Create an Authorization

Create an Authorization to process a transaction.

Endpoint: POST /authorizations
Security: BasicAuth

Header parameters:

• Finix-Version (string)
  Specify the API version of your request. For more details, see Versioning.
  Example: "2022-02-01"

• Content-Type (string)
  The data type being sent in the request body must be application/json.
  Example: "application/json"

Response 201 fields (application/json):

• id (string)
  The ID of the Authorization resource.
  Example: "AUxxxxxxxxxxxxxxxxxx"

• created_at (string)
  Timestamp of when the object was created.

• updated_at (string)
  Timestamp of when the object was last updated.

• 3ds_redirect_url (string,null)
  The redirect URL used for 3DS transactions (if supported by the processor).

• additional_buyer_charges (object,null)
  Details about any Buyer Charges included in the Authorization. The buyer charges are mutually exclusive.

• additional_buyer_charges.convenience_amount (integer,null)
  A convenience fee to charge the buyer for the transaction. This object property is mutually exclusive.

• additional_buyer_charges.rent_surcharge_amount (integer,null)
  A rent surcharge to charge the buyer for the transaction. This object property is mutually exclusive.

• additional_buyer_charges.surcharge_amount (integer,null)
  A surcharge amount to charge the buyer for the transaction. This object property is mutually exclusive.

• additional_healthcare_data (object,null)
  Object detailing any additional healthcare amounts included in the Authorization.

• additional_healthcare_data.clinic_amount (integer,null)
  A clinic or other qualified medical amount for the transaction.

• additional_healthcare_data.dental_amount (integer,null)
  The dental amount for the transaction.

• additional_healthcare_data.prescription_amount (integer,null)
  The prescription/RX amount for the transaction.

• additional_healthcare_data.vision_amount (integer,null)
  The vision/optical amount for the transaction.

• additional_purchase_data (object,null)
  Additional information about the purchase used for Level 2 and Level 3 Processing. Please note that Visa is ending its Level 2 offering in April 2026.

• additional_purchase_data.customer_reference_number (string)
  The customer reference for the purchase (max 17 characters). For Visa, this field no longer qualifies for lower interchange after April 17, 2026. Include item_data for Level 3 processing.

• additional_purchase_data.customs_duty_amount (integer)
  The duty in cents on the total purchase amount for the order.

• additional_purchase_data.destination_country_code (string)
  The ISO country code of the order destination.

• additional_purchase_data.destination_postal_code (string)
  The postal code of the order destination (10 characters).

• additional_purchase_data.discount_amount (integer)
  The amount in cents of the discount for the order. You must include this field to qualify for Level 3 interchange benefits. Even if the value is (0), you should pass the field to qualify for Level 3.

• additional_purchase_data.invoice_reference_number (string)
  The order's invoice number (max 15 characters).

• additional_purchase_data.order_date (object)

• additional_purchase_data.order_date.day (integer)
  Day of purchase (between 1 and 31).

• additional_purchase_data.order_date.month (integer)
  Month of purchase (between 1 and 12).

• additional_purchase_data.order_date.year (integer)
  Year of purchase (4-digit).

• additional_purchase_data.sales_tax (integer)

  • Total aggregate tax amount in cents for the entire purchase. Field is automatically calculated if you pass in the itemized tax amounts.

• For non-taxable transactions either set sales_tax to 0 or omit from payload and also set tax_exempt to True.

• Request must align so amount_excluding_sales_tax + sales_tax = amount_including_sales_tax.

• For Visa, this field no longer qualifies for lower interchange after April 17, 2026. Include item_data for Level 3 processing.

  • additional_purchase_data.sales_tax_finix_generated (integer,null)
    The sales tax amount in cents Finix calculated from the item_data line items.

• additional_purchase_data.ship_from_postal_code (string)
  The postal code from where order is shipped (10 characters).

• additional_purchase_data.shipping_amount (integer)
  The shipping cost in cents for the order.

• additional_purchase_data.tax_exempt (boolean)

  • For tax exempt purchases set to True.

• If set to True, request can't include sales_tax.

• additional_purchase_data.item_data (array)
  Additional information about the transaction. Used for Level 2 and Level 3 Processing.

• additional_purchase_data.item_data.amount_excluding_sales_tax (integer)

  • Total cost of the line item in cents, excluding tax.

• Must align with sales_tax so amount_excluding_sales_tax + sales_tax = amount_including_sales_tax.

• additional_purchase_data.item_data.amount_including_sales_tax (integer)

  • Total cost of the line item in cents, including tax.

• Must align with sales_tax so amount_excluding_sales_tax + sales_tax = amount_including_sales_tax.

• additional_purchase_data.item_data.commodity_code (string)
  A commodity code is a numeric code representing a particular product or service as defined by the National Institute of Governmental Purchasing. The code can be 3, 5, 7, or 11 digits in length. The longer the code the more granular the description of the product/service. (max 12 characters).

• additional_purchase_data.item_data.cost_per_unit (integer)
  The price in cents, excluding tax, of one unit of the item purchased.

• additional_purchase_data.item_data.item_description (string)
  Required when item_data is supplied (max 25 characters).

• additional_purchase_data.item_data.item_discount_amount (integer)
  The item discount amount in cents. You must include this field to qualify for Level 3 interchange benefits. Even if the value is (0), you should pass the field to qualify for Level 3.

• additional_purchase_data.item_data.merchant_product_code (string)
  Merchant defined product code (max 12 characters).

• additional_purchase_data.item_data.quantity (number)
  The number of items purchased. Must be greater than 0.

• additional_purchase_data.item_data.unit_of_measure (string)
  The unit of measure of the purchased item (max 3 characters).

• address_verification (string,null)
  Details the results of the Address Verification checks.

• amount (integer)
  The total amount that will be debited in cents (e.g. 100 cents to debit $1.00).
  Example: 5000

• amount_requested (integer)
  When default_partial_authorization_enabled is set to true, amount_requested indicates the amount the cardholder attempted to authorize.

• application (string)
  The ID of the Application resource the Authorization was created under.

• card_present_details (object,null)
  Details needed to process card present transactions.

• card_present_details.approval_code (string,null)
  Unique ID used to identify the approval of the Transfer.

• card_present_details.brand (string,null)
  The brand of the card saved in the Payment Instrument.

• card_present_details.digital_signature_file_id (string,null)
  If a signature was collected this will contain the the id of the File resource which stored the signature.

• card_present_details.emv_data (object,null)
  Encrypted card data used to process the transaction.

• card_present_details.emv_data.application_identifier (string)
  ID of the application used in the transaction. Tag 9F06 from the EMVCo standard.

• card_present_details.emv_data.application_label (string)
  EMV application label. Tag 50 from the EMVCo standard.

• card_present_details.emv_data.application_preferred_name (string,null)
  EMV application label with formatting (if provided). Tag 9F12 from the EMVCo standard.

• card_present_details.emv_data.application_transaction_counter (string)
  Transaction number for the EMV application. Tag 9F36 from the EMVCo standard.

• card_present_details.emv_data.cryptogram (string)
  Cryptogram returned by the card. Tag 9F26 of the EMVCo standard.

• card_present_details.emv_data.issuer_code_table_index (string,null)
  The alphabet code table (according to ISO 8859) used by the EMV application (if provided). Tag 9F11.

• card_present_details.emv_data.pin_verified (boolean)
  Whether the cardholder's PIN number was verified.

• card_present_details.emv_data.tags (object,null)
  Include up to 50 key: value pairs to annotate requests with custom metadata.

• Maximum character length for individual keys is 40.

• Maximum character length for individual values is 500. (For example, order_number: 25, item_type: produce, department: sales)

• card_present_details.entry_mode (string,null)
  Details of the card payment method used to process the transaction.

The possible enums are:

• UNKNOWN - The method by which the payment card was used is unknown.

• SWIPED - The card was swiped through a POS terminal.

• CONTACTLESS - The payment was made by tapping a card on a POS terminal.

• CHIP_ENTRY - The payment card was inserted into a card reader. Enum: "UNKNOWN", "SWIPED", "CONTACTLESS", "CHIP_ENTRY"

• card_present_details.masked_account_number (string,null)
  Last four digits of the bank account number.

• card_present_details.name (string,null)
  The name of the card owner.

• card_present_details.payment_type (string)
  The type of Payment Instrument used in the transaction (or the original payment).

• currency (string)
  ISO 4217 3-letter currency code. Enum: "CAD", "USD"

• created_via (string)
  Gives more information about the product flow that was used to create the resource. Finix retains the right to add additional enums for this field without it being a breaking change. Enum: "CARD_PRESENT_SEMI_INTEGRATED_API", "CARD_PRESENT_STANDALONE", "CARD_PRESENT_STANDALONE_MANUAL_ENTRY", "CARD_PRESENT_IOS_APP", "CARD_PRESENT_IOS_APP_MANUAL_ENTRY", "CARD_PRESENT_IOS_D135_SDK", "CARD_PRESENT_ANDROID_APP", "CARD_PRESENT_ANDROID_APP_MANUAL_ENTRY", "CARD_PRESENT_ANDROID_D135_SDK", "CHECKOUT_FORM", "CYBERSOURCE", "PAYMENT_LINK", "PAYOUT_LINK", "PLUGIN_CHECKOUT_CHAMP", "PLUGIN_FYNTEK", "PLUGIN_GAMBLE_ID", "PLUGIN_GAMMA_SWEEP", "PLUGIN_HYPERSWITCH", "PLUGIN_PAYSIGHT", "PLUGIN_STICKYIO", "PLUGIN_TAGADA", "PLUGIN_WOO_COMMERCE", "SUBSCRIPTION", "UNKNOWN", "VIRTUAL_TERMINAL"

• device (string,null)
  The ID of the activated device. Example: "DVxxxxxxxxxxxxxxxxxx"

• expires_at (string)
  Authorization expiration time.

• failure_code (string,null)
  The code of the failure so the decline can be handled programmatically. For more info on how to handle the failure, see Failure Codes.

• failure_message (string,null)
  A human-readable description of why the transaction was declined. This will also include a suggestion on how to complete the payment.

• identity (string)
  ID of the buyer 'Identity' to run the card present authorization. Finix tokenizes the card associated with the provided 'Identity' and processes the authorization, removing the need to create a blank buyer Identity.

• idempotency_id (string,null)
  Pass any randomly generated or internal ID to idempotently identify Transfers, Authorizations, or refund requests.

• ip_address_details (object)
  This field returns null for all users except ROLE_PLATFORM users.

• ip_address_details.ipv4 (object)

• ip_address_details.ipv4.estimated_location (object)

• ip_address_details.ipv4.estimated_location.line1 (string,null, required)
  First line of the address (max 35 characters).

• ip_address_details.ipv4.estimated_location.line2 (string,null)
  Second line of the address (max 35 characters).

• ip_address_details.ipv4.estimated_location.city (string,null, required)
  City (max 20 characters).

• ip_address_details.ipv4.estimated_location.region (string,null, required)
  2-letter State code.

• ip_address_details.ipv4.estimated_location.postal_code (string,null, required)
  Zip or Postal code (max 7 characters).

• ip_address_details.ipv4.estimated_location.country (string,null, required)
  Enum: "ABW", "AFG", "AGO", "AIA", "ALA", "ALB", "AND", "ARE", "ARG", "ARM", "ASM", "ATA", "ATF", "ATG", "AUS", "AUT", "AZE", "BDI", "BEL", "BEN", "BES", "BFA", "BGD", "BGR", "BHR", "BHS", "BIH", "BLM", "BLR", "BLZ", "BMU", "BOL", "BRA", "BRB", "BRN", "BTN", "BVT", "BWA", "CAF", "CAN", "CCK", "CHE", "CHL", "CHN", "CIV", "CMR", "COD", "COG", "COK", "COL", "COM", "CPV", "CRI", "CUB", "CUW", "CXR", "CYM", "CYP", "CZE", "DEU", "DJI", "DMA", "DNK", "DOM", "DZA", "ECU", "EGY", "ERI", "ESH", "ESP", "EST", "ETH", "FIN", "FJI", "FLK", "FRA", "FRO", "FSM", "GAB", "GBR", "GEO", "GGY", "GHA", "GIB", "GIN", "GLP", "GMB", "GNB", "GNQ", "GRC", "GRD", "GRL", "GTM", "GUF", "GUM", "GUY", "HKG", "HMD", "HND", "HRV", "HTI", "HUN", "IDN", "IMN", "IND", "IOT", "IRL", "IRN", "IRQ", "ISL", "ISR", "ITA", "JAM", "JEY", "JOR", "JPN", "KAZ", "KEN", "KGZ", "KHM", "KIR", "KNA", "KOR", "KWT", "LAO", "LBN", "LBR", "LBY", "LCA", "LIE", "LKA", "LSO", "LTU", "LUX", "LVA", "MAC", "MAF", "MAR", "MCO", "MDA", "MDG", "MDV", "MEX", "MHL", "MKD", "MLI", "MLT", "MMR", "MNE", "MNG", "MNP", "MRT", "MSR", "MTQ", "MUS", "MWI", "MYS", "MYT", "NAM", "NCL", "NER", "NFK", "NGA", "NIC", "NIU", "NLD", "NOR", "NPL", "NRU", "NZL", "OMN", "PAK", "PAN", "PCN", "PER", "PHL", "PLW", "PNG", "POL", "PRI", "PRK", "PRT", "PRY", "PSE", "PYF", "QAT", "REU", "ROU", "RUS", "RWA", "SAU", "SDN", "SEN", "SGP", "SGS", "SHN", "SJM", "SLB", "SLE", "SLV", "SMR", "SOM", "SPM", "SRB", "SSD", "STP", "SUR", "SVK", "SVN", "SWE", "SWZ", "SXM", "SYC", "SYR", "TCA", "TCD", "TGO", "THA", "TJK", "TKL", "TKM", "TLS", "TON", "TTO", "TUN", "TUR", "TUV", "TWN", "TZA", "UGA", "UKR", "UMI", "URY", "USA", "UZB", "VAT", "VCT", "VEN", "VGB", "VIR", "VNM", "VUT", "WLF", "WSM", "XKX", "YEM", "ZAF", "ZMB", "ZWE"

• ip_address_details.ipv4.ip (string,null)
  The card brands require the customer's IP address for online gaming clients. Only supports Internet Protocol version 4 (IPv4).
  Example: "192.168.1.1"

• ip_address_details.ipv4.latitude (number)
  Geo-location based on the IP address.

• ip_address_details.ipv4.longitude (number)
  Geo-location based on the IP address.

• is_void (boolean)
  Whether the Authorization has been voided.

• merchant (string)
  The ID of the Merchant resource the Authorization was created under.
  Example: "MUxxxxxxxxxxxxxxxxxxxxxx"

• merchant_identity (string)
  The ID of the Identity resource used by the Merchant the Authorization was processed under.
  Example: "IDxxxxxxxxxxxxxxxxxxxxxx"

• messages (array,null)
  Message field that provides additional details. This field is typically null.

• network_details (object,null)
  Contains network-specific fields used by issuers to identify transactions.

• network_details.brand (string)
  Card brand associated with the saved payment instrument.
  Example: "VISA"

• network_details.authorization_code (string)
  Code returned by the issuing bank when a transaction is authorized.
  Example: 82533

• raw (any)
  Raw response from the processor.

• receipt_last_printed_at (string,null)
  Timestamp when the receipt was last printed.

• security_code_verification (string,null)
  Details the results of the Security Code Verification checks.

• source (string)
  ID of the Payment Instrument where funds get debited.
  Example: "PIxxxxxxxxxxxxxxxxxx"

• state (string)
  The state of the Authorization.
  Enum: "CANCELED", "PENDING", "FAILED", "SUCCEEDED", "UNKNOWN"

• supplemental_fee (integer,null)
  Amount in cents for which an additional fee will be created in addition to any fees created from the assigned fee profile.

• tags (object,null)
  Include up to 50 key: value pairs to annotate requests with custom metadata.

• Maximum character length for individual keys is 40.

• Maximum character length for individual values is 500. (For example, order_number: 25, item_type: produce, department: sales)

• trace_id (string)
  Trace ID of the Authorization. The processor sends back the trace_id so you can track the authorization end-to-end.

• transfer (string,null)
  The ID of the transfer resource that gets created when the Authorization moves to SUCCEEDED.
  Example: "TRxxxxxxxxxxxxxxxxxx"

• void_state (string)
  The state of the void attempt for the Authorization.
  Enum: "UNATTEMPTED", "PENDING", "SUCCEEDED"

• _links (object)

• _links.self (object)
  Link to the resource that was used in the request.

• _links.self.href (string)

• _links.application (object)
  Link to the Application the request was made under.

• _links.application.href (string)

• _links.device (object)
  Link to the Device the request was made under.

• _links.device.href (string)

• _links.merchant_identity (object)
  Link to the Identity the Merchant was created under and the Transfer was submitted with.

• _links.merchant_identity.href (string)

• _links.transfers (object)
  Link to the Transfer the request was made under.

• _links.transfers.href (string)

Response 400 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 401 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 402 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 403 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 404 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 406 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 422 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.