> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paywithatoa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Charge Saved Card | Card on File API

> Charge saved card via the Atoa Card on File API, request parameters, response schema and code samples in cURL, Python, JavaScript, PHP, Go and Java.

Charge a customer's saved card without them being present (off-session). The customer must have a previously saved payment method (see [List Payment Methods](https://docs.paywithatoa.com/api-reference/payment-methods/list-payment-methods.md)).

> [!NOTE]
>
> The response always returns `status: "PENDING"` to confirm that the payment processing has started. The final status (`COMPLETED`, `AUTHORIZED`, `FAILED`) is updated asynchronously once the card network confirms the transaction. Use [Webhooks](https://docs.paywithatoa.com/api-reference/webhook/process-payment-webhook-response.md) to receive real-time status updates, or poll the [Get Payment Status](https://docs.paywithatoa.com/api-reference/payment/get-payment-status.md) API.

> [!NOTE]
>
> For `MANUAL_CAPTURE` or `CAPTURE_BEFORE_EXPIRY`, the payment will move to `AUTHORIZED` once confirmed — you must then call [Manual Capture Payment](https://docs.paywithatoa.com/api-reference/card-on-file/capture-payment.md) to collect the funds. For `AUTO_CAPTURE`, the payment moves directly to `COMPLETED`.

### Authorization

Bearer `<accessSecret>`

**Request Body Schema**

**customerId** `string` *required*

The customer UUID to charge. Must be a valid UUID.

**paymentMethodId** `string` *required*

The saved card ID from [List Payment Methods](https://docs.paywithatoa.com/api-reference/payment-methods/list-payment-methods.md) response (`id` field). 1-64 characters.

**captureType** `string` *required*

How to capture the payment.

> **Possible values**
>
> * `AUTO_CAPTURE` — Capture immediately once confirmed. Final status: `COMPLETED`.
> * `MANUAL_CAPTURE` — Authorize only. Final status: `AUTHORIZED`. Call [Manual Capture Payment](https://docs.paywithatoa.com/api-reference/card-on-file/capture-payment.md) later to collect funds.
> * `CAPTURE_BEFORE_EXPIRY` — Authorize and auto-capture before expiry if not manually captured or cancelled. Final status: `AUTHORIZED` until captured.

**amount** `number` *required*

Payment amount in pounds. Example: `10.50` for ten pounds fifty pence. Minimum: £1.

**orderId** `string` *required*

Your merchant order reference for tracking. 1-50 characters, must not be blank.

**notes** `string`

Short payment description or notes. Max 30 characters.

**storeId** `string`

Store UUID. If not provided, the merchant's primary store is used. Refer [Get Stores API](https://docs.paywithatoa.com/api-reference/payment/get-stores.md).

**Response**

**paymentRequestId** `string`

Unique payment identifier (UUID). Use this for [Capture](https://docs.paywithatoa.com/api-reference/card-on-file/capture-payment.md), [Cancel](https://docs.paywithatoa.com/api-reference/card-on-file/cancel-payment.md), and status queries.

**status** `string`

Always `PENDING` in the initial response. Indicates that payment processing has been initiated. The final status is updated asynchronously via [webhook](https://docs.paywithatoa.com/api-reference/webhook/process-payment-webhook-response.md).

**amount** `number`

Payment amount in pounds.

**currency** `string`

Currency code (e.g., `GBP`).

**orderId** `string`

Your merchant order reference.

**customerId** `string`

The charged customer's UUID.

**paymentMethodId** `string`

The card used for payment.

**captureType** `string`

The capture type used.

**createdAt** `string`

ISO 8601 timestamp.

**expiresAt** `string`

When the authorization expires (only for MANUAL\_CAPTURE / CAPTURE\_BEFORE\_EXPIRY).

```bash curl theme={null}
curl --request POST \
  --url https://api.atoa.me/api/payments/card/process-payment \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "amount": 10.50,
  "orderId": "ORDER-001",
  "notes": "Payment for order #001"
}'
```

```python Python theme={null}
import requests

url = "https://api.atoa.me/api/payments/card/process-payment"

payload = {
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())
```

```javascript JavaScript theme={null}
const response = await fetch(
  "https://api.atoa.me/api/payments/card/process-payment",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer <token>",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      customerId: "550e8400-e29b-41d4-a716-446655440000",
      paymentMethodId: "card_abc123def456",
      captureType: "AUTO_CAPTURE",
      amount: 10.50,
      orderId: "ORDER-001",
      notes: "Payment for order #001",
    }),
  }
);

const data = await response.json();
console.log(data);
```

```php PHP theme={null}
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/payments/card/process-payment",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    "customerId" => "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId" => "card_abc123def456",
    "captureType" => "AUTO_CAPTURE",
    "amount" => 10.50,
    "orderId" => "ORDER-001",
    "notes" => "Payment for order #001"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
curl_close($curl);
echo $response;
```

```go Go theme={null}
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://api.atoa.me/api/payments/card/process-payment"
  payload := strings.NewReader(`{
    "customerId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentMethodId": "card_abc123def456",
    "captureType": "AUTO_CAPTURE",
    "amount": 10.50,
    "orderId": "ORDER-001",
    "notes": "Payment for order #001"
  }`)

  req, _ := http.NewRequest("POST", url, payload)
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)
  fmt.Println(string(body))
}
```

```java Java theme={null}
HttpResponse<String> response = Unirest.post("https://api.atoa.me/api/payments/card/process-payment")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\"customerId\":\"550e8400-e29b-41d4-a716-446655440000\",\"paymentMethodId\":\"card_abc123def456\",\"captureType\":\"AUTO_CAPTURE\",\"amount\":10.50,\"orderId\":\"ORDER-001\",\"notes\":\"Payment for order #001\"}")
  .asString();
```

```json 201 (AUTO_CAPTURE) theme={null}
{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "AUTO_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z"
}
```

```json 201 (MANUAL_CAPTURE) theme={null}
{
  "paymentRequestId": "9baa68d8-362a-4127-994d-2ea622ef35ee",
  "status": "PENDING",
  "amount": 10.50,
  "currency": "GBP",
  "orderId": "ORDER-001",
  "customerId": "550e8400-e29b-41d4-a716-446655440000",
  "paymentMethodId": "card_abc123def456",
  "captureType": "MANUAL_CAPTURE",
  "createdAt": "2025-06-15T10:30:00.000Z",
  "expiresAt": "2025-06-22T10:30:00.000Z"
}
```

```json 400 theme={null}
{
  "name": "BAD_REQUEST",
  "message": "Amount should not be less than £1.",
  "status": 400,
  "errors": []
}
```

```json 404 theme={null}
{
  "name": "NOT_FOUND",
  "message": "Customer or card not found",
  "status": 404,
  "errors": []
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.