/gateway/public/sessions/{session_id}/simulator

Test mode only. Forces a specific outcome so you can exercise every branch without a real card.

Body

scenarioenumREQUIRED

See the scenario table in Testing.