Carts

Confirm a cart

Sends the order to be placed and answers placing, never placed: read GET /orders/{orderId} for the outcome. On a connected person's token, a live confirm needs the 6-digit code Layout texts the person only when they keep codes on, the total is over Layout's amount limit for codes (which can change), Layout's risk checks ask for one, or a code is already out for this cart; otherwise one call places it. A live build grant meets the same rules once the person has connected your application, since connecting is their agreement that it places orders for them; for a person who connected before that, the first order's code says so and agrees to it. When it is required the first call texts the person Layout's code, which names the total, the store and the card, and answers code_required (when a code texted for this cart in the last 10 minutes is still good, nothing new is texted and you ask the person for that one); you send the same request again with the code the person gives you. Layout texts at most four codes per cart. In sandbox the order is simulated and needs no code, except at test_place_code, whose code is 000000 and is never texted. placing means the confirm was accepted: follow the order, which can still end failed without reaching the restaurant.

post/carts/{cartId}/confirm

Request

  • Base URL: https://api.layout.link/v1
  • URL: https://api.layout.link/v1/carts/{cartId}/confirm
  • Auth: HTTP bearer

Path parameters

cartIdstring required

The crt_ id.

Headers

Layout-Version'2026-10-01'

The API version you code against. Optional; without it you get 2026-10-01, the current version. Layout answers with the version it used.

Idempotency-Keystring

Optional. Any 1 to 255 visible ASCII characters, unique per real intent. A retry with the same key and the same body gets the stored response for 24 hours, with Idempotent-Replayed: true, and is never run twice. The same key with a different body is 409 idempotency_conflict; while the first request is still running it is 409 in_progress with Retry-After. Only a success is stored: any error releases the key so it can be sent again. A 4xx ran nothing. A 5xx may have run, above all a confirm's 500, so read the resource before sending anything changed.

Request body

expectedTotalMinorinteger required

The cart's totalMinor, exactly as Layout returned it. The restaurant's total alone (fees.merchantTotalMinor) is refused when a fee applies.

idempotencyKeystring

Unique per real intent. A retry with the same key and body returns the same answer. Optional when the request carries an Idempotency-Key header, whose value is then used; when both are sent, this one names the cart or the confirm.

codestring

Response

Placing.

Example response

{
  "order": {
    "id": "ord_7c21e4b9a0d3"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.