---
title: "Update a payment"
method: PATCH
path: "/v1/payments/{id}"
tags: ["Payment"]
---

# Update a payment

`PATCH /v1/payments/{id}`

Updates a payment / deposit ("abono").

## Permitted fields
A non-staff company user (with access to the payment's company) may only edit
`comments`. The request is rejected with `401 Unauthorized` only when `comments` is
absent from the body; if `comments` is present, any other (staff-only) fields sent
alongside it are silently dropped and the request succeeds with `200`. The full set
of payment fields is editable only by Cardda staff (admin/superadmin).

Unlike the list/detail endpoints, the update response returns the bare payment
record: it does NOT include the `amount` money object or the `ppo_allocations` array.

## Path parameters

- `id` string, uuid, required

## Parameters

- `#/paths/~1v1~1bills/get/parameters/0` — unresolved $ref

## Request body

- PaymentUpdate — Body to update a payment. For a non-staff company user, only `comments` may be edited; the request is rejected with `401` only when `comments` is absent. Any staff-only fields sent together with `comments` are silently ignored (the request still succeeds). The additional fields below are accepted only for Cardda staff (admin/superadmin).
  - `comments` string — Free-text comment. This is the ONLY field a non-staff company user is permitted to edit. A non-staff request that omits `comments` returns `401 Unauthorized`; extra keys sent alongside `comments` are dropped rather than rejected.

## Response `200`

The updated payment, returned as the bare record: the `amount` money object and
the `ppo_allocations` array (present on the list/detail endpoints) are NOT
included here.

- PaymentBareRecord — The bare payment / deposit ("abono") record returned by the update (`PATCH /v1/payments/:id`) endpoint. Unlike the list/detail projection (`Payment.yaml`), it does NOT include the serializer-computed `amount` money object nor the `ppo_allocations` array.
  - `id` string, uuid, required
  - `company_id` string, uuid, nullable
  - `user_id` string, nullable
  - `kind` string — Payment kind (e.g. received, sent, reversal variants).
  - `amount_cents` integer, nullable
  - `currency` string, nullable
  - `payment_type` string, nullable
  - `description` string, nullable
  - `comments` string — Free-text comment. The only field a non-staff company user may edit.
  - `comment` string, nullable
  - `reference_id` string, nullable
  - `external_id` string, nullable
  - `bank_id` string, nullable
  - `conciliated` boolean, nullable
  - `verified` boolean
  - `recipient_account` object, nullable
  - `sender_account` object, nullable
  - `transaction_date` string, date-time, nullable
  - `post_date` string, date-time, nullable
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401` — Unauthorized - missing/invalid token, or a non-staff user sent a body without the `comments` field.
- `404` — Payment not found (or outside the caller's company scope).

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardda/banking-api/revisions/ff1aeb3fda8b/schema)