Cancel payment

API contract v1.0.0

On this page

cancelPayment

POST/v1/payments/{payment_id}/cancel

Required scopespayments:writeIdempotency key required

Closes a payment when it can be shown to be safe. There is no request body. A payment in created, or in failed with no attempt in flight, can be canceled directly. A requires_action payment becomes canceled only after the provider confirms the cancellation and confirms that no charge succeeded. If that can't be confirmed, the API returns 202, the payment stays in its original status (or processing) while the platform keeps running status queries, and the platform never forces a local cancellation. Payments in states that can't be canceled, such as processing or succeeded, return 409.

Request headers

Request headers	Required	Format	Description
Authorization	Yes	Bearer <API_KEY>	Server-side key, to be used only on the merchant's server. The merchant and environment are derived from the key. A missing, invalid, revoked or expired key returns 401.
Idempotency-Key	Yes	1–255 visible ASCII characters	Idempotency key, 1–255 visible ASCII characters. The scope is merchant, environment, method and path: with the same key and matching core business parameters, the original business object is reused, and conflicting parameters return 409 idempotency_conflict. Use one key per submission, and reuse the same key when you retry after a network error; use a new key for a new submission, such as a card change. For concurrent requests with the same key, only one request gets to run, and the others wait for its transaction to commit and then return the same object (200). If the wait times out, the API returns 409 operation_in_progress (retryable=true); retry later with the original key. A request rejected with 400, 401, 403 or 422 doesn't consume the idempotency key; fix it and submit with a new key.

Request example

curl

curl -X POST 'https://api.fluxan.co/v1/payments/<PAYMENT_ID>/cancel' \
  -H 'Authorization: Bearer <TEST_SERVER_API_KEY>' \
  -H 'Idempotency-Key: <UNIQUE_OPERATION_KEY>'

Placeholders to replace

<PAYMENT_ID>: The id returned when you create a payment (starts with pay_)
<TEST_SERVER_API_KEY>: Test-environment server API key, created on the "API Key" page of the merchant portal
<UNIQUE_OPERATION_KEY>: The idempotency key you generate for this request (for example, a UUID); reuse the same key when you retry after a network error

Note

Server API keys must only be used on your own server, so the docs site doesn't offer interactive API testing. Get a test key: API Key page in the merchant portal (opens the merchant portal in a new tab) (Test environment; Requires Owner, Admin or Developer)

Responses

The payment was canceled (status=canceled), or this is an idempotent replay with the same key.

A payment that hadn't been submitted yet was canceled safely

{
  "id": "pay_demo_006",
  "merchant_order_no": "ORDER-DEMO-006",
  "environment": "test",
  "amount": 10000,
  "currency": "USD",
  "status": "canceled",
  "resolution_status": "known",
  "captured_amount": 0,
  "refunded_amount": 0,
  "refund_returned_amount": 0,
  "refund_reserved_amount": 0,
  "refund_status": "none",
  "authentication_status": null,
  "reconciliation_status": "pending",
  "upstream_receipt_status": "not_received",
  "latest_attempt_id": null,
  "attempt_count": 0,
  "version": 2,
  "next_action": null,
  "failure": null,
  "description": "Example order",
  "customer_reference": "CUSTOMER-DEMO-006",
  "metadata": {
    "business_order_type": "one_time_purchase"
  },
  "card": null,
  "created_at": "2026-09-23T09:00:00Z",
  "succeeded_at": null,
  "expires_at": "2026-09-23T09:30:00Z",
  "request_id": "req_demo_016"
}

Response fields

Returns an object. See the object section for field descriptions.

Name	Type	Required	Description
`id`	string	Required	Platform payment ID. Example: `pay_demo_001`
`merchant_order_no`	string	Required	Merchant order ID, case-sensitive as sent. Example: `ORDER-DEMO-001`
`environment`	string	Required	Environment: test is the test environment and live is the live environment. Test and live objects are isolated from each other. `test` `live` More values may be added in the future. Don't treat a status you don't recognize as success. Example: `test`
`amount`	integer(int64)	Required	Order amount, in the smallest currency unit. It can't be changed after the first submission to the provider. Constraints: `≥ 1` Example: `10000`
`currency`	string	Required	Uppercase three-letter currency code. Constraints: `Format ^[A-Z]{3}$` Example: `USD`
`status`	string	Required	Payment status. Clients must not treat an unknown status as success. created: the order has been created and no valid charge attempt has been submitted yet; new attempts are allowed within the validity period processing: submitted and being processed, or the outcome isn't confirmed yet; new attempts aren't allowed requires_action: the current attempt needs the payer to complete an action such as authentication; new attempts aren't allowed failed: the latest attempt clearly failed; this is not a terminal state, and an explicit retry is possible when the deadline, attempt limit and risk conditions are met succeeded: payment confirmed as successful canceled: cancellation confirmed as safe expired: no unresolved attempt, and the order has expired and closed `created`: The order has been created and no valid charge attempt has been submitted yet; new attempts are allowed within the validity period `processing`: Submitted and being processed, or the outcome isn't confirmed yet; new attempts aren't allowed `requires_action`: The current attempt needs the payer to complete an action such as authentication; new attempts aren't allowed `failed`: The latest attempt clearly failed; this is not a terminal state, and an explicit retry is possible when the deadline, attempt limit and risk conditions are met `succeeded`: Payment confirmed as successful `canceled`: Cancellation confirmed as safe `expired`: No unresolved attempt, and the order has expired and closed More values may be added in the future. Don't treat a status you don't recognize as success. Example: `requires_action`
`resolution_status`	string	Required	Outcome confirmation. known: outcome confirmed needs_query: outcome unknown; the platform is running a status query against the provider using the original identifiers manual_review: past the automatic query window and handed over to manual follow-up; never marked as failed automatically `known`: Outcome confirmed `needs_query`: Outcome unknown; the platform is running a status query against the provider using the original identifiers `manual_review`: Past the automatic query window and handed over to manual follow-up; never marked as failed automatically More values may be added in the future. Don't treat a status you don't recognize as success. Example: `known`
`captured_amount`	integer(int64)	Required	The amount confirmed as captured; equal to amount on success. Constraints: `≥ 0` Example: `0`
`refunded_amount`	integer(int64)	Required	The confirmed effective refunded principal: the total of successful refunds minus confirmed refund returns. It excludes refunds that are still processing and platform exception refunds. Constraints: `≥ 0` Example: `0`
`refund_returned_amount`	integer(int64)	Required	The cumulative refund principal confirmed as returned. Constraints: `≥ 0` Example: `0`
`refund_reserved_amount`	integer(int64)	Required	Principal reserved for refunds that are under review or processing. Constraints: `≥ 0` Example: `0`
`refund_status`	string	Required	Refund summary status, derived from refunded_amount (the effective refunded principal): none, partial, full. `none` `partial` `full` More values may be added in the future. Don't treat a status you don't recognize as success. Example: `none`
`authentication_status`	stringNullable	Required	The 3DS authentication status of the current attempt, taken from the authentication session status: not_required, pending, challenge, authenticated, failed, abandoned, expired. Tolerate new values. Successful authentication (authenticated) doesn't mean the charge succeeded, so don't use it to decide the payment outcome. It's null when there is no attempt yet or the attempt hasn't entered authentication. Example: `challenge`
`reconciliation_status`	ReconciliationStatus	Required	The progress of the platform's funds processing, for reconciliation reference only. It doesn't indicate whether the payment succeeded or when you'll be paid out. `pending` `matched` `difference` `resolved` More values may be added in the future. Don't treat a status you don't recognize as success.
`upstream_receipt_status`	UpstreamReceiptStatus	Required	The progress of the platform's funds processing, for reconciliation reference only. It doesn't indicate whether the payment succeeded or when you'll be paid out. `not_received` `partially_received` `received` `reversed` More values may be added in the future. Don't treat a status you don't recognize as success.
`latest_attempt_id`	stringNullable	Required	ID of the latest payment attempt; null if no attempt has been submitted yet. Example: `pat_demo_001`
`attempt_count`	integer(int32)	Required	The number of attempts started. The default maximum is 3. Constraints: `≥ 0` Example: `1`
`version`	integer(int64)	Required	Object version, which increases with every effective business change. Compare versions to discard older events, and don't order events by status name. Constraints: `≥ 1` Example: `2`
`next_action`	NextActionNullable	Required	The action the payer must complete when status=requires_action; null in all other cases.
`type`	string	Required	The initial release of the public API exposes only redirect_to_url. Clients must tolerate types that are added in the future. `redirect_to_url` More values may be added in the future. Don't treat a status you don't recognize as success. Example: `redirect_to_url`
`authentication_session_id`	string	Required	Authentication session ID, linked to a specific payment attempt. Example: `auth_demo_001`
`url`	string(uri)	Required	The URL of the platform's authentication page. Example: `https://pay.payhub.example/auth/<SHORT_LIVED_TOKEN>`
`expires_at`	string(date-time)	Required	The time the authentication access expires (10 minutes at most). Example: `2026-09-23T09:10:00Z`
`failure`	PaymentFailureNullable	Required	The reason when the attempt that latest_attempt_id points to has clearly failed; otherwise null.
`code`	string	Required	Failure reason code. Example: `card_declined`
`message`	string	Required	Sanitized description. Example: `The issuer declined this transaction.`
`attempt_id`	string	Required	ID of the failed payment attempt. Example: `pat_demo_001`
`description`	string	No	Order summary. Constraints: `Max length 256` Example: `Example order`
`customer_reference`	string	No	Merchant-side customer reference. Constraints: `Max length 128` Example: `CUSTOMER-DEMO-001`
`metadata`	object	No	Custom key-value pairs set by the merchant: up to 20 keys. A key can be up to 40 characters, and a value is a string of up to 200 characters. Don't put sensitive data such as card numbers in it. The platform checks for such data and rejects the request. Constraints: `Up to 20 keysMax value length 200` Example: `{"business_order_type":"one_time_purchase"}`
`card`	CardSummaryNullable	Required	Masked details of the card used in the latest attempt; null when there are no card details yet.
`brand`	string	Required	Card brand. Example: `visa`
`last4`	string	Required	Last four digits of the card number. Constraints: `Format ^[0-9]{4}$` Example: `1234`
`created_at`	string(date-time)	Required	Creation time. Example: `2026-09-23T09:00:00Z`
`succeeded_at`	string(date-time)Nullable	Required	The time the payment was confirmed as successful; null if it hasn't succeeded. Example: `null`
`expires_at`	string(date-time)	Required	The deadline for starting a new attempt, fixed at creation (by default 30 minutes after creation; the platform can adjust it to between 5 and 120 minutes, so go by this field). Expiry only closes the entry point for new attempts. It doesn't invalidate a payment that was already submitted. Example: `2026-09-23T09:30:00Z`
`request_id`	string	Required	Unique identifier of this request, used for troubleshooting and support. Example: `req_demo_001`

Possible error codes

HTTP	Error code	When it occurs	How to handle
400	invalid_request	`Idempotency-Key` is missing; the order ID contains invalid characters; `payment_method_data` and `payment_method_id` are submitted together; `confirm=false` carries card details; `confirm=true` has no `return_url`; a checkout session request sends both groups of identity parameters, or neither; a `browser_info` / `billing_details` field the provider requires is missing; the cursor, time format or `limit` is invalid	Fix the request according to `error.field` and resubmit it; don't charge again automatically
404	not_found	An incorrect ID; using a test key to look up a live object; looking up a platform exception refund (not returned by the open API)	Check the ID and the environment of the key you used; the platform doesn't reveal whether another merchant's object exists
409	operation_in_progress	Requests with the same key were sent concurrently	Retry later with the same key, or retrieve `related_resource_id`; don't switch to a new key
409	invalid_state	Canceling a payment that is `processing` / `succeeded`; calling confirm on an order that has expired, been canceled or already succeeded; creating a checkout session for an order that can't be paid	Retrieve the object's latest state, then decide what to do
401	unauthenticatedCommon	No `Authorization` header was sent; the key was copied incompletely; the old key expired after a rotation; the key was revoked	Check your credentials: on the API Key page in the merchant portal, verify the key's status and environment
403	forbiddenCommon	Creating a refund with a read-only key; calling `getEvent` without the read scope for the event's business area; if the request's source IP isn't on the key's allowlist, the more specific `ip_not_allowed` is returned	Use a key that has the required scope; don't work around the restriction
429	rate_limitedCommon	A rate limit per merchant and per key; switching keys doesn't get around the merchant's overall limit	Wait for `Retry-After` seconds, then retry with the original idempotency key
500	internal_errorCommon	—	Retry with the original idempotency key, or query by merchant order ID / refund ID; never charge again with a new key
502 / 503	upstream_unavailableCommon	A provider or platform dependency failed, and the platform can't confirm whether this request took effect	Same as above

Notes

There's no request body, but you must send an idempotency key.
A payment in created, or in failed with no attempt in flight, can be canceled right away.
A requires_action payment becomes canceled only after the provider confirms the cancellation and confirms that no charge succeeded. If that can't be confirmed, the API returns 202, the status doesn't change, and the platform keeps running status queries.
Payments in processing, succeeded and similar statuses can't be canceled and return 409 invalid_state.

Caution

A 202 doesn't mean the payment was canceled. Rely on the payment.canceled event or the result of a query.

Related events: payment.canceled
Check the status when the outcome is unknown
Error codes and HTTP status

Was this page helpful?