# Commit a payment (/api/payments/commit-payment)

`POST https://api.comecero.com/api/v1/payments/{payment_id}/commit`

Finishes an `initiated` payment once the shopper has done their step: approved at PayPal or Amazon Pay, passed a 3-D Secure check, or confirmed in Stripe.js. The amounts are worked out again from the cart or invoice first, so a changed shipping or tax is charged. On success the cart or invoice closes, the order is made, events fire and the receipt goes out. If a PayPal total went up too much since approval, the payment stays `initiated` with a new `response_data.redirect_url` for the buyer to approve again. Two commits at once (the shopper's browser and the provider's webhook) run one after the other, and the second gets the first one's result. A payment that is already `pending` comes back as it is. A `completed` or `cancelled` payment is `422`. The Comecero-hosted 3-D Secure page commits the payment itself, so get the payment first and commit only while it is `initiated`. Any token type may call it, a limited token too, for any payment of the account: a shopper may come back in another browser. A limited token that is not bound to the payment gets only `object`, `payment_id`, `success`, `status`, `payment_method.type` and `response_data.redirect_url`. A token that may not create or update payments gets `401`. The body is optional.

## Parameters

- `payment_id` (path, required): The id of the payment.
- `expand` (query): Comma-separated child objects to return in full instead of as a URL, for example `customer,payments`. Use dot notation for nested objects (`items.product`), up to four levels deep. A single object takes up to 12 paths; a list takes up to 2, applied to every item. Extra paths are dropped without an error. See [Expanding objects](https://docs.comecero.com/docs/basic-concepts/expanding-objects).
- `formatted` (query): When `true`, the object also has a `formatted` child with amounts and dates as display text in the shopper's language and currency (for example `$19.99` or `November 7, 2026`). The default is `false`. See [Localized formatting](https://docs.comecero.com/docs/basic-concepts/localized-formatting).

Request body: the `payment_commit_request` schema.

Responses: 201, 400, 401, 402, 403, 404, 409, 422, 500, 502, 504.

Full schemas: operation `commit_payment` in /openapi.json.