# Create a payment

Creates a payment for an order or subscription. For initial payments, card details and a callback URL are required. For subsequent payments on `as_presented` subscriptions, the card from the last successful payment is reused, and `request_id`, `amount`, and `currency` are required instead.
Either `order_id` or `subscription_id` must be provided, but not both.
On a `subsequent` auto debit for an `as_presented` subscription, pass `split_ids` to price that charge from your declared share of a dynamic pricing rule. See [Dynamic Fee Split](#tag/pricing_split). The splits apply to that charge only and do not modify the subscription's own declaration. Omit `split_ids` and Glomo prices the charge from the subscription's declaration; if that declaration no longer resolves, the auto debit is rejected with a `400 Bad Request` until you pass a valid `split_ids` to override it.

Endpoint: POST /payment
Version: 1.0.0
Security: JWT

## Security:

  - `JWT` (unknown)
    http bearer JWT

## Request fields (application/json):

  - `order_id` (string)
    The unique identifier for the order. Either `order_id` or `subscription_id` must be provided, but not both.
    Example: order_68c00b7btsthf

  - `subscription_id` (string)
    The unique identifier for the subscription. Either `order_id` or `subscription_id` must be provided, but not both.
    Example: sub_5JU9yv0lGSUP

  - `method` (string)
    Payment method. Must be `card`. Required for initial payments. Not required for subsequent payments (defaults to `card`).
    Enum: "card"

  - `sequence` (string)
    Payment sequence. Use `initial` (default) for first-time payments or `subsequent` for merchant-initiated payments on `as_presented` subscriptions.
    Enum: "initial", "subsequent"

  - `card` (object)
    Card details. Required for initial payments. Not required for subsequent payments — the card from the last successful payment is reused.

  - `card.holder_name` (string, required)
    The name of the card holder.
    Example: John Doe

  - `card.number` (string, required)
    The card number: 13 to 19 digits, spaces are stripped. In sandbox, use one of the [test card numbers](/payin/payment-methods/cards#test-card-details); any other number is rejected with `400` and the message `Card is not a valid test card`. Each test card's outcome is listed on the [Cards page](/payin/payment-methods/cards#test-card-details).
    Example: 4111111111111111

  - `card.expiry_month` (string, required)
    The card expiry month, two digits from `01` to `12`. The expiry must not be in the past.
    Example: 09

  - `card.expiry_year` (string, required)
    The card expiry year in 2-digit (YY) format. Send the last two digits of the expiry year (e.g. for 2030, send '30'); the 4-digit year (`2030`) is also accepted. The expiry must not be in the past.
    Example: 30

  - `card.cvv` (string, required)
    The card CVV/CVC code, 3 or 4 digits.
    Example: 123

  - `callback_url` (string)
    HTTPS URL where the customer is redirected after payment processing. Required for initial payments. Not required for subsequent payments as there is no customer redirect involved. When sent, it must be an `https://` URL: an `http://` URL returns `400` with a message containing `Callback url must be a valid HTTPS URL`, and a value that is not a web URL returns `400` with `Callback url is not a valid URL`.
    Example: https://server.yoursite.com/payment/callback

  - `request_id` (string)
    Your unique identifier for this payment, used to reject duplicates. Required for subsequent payments, optional for initial payments. On a subsequent payment, a `request_id` already used on your account is rejected with `400` and the message `Payment already exists for this request_id`. Retrying an initial payment is rejected first by the order or subscription state check (for example `Order has an ongoing payment` or `Order is not in a valid state for payment`). In neither case is the existing payment returned; look it up with `GET /v1/payment?request_id=<your_request_id>`.
    Example: unique_request_id_123

  - `amount` (integer)
    Payment amount in the smallest unit of `currency`, which must be the subscription's currency (cents for USD). `1500` is $15.00 when `currency` is USD. Read only when `sequence` is `subsequent`, where it is required, must be greater than 0 and cannot exceed the subscription's `max_amount`. Ignored on initial payments.
    Example: 1500

  - `currency` (string)
    Currency code in [ISO 4217](https://en.wikipedia.org/wiki/ISO_4217) format, case-insensitive. Checked only on subsequent payments, where it must match the subscription's currency; otherwise the request is rejected with `400`. Ignored on initial payments.
    Example: USD

  - `split_ids` (array)
    The pricing splits to apply to this charge. Supported on a `subsequent` auto debit for an `as_presented` subscription; sending `split_ids` for a fixed-frequency subscription returns a `400 Bad Request`.
The splits apply to this charge only. They override the subscription's own declaration for this charge and do not modify it. Omit `split_ids` and Glomo prices the charge from the subscription's declaration.
    Example: ["psplit_7Kq2mXbTdLp9"]

  - `notes` (object | null)
    Optional key-value pairs for attaching custom metadata (e.g. invoice references, project codes). Keys must be strings and cannot collide with reserved field names. Your account may require some `notes` fields: Glomo configures custom field rules per account, and for beneficiaries they are checked when the beneficiary is created. Some fields are also validated by the beneficiary's country (for example, a PAN format for Indian beneficiaries). A missing required field returns `422` with `Validation failed: Notes <field> is required`, and type and validation errors (such as enum constraints) are returned the same way. The rule is set on your account, not by currency or rail. No API lists the fields, but the `422` names each missing one: add that key to `notes` with the value your account expects, and ask your Glomo account manager if you don't know what the field should hold. See [Custom fields](/payin/custom-fields). Each key appears as a separate column in CSV report exports, with corresponding values populating the rows.
    Example: {"invoice_ref":"INV-2026-001","project":"Alpha"}

## Request examples:

  - `Initial payment with card details` (unknown)

  - `Subsequent payment for as_presented subscription` (unknown)

  - `Subsequent payment overriding the subscription's fee split for this charge` (unknown)

## Response 201:

  - `201` (unknown)
    Payment created successfully

## Response 201 fields (application/json):

  - `payment_id` (string)
    The unique identifier for the created payment.
    Example: payt_691eeb9aV79Uk

  - `status` (string)
    The current status of the payment. Uses the same values as the payment's `status` field. A payment that still needs the customer to act is `in_progress` and carries `next_steps`.
    Enum: "in_progress", "action_required", "under_review", "success", "failed"

  - `next_steps` (array)
    A list of actions to be taken to complete the payment. For initial payments, this typically includes a redirect URL for 3DS/OTP authentication and a polling URL to check payment status.

  - `next_steps.action` (string)
    The type of action to perform.
    Enum: "redirect", "poll"

  - `next_steps.payload` (object)
    The payload for the action. Structure varies based on the action type.

  - `next_steps.payload.url` (string)
    The URL for the action. For `redirect`, this is the URL to redirect the customer to. For `poll`, this is the URL to poll for payment status updates.
    Example: https://secure.glomopay.com?paymentId=payt_691eeb9aV79Uk&authToken=ey...&redirectUrl=encoded_url

  - `next_steps.payload.interval_in_ms` (integer)
    The recommended polling interval in milliseconds. Only present for `poll` actions.
    Example: 5000

## Response 400:

  - `400` (unknown)
    Bad request

## Response 400 fields (application/json):

  - `error` (string)
    Enum: "Bad Request"

  - `message` (string)
    Error message.
    Example: order_id or subscription_id is required

## Response 400 examples:

  - `Missing order_id or subscription_id` (unknown)

  - `Duplicate request_id` (unknown)

  - `split_ids sent for a fixed-frequency subscription` (unknown)

  - `The subscription's own declaration no longer resolves and no override was passed` (unknown)

  - `A split id does not resolve to a live dynamic rule` (unknown)