Skip to main content

Security Deposits API

Create a card authorization link for a booking, send it through your own guest communication system, and synchronize its status using signed webhooks. All endpoints require an OAuth bearer token. Use billing.write to create, capture, or release deposits and billing.read to retrieve them.
The response contains an authorization_url. Send this URL to the guest. Repeating the request with the same Idempotency-Key returns the original deposit instead of creating a duplicate.

Retrieve deposits

The list endpoint also accepts status and per_page. Available statuses are pending, authorized, partially_captured, captured, released, expired, and failed.

Capture or release

Capture the full remaining amount by omitting amount, or capture part of it:
Release the remaining card authorization:

Webhook events

PayRequest sends deposit.created, deposit.authorized, deposit.partially_captured, deposit.captured, deposit.released, deposit.expired, and deposit.failed to the webhook URL configured under Settings β†’ API & MCP. Verify the X-PayRequest-Signature header using the configured webhook secret. The signature format is sha256= followed by the HMAC-SHA256 digest of the raw request body. The X-PayRequest-Event header contains the event name.
Card authorizations expire. Create the link close enough to check-in for the selected payment provider’s authorization window.