> This page is for Developers. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://zuora.ferndocs.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server. # Create authorization POST https://rest.test.zuora.com/v1/payment-methods/{payment-method-id}/authorize Content-Type: application/json Enables you to authorize the availability of funds for a transaction but delay the capture of funds until a later time. Subsequently, use [Create a payment](https://developer.zuora.com/api-references/api/operation/POST_CreatePayment) or [Create an order](https://developer.zuora.com/api-references/api/operation/POST_Order/) to capture the authorized funds, or use [Cancel authorization](https://developer.zuora.com/api-references/api/operation/POST_CancelAuthorization) to cancel the authorization. For gateway integrations that support this operation, see Delayed Capture. Reference: https://zuora.ferndocs.com/developers/api-reference/zuora-api/payments/payment-authorization/post-create-authorization ## Authentication - `Authorization` header (bearer token, required) — Use `Bearer {{token}}` in the `Authorization` header for authentication. ## Servers - `https://rest.test.zuora.com` (US Developer & Central Sandbox (incl. Test Drive), default) - `https://rest.sandbox.na.zuora.com` (US API Sandbox Cloud 1) - `https://rest.apisandbox.zuora.com` (US API Sandbox Cloud 2) - `https://rest.na.zuora.com` (US Production Cloud 1) - `https://rest.zuora.com` (US Production Cloud 2) - `https://rest.test.eu.zuora.com` (EU Developer & Central Sandbox) - `https://rest.sandbox.eu.zuora.com` (EU API Sandbox) - `https://rest.eu.zuora.com` (EU Production) - `https://rest.test.ap.zuora.com` (APAC Developer & Central Sandbox) - `https://rest.ap.zuora.com` (APAC Production) ## Request ### Path parameters - `payment-method-id` (string, required) — The unique ID of the payment method where the authorization is created. ### Headers - `Idempotency-Key` (string, optional) — Specify a unique idempotency key if you want to perform an idempotent POST or PATCH request. Do not use this header in other request types. With this header specified, the Zuora server can identify subsequent retries of the same request using this value, which prevents the same operation from being performed multiple times by accident. - `Accept-Encoding` (string, optional) — Include the `Accept-Encoding: gzip` header to compress responses as a gzipped file. It can significantly reduce the bandwidth required for a response. If specified, Zuora automatically compresses responses that contain over 1000 bytes of data, and the response contains a `Content-Encoding` header with the compression algorithm so that your client can decompress it. - `Content-Encoding` (string, optional) — Include the `Content-Encoding: gzip` header to compress a request. With this header specified, you should upload a gzipped file for the request payload instead of sending the JSON payload. - `Zuora-Track-Id` (string, optional) — A custom identifier for tracing the API call. If you set a value for this header, Zuora returns the same value in the response headers. This header enables you to associate your system process identifiers with Zuora API calls, to assist with troubleshooting in the event of an issue. The value of this field must use the US-ASCII character set and must not include any of the following characters: colon (`:`), semicolon (`;`), double quote (`"`), and quote (`'`). - `Zuora-Entity-Ids` (string, optional) — An entity ID. If you have [Zuora Multi-entity](https://knowledgecenter.zuora.com/BB_Introducing_Z_Business/Multi-entity) enabled and the OAuth token is valid for more than one entity, you must use this header to specify which entity to perform the operation in. If the OAuth token is only valid for a single entity, or you do not have Zuora Multi-entity enabled, you should not set this header. - `Zuora-Org-Ids` (string, optional) — Comma separated IDs. If you have Zuora Multi-Org enabled, you can use this header to specify which orgs to perform the operation in. If you do not have Zuora Multi-Org enabled, you should not set this header. The IDs must be a sub-set of the user's accessible orgs. If you specify an org that the user does not have access to, the operation fails. This header is important in Multi-Org (MO) setups because it defines the organization context under which the API should operate—mainly used for read access or data visibility filtering. If the header is not set, the operation is performed in scope of the user's accessible orgs. - `Zuora-Version` (string, optional) — The minor API version. For a list of available minor versions, see [API upgrades](https://developer.zuora.com/v1-api-reference/api-upgrades/). ### Body (application/json) This endpoint expects a POSTDelayAuthorizeCapture. - `amount` (double, required) — The amount of the transaction. - `gatewayOrderId` (string, required) — The order ID for the specific gateway. The specified order ID will be used in transaction authorization. If you specify an empty value for this field, Zuora will generate an ID and you will have to associate this ID with your order ID by yourself if needed. It is recommended to specify an ID for this field. - `accountId` (string, optional) — The ID of the customer account. Either `accountId` or `accountNumber` is required. - `accountNumber` (string, optional) — The number of the customer account. Either `accountNumber` or `accountId` is required. - `gatewayOptions` (PostDelayAuthorizeCaptureGatewayOptions, optional) — The field used to pass gateway-specific parameters and parameter values. The fields supported by gateways vary. For more information, see the Overview topic of each gateway integration in [Zuora Knowledge Center](https://knowledgecenter.zuora.com/Zuora_Billing/Billing_and_Payments/M_Payment_Gateways/Supported_Payment_Gateways). Zuora sends all the information that you specified to the gateway. If you specify any unsupported gateway option parameters, they will be ignored without error prompts. - `mitTransactionSource` (enum, optional) — Payment transaction source used to differentiate the transaction source in Stored Credential Transaction framework. - `C_Unscheduled`: Cardholder-initiated transaction (CIT) that does not occur on scheduled or regularly occurring dates. - `M_Recurring`: Merchant-initiated transaction (MIT) that occurs at regular intervals. - `M_Unscheduled`: Merchant-initiated transaction (MIT) that does not occur on scheduled or regularly occurring dates. - `M_MOTO`: Mail Order Telephone Order (MOTO) payment transaction. This option is only available for credit card payments on Stripe v2. See [Overview of Stripe payment gateway integration](https://knowledgecenter.zuora.com/Zuora_Collect/Payment_gateway_integrations/Supported_payment_gateways/Stripe_Payment_Gateway/A_Overview_of_Stripe_payment_gateway_integration) for more information. - Allowed values: `C_Unscheduled`, `M_Recurring`, `M_Unscheduled`, `M_MOTO` - `paymentGatewayId` (string, optional) — The ID of the payment gateway instance. If Payment Gateway Routing is enabled: * If this field is not specified, gateway routing rules will be invoked. * If this field is specified, the specified gateway will be used to authorize the payment. If Payment Gateway Routing is disabled: * If this field is not specified, the default payment gateway will be used to authorize the payment. The default gateway of the customer account takes precedence over the default gateway of the tenant. * If this field is specified, the specified gateway will be used to authorize the payment. - `softDescriptor` (string, optional) — A text, rendered on a cardholder’s statement, describing a particular product or service purchased by the cardholder. - `softDescriptorPhone` (string, optional) — The phone number that relates to the soft descriptor, usually the phone number of customer service. ## Response ### 200 OK - `gatewayOrderId` (string, optional) — The order ID for the specific gateway. The specified order ID will be used in transaction authorization. If you specify an empty value for this field, Zuora will generate an ID and you will have to associate this ID with your order ID by yourself if needed. It is recommended to specify an ID for this field. - `paymentGatewayResponse` (PostAuthorizeResponsePaymentGatewayResponse, optional) — The response data returned from the gateway. This field is available only if the `success` field is `false` and the support for returning additional error information from the gateway is enabled. - `processId` (string, optional) — The ID of the running process when the exception occurs. This field is available only if the `success` field is `false`. - `reasons` (list of PostAuthorizeResponseReasonsItems, optional) — The container of the error code and message. This field is available only if the `success` field is `false`. - `requestId` (string, optional) — The ID of the request. This field is available only if the `success` field is `false` - `resultCode` (string, optional) — The result code of the request. 0 indicates that the request succeeded, and the following values indicate that the request failed: - 1: The request is declined. - 7: The field format is not correct. - 10: Client connection has timed out. - 11: Host connection has timed out. - 12: Processor connection has timed out. - 13: Gateway server is busy. - 20: The card type is not supported. - 21: The merchant account information is invalid. - 22: A generic error occurred on the processor. - 40: The card type has not been set up yet. - 41: The limit for a single transaction is exceeded. - 42: Address checking failed. - 43: Card security code checking failed. - 44: Failed due to the gateway security setting. - 45: Fraud protection is declined. - 46: Address checking or card security code checking failed (for Authorize.net gateway only). - 47: The maximum amount is exceeded (for Authorize.net gateway only). - 48: The IP address is blocked by the gateway (for Authorize.net gateway only). - 49: Card security code checking failed (for Authorize.net gateway only). - 60: User authentication failed. - 61: The currency code is invalid. - 62: The transaction ID is invalid. - 63: The credit card number is invalid. - 64: The card expiration date is invalid. - 65: The transaction is duplicated. - 66: Credit transaction error. - 67: Void transaction error. - 90: A valid amount is required. - 91: The BA code is invalid. - 92: The account number is invalid. - 93: The ACH transaction is not accepted by the merchant. - 94: An error occurred for the ACH transaction. - 95: The version parameter is invalid. - 96: The transaction type is invalid. - 97: The transaction method is invalid. - 98: The bank account type is invalid. - 99: The authorization code is invalid. - 200: General transaction error. - 500: The transaction is queued for submission. - 999: Unknown error. - -1: An error occurred in gateway communication. - -2: Idempotency is not supported. - -3: Inquiry call is not supported. - `resultMessage` (string, optional) — The corresponding request ID. - `success` (boolean, optional) — Indicates whether the call succeeded. - `transactionId` (string, optional) — The ID of the transaction. ## Errors ### 500 Internal Server Error Internal Server Error - `reasons` (list of ErrorResponseReasonsItems, optional) ### 400 Client Request Error Request Errors - `processId` (string, optional) — The ID of the process that handles the operation. - `reasons` (list of CommonResponseReasonsItems, optional) — The container of the error code and message. This field is available only if the `success` field is `false`. - `requestId` (string, optional) — Unique identifier of the request. - `success` (boolean, optional) — Indicates whether the call succeeded. ## Types ### PostDelayAuthorizeCaptureGatewayOptions The field used to pass gateway-specific parameters and parameter values. The fields supported by gateways vary. For more information, see the Overview topic of each gateway integration in [Zuora Knowledge Center](https://knowledgecenter.zuora.com/Zuora_Billing/Billing_and_Payments/M_Payment_Gateways/Supported_Payment_Gateways). Zuora sends all the information that you specified to the gateway. If you specify any unsupported gateway option parameters, they will be ignored without error prompts. - `key` (string, optional) — The name of a gateway-specific parameter. - `value` (string, optional) — The value of the gateway-specific parameter. ### PostAuthorizeResponsePaymentGatewayResponse The response data returned from the gateway. This field is available only if the `success` field is `false` and the support for returning additional error information from the gateway is enabled. - `additionalInfo` (PostAuthorizeResponsePaymentGatewayResponseAdditionalInfo, optional) — The additional information returned from the gateway. The returned fields vary for gateways. Here is an example. ``` "additionalInfo": { "ProcessorName": "MasterCard Saferpay Test", "ProcessorResult": "51", "ProcessorMessage": "Insufficient funds", "ErrorName": "TRANSACTION_DECLINED" } ``` - `gatewayResponseCode` (string, optional) — The HTTP response code. - `gatewayResponseMessage` (string, optional) — The error message returned from the gateway. - `gatewayType` (string, optional) — The gateway type. - `gatewayVersion` (string, optional) — The gateway version. ### PostAuthorizeResponseReasonsItems - `code` (string, optional) — Error code. - `message` (string, optional) — Error message. It usually contains a combination of gateway response code and response message. ### ErrorResponseReasonsItems - `code` (string, optional) — The error code of response. - `message` (string, optional) — The detail information of the error response ### CommonResponseReasonsItems - `code` (string, optional) — The error code of response. - `message` (string, optional) — The detail information of the error response ### PostAuthorizeResponsePaymentGatewayResponseAdditionalInfo The additional information returned from the gateway. The returned fields vary for gateways. Here is an example. ``` "additionalInfo": { "ProcessorName": "MasterCard Saferpay Test", "ProcessorResult": "51", "ProcessorMessage": "Insufficient funds", "ErrorName": "TRANSACTION_DECLINED" } ``` ## Examples **Request** ```json { "amount": 1.99, "gatewayOrderId": "A001", "accountId": "402881e861bd8a7e0161c6a453750026" } ``` **Response** ```json { "gatewayOrderId": "A001", "resultCode": "0", "resultMessage": "Request ID: 5231719060426316203012", "success": true, "transactionId": "5231719060426316203012" } ``` **SDK Code** ```python import requests url = "https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize" payload = { "amount": 1.99, "gatewayOrderId": "A001", "accountId": "402881e861bd8a7e0161c6a453750026" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"amount":1.99,"gatewayOrderId":"A001","accountId":"402881e861bd8a7e0161c6a453750026"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize" payload := strings.NewReader("{\n \"amount\": 1.99,\n \"gatewayOrderId\": \"A001\",\n \"accountId\": \"402881e861bd8a7e0161c6a453750026\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"amount\": 1.99,\n \"gatewayOrderId\": \"A001\",\n \"accountId\": \"402881e861bd8a7e0161c6a453750026\"\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"amount\": 1.99,\n \"gatewayOrderId\": \"A001\",\n \"accountId\": \"402881e861bd8a7e0161c6a453750026\"\n}") .asString(); ``` ```php request('POST', 'https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize', [ 'body' => '{ "amount": 1.99, "gatewayOrderId": "A001", "accountId": "402881e861bd8a7e0161c6a453750026" }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"amount\": 1.99,\n \"gatewayOrderId\": \"A001\",\n \"accountId\": \"402881e861bd8a7e0161c6a453750026\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "amount": 1.99, "gatewayOrderId": "A001", "accountId": "402881e861bd8a7e0161c6a453750026" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://rest.test.zuora.com/v1/payment-methods/payment-method-id/authorize")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```