Charge Saved Card | Card on File API

curl --request POST \
  --url https://api.atoa.me/api/payments/card/process-payment \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "amount": 10.50,
  "orderId": "ORDER-001",
  "notes": "Payment for order #001"
}'

import requests

url = "https://api.atoa.me/api/payments/card/process-payment"

payload = {
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

const response = await fetch(
  "https://api.atoa.me/api/payments/card/process-payment",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer <token>",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      customerId: "550e8400-e29b-41d4-a716-446655440000",
      paymentMethodId: "card_abc123def456",
      captureType: "AUTO_CAPTURE",
      amount: 10.50,
      orderId: "ORDER-001",
      notes: "Payment for order #001",
    }),
  }
);

const data = await response.json();
console.log(data);

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/payments/card/process-payment",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    "customerId" => "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId" => "card_abc123def456",
    "captureType" => "AUTO_CAPTURE",
    "amount" => 10.50,
    "orderId" => "ORDER-001",
    "notes" => "Payment for order #001"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
curl_close($curl);
echo $response;

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://api.atoa.me/api/payments/card/process-payment"
  payload := strings.NewReader(`{
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
  }`)

  req, _ := http.NewRequest("POST", url, payload)
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)
  fmt.Println(string(body))
}

HttpResponse<String> response = Unirest.post("https://api.atoa.me/api/payments/card/process-payment")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\"customerId\":\"550e8400-e29b-41d4-a716-446655440000\",\"paymentMethodId\":\"card_abc123def456\",\"captureType\":\"AUTO_CAPTURE\",\"amount\":10.50,\"orderId\":\"ORDER-001\",\"notes\":\"Payment for order #001\"}")
  .asString();

{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z"
}

{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "MANUAL_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z",
  "expiresAt": "2025-06-22T10:30:00.000Z"
}

{
  "name": "BAD_REQUEST",
  "message": "Amount should not be less than £1.",
  "status": 400,
  "errors": []
}

{
  "name": "NOT_FOUND",
  "message": "Customer or card not found",
  "status": 404,
  "errors": []
}

POST

api

payments

card

process-payment

curl --request POST \
  --url https://api.atoa.me/api/payments/card/process-payment \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "amount": 10.50,
  "orderId": "ORDER-001",
  "notes": "Payment for order #001"
}'

import requests

url = "https://api.atoa.me/api/payments/card/process-payment"

payload = {
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

const response = await fetch(
  "https://api.atoa.me/api/payments/card/process-payment",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer <token>",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      customerId: "550e8400-e29b-41d4-a716-446655440000",
      paymentMethodId: "card_abc123def456",
      captureType: "AUTO_CAPTURE",
      amount: 10.50,
      orderId: "ORDER-001",
      notes: "Payment for order #001",
    }),
  }
);

const data = await response.json();
console.log(data);

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/payments/card/process-payment",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    "customerId" => "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId" => "card_abc123def456",
    "captureType" => "AUTO_CAPTURE",
    "amount" => 10.50,
    "orderId" => "ORDER-001",
    "notes" => "Payment for order #001"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
curl_close($curl);
echo $response;

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://api.atoa.me/api/payments/card/process-payment"
  payload := strings.NewReader(`{
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
  }`)

  req, _ := http.NewRequest("POST", url, payload)
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)
  fmt.Println(string(body))
}

HttpResponse<String> response = Unirest.post("https://api.atoa.me/api/payments/card/process-payment")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\"customerId\":\"550e8400-e29b-41d4-a716-446655440000\",\"paymentMethodId\":\"card_abc123def456\",\"captureType\":\"AUTO_CAPTURE\",\"amount\":10.50,\"orderId\":\"ORDER-001\",\"notes\":\"Payment for order #001\"}")
  .asString();

{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z"
}

{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "MANUAL_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z",
  "expiresAt": "2025-06-22T10:30:00.000Z"
}

{
  "name": "BAD_REQUEST",
  "message": "Amount should not be less than £1.",
  "status": 400,
  "errors": []
}

{
  "name": "NOT_FOUND",
  "message": "Customer or card not found",
  "status": 404,
  "errors": []
}

Charge a customer’s saved card without them being present (off-session). The customer must have a previously saved payment method (see List Payment Methods).

The response always returns status: "PENDING" to confirm that the payment processing has started. The final status (COMPLETED, AUTHORIZED, FAILED) is updated asynchronously once the card network confirms the transaction. Use Webhooks to receive real-time status updates, or poll the Get Payment Status API.

For MANUAL_CAPTURE or CAPTURE_BEFORE_EXPIRY, the payment will move to AUTHORIZED once confirmed — you must then call Manual Capture Payment to collect the funds. For AUTO_CAPTURE, the payment moves directly to COMPLETED.

Authorization

Bearer <accessSecret> Request Body Schema

string

required

The customer UUID to charge. Must be a valid UUID.

string

required

The saved card ID from List Payment Methods response (id field). 1-64 characters.

string

required

How to capture the payment.

Possible values

AUTO_CAPTURE — Capture immediately once confirmed. Final status: COMPLETED.
MANUAL_CAPTURE — Authorize only. Final status: AUTHORIZED. Call Manual Capture Payment later to collect funds.
CAPTURE_BEFORE_EXPIRY — Authorize and auto-capture before expiry if not manually captured or cancelled. Final status: AUTHORIZED until captured.

number

required

Payment amount in pounds. Example: 10.50 for ten pounds fifty pence. Minimum: £1.

string

required

Your merchant order reference for tracking. 1-50 characters, must not be blank.

string

Short payment description or notes. Max 30 characters.

string

Store UUID. If not provided, the merchant’s primary store is used. Refer Get Stores API.

Response

string

Unique payment identifier (UUID). Use this for Capture, Cancel, and status queries.

string

Always PENDING in the initial response. Indicates that payment processing has been initiated. The final status is updated asynchronously via webhook.

number

Payment amount in pounds.

string

Currency code (e.g., GBP).

string

Your merchant order reference.

string

The charged customer’s UUID.

string

The card used for payment.

string

The capture type used.

string

ISO 8601 timestamp.

string

When the authorization expires (only for MANUAL_CAPTURE / CAPTURE_BEFORE_EXPIRY).

curl --request POST \
  --url https://api.atoa.me/api/payments/card/process-payment \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "amount": 10.50,
  "orderId": "ORDER-001",
  "notes": "Payment for order #001"
}'

import requests

url = "https://api.atoa.me/api/payments/card/process-payment"

payload = {
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

const response = await fetch(
  "https://api.atoa.me/api/payments/card/process-payment",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer <token>",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      customerId: "550e8400-e29b-41d4-a716-446655440000",
      paymentMethodId: "card_abc123def456",
      captureType: "AUTO_CAPTURE",
      amount: 10.50,
      orderId: "ORDER-001",
      notes: "Payment for order #001",
    }),
  }
);

const data = await response.json();
console.log(data);

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/payments/card/process-payment",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    "customerId" => "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId" => "card_abc123def456",
    "captureType" => "AUTO_CAPTURE",
    "amount" => 10.50,
    "orderId" => "ORDER-001",
    "notes" => "Payment for order #001"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
curl_close($curl);
echo $response;

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://api.atoa.me/api/payments/card/process-payment"
  payload := strings.NewReader(`{
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
  }`)

  req, _ := http.NewRequest("POST", url, payload)
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)
  fmt.Println(string(body))
}

HttpResponse<String> response = Unirest.post("https://api.atoa.me/api/payments/card/process-payment")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\"customerId\":\"550e8400-e29b-41d4-a716-446655440000\",\"paymentMethodId\":\"card_abc123def456\",\"captureType\":\"AUTO_CAPTURE\",\"amount\":10.50,\"orderId\":\"ORDER-001\",\"notes\":\"Payment for order #001\"}")
  .asString();

{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z"
}

{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "MANUAL_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z",
  "expiresAt": "2025-06-22T10:30:00.000Z"
}

{
  "name": "BAD_REQUEST",
  "message": "Amount should not be less than £1.",
  "status": 400,
  "errors": []
}

{
  "name": "NOT_FOUND",
  "message": "Customer or card not found",
  "status": 404,
  "errors": []
}

Overview

Reference

Webhook

Card on File

Charge Saved Card | Card on File API

Authorization

​Authorization

Authorization