> ## Documentation Index > Fetch the complete documentation index at: https://docs2.petstoreapi.com/llms.txt > Use this file to discover all available pages before exploring further. # Pay Order > Process payment for an existing order. ## Payment Workflow Payment processing follows this workflow: 1. **Create Order**: First create an order using `POST /orders` (status: `placed`) 2. **Submit Payment**: Call this endpoint with payment details (card or bank account) 3. **Payment Processing**: The payment is processed with status `processing` 4. **Payment Result**: - **Success**: Payment status becomes `succeeded`, order status updates to `approved` - **Failure**: Payment status becomes `failed`, order remains `placed` and can be retried 5. **Receipt**: After successful payment, retrieve the receipt from the order details **Security Note**: Sensitive payment data (like CVC codes) are `writeOnly` and never returned in responses. Card numbers and account numbers are masked when read. ## OpenAPI ````yaml api-reference/modern-petstore-3.1.openapi.json post /orders/{id}/payment openapi: 3.1.0 info: title: Modern Petstore API summary: A modern, realistic pet store API demonstrating current best practices description: >- This is a modern Pet Store API based on the OpenAPI 3.2 specification. It demonstrates contemporary API design patterns and best practices including RESTful compliance, proper HTTP methods, structured error responses (RFC 9457), and modern authentication flows. Key features include pet catalog browsing, adoption workflow, order management, user accounts, AI-powered chat advisor, and real-time event notifications via webhooks. The API showcases OpenAPI 3.2 capabilities like hierarchical tags, QUERY HTTP method, OAuth device flow, and server-sent events. Some useful links: - [API Documentation](https://docs.petstoreapi.com) - [Source Code Repository](https://github.com/petstoreapi/PetstoreAPI) - [OpenAPI Specification](https://petstoreapi.com/v1/specs/modern-petstore-3.2.openapi.yaml) version: 1.0.0 contact: name: Petstore API Support url: https://petstoreapi.com/support email: support@petstoreapi.com license: name: MIT identifier: MIT servers: - url: https://api.petstoreapi.com/v1 description: Production server security: - bearerAuth: [] - oauth2: [] tags: - name: Store description: Store operations including orders and inventory - name: Pet description: Pet catalog and management operations - name: Payments description: Payment processing with polymorphic payment sources - name: User description: User account management - name: Chat description: >- AI-powered chat completions with streaming support using Server-Sent Events (SSE) externalDocs: description: Learn more about Chat API url: https://petstoreapi.com/docs/chat - name: Webhooks description: Event-driven webhook notifications (OpenAPI 3.2) externalDocs: description: Learn more about webhooks url: https://petstoreapi.com/docs/webhooks paths: /orders/{id}/payment: post: tags: - Payments summary: Pay Order description: >- Process payment for an existing order. ## Payment Workflow Payment processing follows this workflow: 1. **Create Order**: First create an order using `POST /orders` (status: `placed`) 2. **Submit Payment**: Call this endpoint with payment details (card or bank account) 3. **Payment Processing**: The payment is processed with status `processing` 4. **Payment Result**: - **Success**: Payment status becomes `succeeded`, order status updates to `approved` - **Failure**: Payment status becomes `failed`, order remains `placed` and can be retried 5. **Receipt**: After successful payment, retrieve the receipt from the order details **Security Note**: Sensitive payment data (like CVC codes) are `writeOnly` and never returned in responses. Card numbers and account numbers are masked when read. operationId: createOrderPayment parameters: - name: id in: path description: Unique identifier for the order required: true example: 019b4139-1234-7abc-8def-123456789abc schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/OrderPayment' examples: Card: value: amount: '49.99' currency: GBP source: object: card name: J. Doe number: '4242424242424242' cvc: '123' expMonth: 12 expYear: 2025 addressLine1: 123 Fake Street addressLine2: 4th Floor addressCity: London addressCountry: gb addressPostCode: N12 9XX summary: Pay by Bank Card Bank: value: amount: '100.50' currency: GBP source: object: bank_account name: J. Doe number: '00012345' sortCode: '000123' accountType: individual bankName: Starling Bank country: gb summary: Pay by Bank Account required: true responses: '201': description: Payment successful content: application/json: schema: $ref: '#/components/schemas/OrderPayment' examples: '1': summary: Card Payment value: id: 2e3b4f5a-6b7c-8d9e-0f1a-2b3c4d5e6f7a amount: '49.99' currency: GBP source: object: card name: J. Doe number: '************4242' cvc: '123' expMonth: 12 expYear: 2025 addressCountry: gb addressPostCode: N12 9XX status: succeeded '2': summary: Bank Account Payment value: id: 2e3b4f5a-6b7c-8d9e-0f1a-2b3c4d5e6f7a amount: '100.50' currency: GBP source: object: bank_account name: J. Doe accountType: individual number: '*********2345' sortCode: '000123' bankName: Starling Bank country: gb status: succeeded '400': $ref: '#/components/responses/BadRequest' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/UnprocessableEntity' deprecated: false security: [] components: schemas: OrderPayment: description: Order payment information with polymorphic payment sources type: object required: - id - amount - currency - source - status properties: id: description: Unique payment identifier type: string format: uuid readOnly: true examples: - 2e3b4f5a-6b7c-8d9e-0f1a-2b3c4d5e6f7a amount: description: Payment amount (positive decimal) type: string examples: - '49.99' - '100.50' currency: description: Three-letter ISO 4217 currency code (uppercase) type: string enum: - USD - EUR - GBP - CAD - AUD default: USD source: description: Payment source (card or bank account) discriminator: propertyName: object mapping: card: '#/components/schemas/CardPaymentSource' bankAccount: '#/components/schemas/BankAccountPaymentSource' oneOf: - $ref: '#/components/schemas/CardPaymentSource' - $ref: '#/components/schemas/BankAccountPaymentSource' status: description: Payment status type: string enum: - PENDING - PROCESSING - SUCCEEDED - FAILED - CANCELLED readOnly: true createdAt: type: string format: date-time readOnly: true description: Payment creation timestamp unevaluatedProperties: false CardPaymentSource: type: object title: Bank Card description: Debit or credit card payment source externalDocs: description: Payment Security Best Practices and PCI Compliance Guide url: https://petstoreapi.com/docs/payments/security required: - object - name - number - expMonth - expYear properties: object: type: string const: card description: Discriminator value for card payments name: type: string description: Cardholder name examples: - Jane Doe - John Smith number: type: string description: Card number (masked when reading) pattern: ^[0-9*]{13,19}$ examples: - '4242424242424242' - '************4242' cvc: type: string description: Card security code pattern: ^[0-9]{3,4}$ writeOnly: true expMonth: type: integer minimum: 1 maximum: 12 description: Expiration month (1-12) expYear: type: integer minimum: 2024 description: Expiration year (4 digits) brand: type: string enum: - VISA - MASTERCARD - AMEX - DISCOVER - DINERS - JCB - UNIONPAY readOnly: true description: Card brand last4: type: string pattern: ^[0-9]{4}$ readOnly: true description: Last 4 digits billingAddress: type: object properties: line1: type: string writeOnly: true line2: type: string writeOnly: true city: type: string state: type: string postalCode: type: string country: type: string pattern: ^[A-Z]{2}$ description: ISO 3166-1 alpha-2 country code unevaluatedProperties: false unevaluatedProperties: false BankAccountPaymentSource: type: object title: Bank Account description: Bank account payment source externalDocs: description: ACH Payment Processing and Bank Account Verification url: https://petstoreapi.com/docs/payments/ach-guide required: - object - accountHolderName - accountNumber - routingNumber - accountType properties: object: type: string const: bank_account description: Discriminator value for bank account payments accountHolderName: type: string description: Name of account holder accountNumber: type: string description: Bank account number (masked when reading) pattern: ^[0-9*]{4,17}$ routingNumber: type: string description: Bank routing number pattern: ^[0-9]{9}$ accountType: type: string enum: - CHECKING - SAVINGS description: Type of bank account bankName: type: string readOnly: true description: Name of the bank last4: type: string pattern: ^[0-9]{4}$ readOnly: true description: Last 4 digits of account number unevaluatedProperties: false Error: type: object description: RFC 9457 Problem Details for HTTP APIs required: - type - title - status properties: type: type: string format: uri description: A URI reference that identifies the problem type examples: - https://petstoreapi.com/errors/not-found - https://petstoreapi.com/errors/validation-error title: type: string description: A short, human-readable summary of the problem examples: - Resource Not Found - Validation Error status: type: integer description: The HTTP status code examples: - 404 - 400 - 422 detail: type: string description: A human-readable explanation specific to this occurrence examples: - The requested pet with ID '123' was not found instance: type: string format: uri description: A URI reference that identifies the specific occurrence examples: - /v1/pets/123 errors: type: array description: Detailed validation errors (for 422 responses) items: type: object required: - field - message properties: field: type: string description: The field that failed validation message: type: string description: Description of the validation error code: type: string description: Machine-readable error code unevaluatedProperties: false unevaluatedProperties: false responses: BadRequest: description: Bad request - Invalid parameters headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/problem+json: schema: $ref: '#/components/schemas/Error' examples: invalid-parameter: summary: Invalid query parameter value: type: https://petstoreapi.com/errors/bad-request title: Bad Request status: 400 detail: >- Invalid value for parameter 'status'. Must be one of: available, pending, sold. instance: /pets NotFound: description: Resource not found content: application/problem+json: schema: $ref: '#/components/schemas/Error' examples: pet-not-found: summary: Pet not found value: type: https://petstoreapi.com/errors/not-found title: Not Found status: 404 detail: The requested pet with ID '123' was not found. instance: /pets/123 UnprocessableEntity: description: Unprocessable entity - Validation errors content: application/problem+json: schema: $ref: '#/components/schemas/Error' examples: validation-errors: summary: Validation errors value: type: https://petstoreapi.com/errors/validation-error title: Validation Error status: 422 detail: The request body contains validation errors. instance: /pets errors: - field: name message: Pet name is required code: required_field - field: status message: Invalid status value code: invalid_format headers: RateLimit-Limit: description: The maximum number of requests allowed in the current time window schema: type: integer example: 100 RateLimit-Remaining: description: The number of requests remaining in the current time window schema: type: integer example: 95 RateLimit-Reset: description: The time at which the current rate limit window resets (Unix timestamp) schema: type: integer example: 1702648800 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Bearer token authentication using JWT (JSON Web Token). Include the token in the Authorization header as: `Authorization: Bearer ` oauth2: type: oauth2 description: >- OAuth 2.0 authorization with multiple flows including device authorization for IoT devices and smart TVs flows: authorizationCode: authorizationUrl: https://auth.petstoreapi.com/authorize tokenUrl: https://auth.petstoreapi.com/token refreshUrl: https://auth.petstoreapi.com/refresh scopes: read:pets: Read pet information write:pets: Create and update pets read:orders: Read order information write:orders: Create and manage orders read:user: Read user profile write:user: Update user profile chat:write: Access AI chat completions ````