Viator Payments API

openapi: 3.2.0
info:
  title: Viator Partner Payments API
  description: 'code { white-space: nowrap; }

    a { font-weight: bold; }


    figure {

    width: 100%;

    text-align: center;

    font-style: italic;

    font-size: smaller;

    text-indent: 0;

    border: thin silver solid;

    margin: 0.5em;

    padding: 0.5em;

    }


    ## Updates


    ### Latest updates:


    | Date | Description…'
  version: '2.0'
  license:
    name: CC BY 4.0
    url: https://creativecommons.org/licenses/by/4.0/au/
servers:
- url: https://api.viator.com/partner
  description: Production server (uses live data)
- url: https://api.sandbox.viator.com/partner
  description: Sandbox server (uses test data)
security:
- API-key: []
tags:
- name: Payments
paths:
  /v1/checkoutsessions/{sessionToken}/paymentaccounts:
    post:
      tags:
      - Payments
      operationId: paymentsCreateToken
      summary: /v1/checkoutsessions/{sessionToken}/paymentaccounts
      description: 'Creates a payment token from raw credit card details for use with the /bookings/cart/book endpoint.


        The URL should not be constructed manually, instead use the `paymentDataSubmissionUrl` value returned from the /bookings/cart/hold endpoint.


        When using the API payment solution, it is a requirement that you implement our fraud prevention solution. See Implementing the API Solution for more details.


        **Note**:

        - This endpoint utilises a different domain to other endpoints referenced in the API.

        - This endpoint is only available to affiliate partners with API access level "Full Access + Booking".'
      servers:
      - url: https://api.tapayments.com
        description: Production server (uses live data)
      - url: https://api.staging.tapayments.com
        description: Sandbox server (uses test data)
      security: []
      parameters:
      - name: Content-Type
        in: header
        description: Identifies the payload as application/json.
        required: true
        schema:
          type: string
          example: application/json
      - name: x-trip-clientid
        in: header
        description: 'This is your unique partner identifier, which you can find in the Viator Partner Program: https://partners.viator.com/login'
        required: true
        schema:
          type: string
          example: P0123456789
      - name: x-trip-requestid
        in: header
        description: Any client-side generated request identifier, unique per request.
        required: true
        schema:
          type: string
          example: 9dbb490a-d953-4a9b-875a-728b5f335b29
      - name: User-Agent
        in: header
        description: value should be appropriate to the client you are using, e.g. "curl/8.8.0"
        required: true
        schema:
          type: string
          example: curl/8.8.0
      - name: sessionToken
        in: path
        description: 'The `sessionToken` is obtained from calling the [/bookings/cart/hold](#operation/bookingsCartHold) endpoint and embedded in the `paymentDataSubmissionUrl`.


          **Note:** The `paymentDataSubmissionUrl` value should be used instead of contructing the URL manually.

          '
        required: true
        schema:
          type: string
        example: CSI-P-kwftrgmrbfbglkaw4espjdr52e
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VaultCardRequest'
            example:
              paymentAccounts:
                creditCards:
                - number: '4111111111111111'
                  cvv: '234'
                  expMonth: '03'
                  expYear: '2026'
                  name: Jane Doe
                  address:
                    country: US
                    postalCode: 02494
        required: true
      responses:
        '200':
          description: Card successfully stored.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VaultPaymentResponse'
              example:
                paymentAccounts:
                  creditCards:
                  - persistAccount: false
                    cardType: Visa
                    name: Jane Doe
                    number: ''
                    accountHead: '411111'
                    accountTail: '1111'
                    expMonth: '03'
                    expYear: '2026'
                    cvv: ''
                    address:
                      street: ''
                      street2: ''
                      city: ''
                      state: ''
                      country: US
                      postalCode: 02494
                      phoneNumber: ''
                    accountMetaData:
                      sessionAccountToken: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                      accountFingerprint: ''
                  bankAccounts: []
                  cvvs: []
                  bankMandates: []
                responseHeader:
                  apiVersion: 1
                  responseId: RES-rciyl2b2q5gidlusbsq3ofht44
                  responseCode: 2000
                  responseMessage: ok
                  errors: []
        '404':
          description: Checkout session expired or not found.
          content:
            application/json:
              example:
                paymentAccounts:
                  creditCards: []
                responseHeader:
                  apiVersion: 1
                  responseId: RES-sa2lfnzy7rdixep2vhte4bjbzq
                  responseCode: 4004
                  responseMessage: Checkout session has expired.
                  errors:
                  - responseStatus: NOT_FOUND
                    responseCode: 4004
                    responseMessage: Checkout session has expired.
                    isExpectedError: true
                    requestFieldPath: param.checkoutsessionid
                    responseDetail: ''
components:
  schemas:
    AccountMetaData:
      type: object
      properties:
        sessionAccountToken:
          type: string
          description: Token for the submitted card, to be supplied when payment is requested.
          example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
    Address:
      required:
      - country
      - postalCode
      type: object
      properties:
        country:
          type: string
          description: The country of the registered billing address, in two character ISO_3166-1 alpha-2 format.
          example: US
        postalCode:
          type: string
          description: The post code of the registered billing address. 4-9 alphanumeric characters, optionally separated space.
          example: 02494
      description: Minimal billing address details for cardholder
    CreditCardRequest:
      required:
      - cvv
      - expMonth
      - expYear
      - name
      - number
      - address
      type: object
      properties:
        number:
          type: string
          description: The full card number, without spaces.
          example: '4111111111111111'
        cvv:
          type: string
          description: The three or four digit CVV.
          example: '234'
        expMonth:
          type: string
          description: Two digit representation of expiry month.
          example: '03'
        expYear:
          type: string
          description: Four digit representation of expiry year.
          example: '2026'
        name:
          type: string
          description: The cardholder's full name.
          example: Jane Doe
        address:
          $ref: '#/components/schemas/Address'
      description: PCI sensitive details for a debit or credit card and relevant metadata.
    VaultPaymentResponse:
      required:
      - paymentAccounts
      type: object
      properties:
        paymentAccounts:
          $ref: '#/components/schemas/PaymentAccounts'
    CreditCard:
      required:
      - accountHead
      - accountTail
      - expMonth
      - expYear
      - name
      type: object
      properties:
        cardType:
          type: string
          description: The name of card network for the card submitted.
          example: Visa
        expMonth:
          type: string
          description: Two digit representation of expiry month.
          example: '03'
        expYear:
          type: string
          description: Four digit representation of expiry year.
          example: '2026'
        name:
          type: string
          description: The cardholder's full name.
          example: Jane Doe
        accountHead:
          type: string
          description: The first six numbers of the card, the BIN portion.
          example: '411111'
        accountTail:
          type: string
          description: The last four numbers of the card.
          example: '1111'
        address:
          $ref: '#/components/schemas/Address'
        accountMetaData:
          $ref: '#/components/schemas/AccountMetaData'
    PaymentAccounts:
      type: object
      properties:
        creditCards:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/CreditCard'
    VaultCardRequest:
      required:
      - paymentAccounts
      type: object
      properties:
        paymentAccounts:
          $ref: '#/components/schemas/PaymentAccountsRequest'
      description: The card submission payload.
    PaymentAccountsRequest:
      required:
      - creditCards
      type: object
      properties:
        creditCards:
          type: array
          description: Array of card data, normal use is single item.
          items:
            $ref: '#/components/schemas/CreditCardRequest'
      description: Wrapper element around payment data.
  securitySchemes:
    API-key:
      type: apiKey
      in: header
      name: exp-api-key