disputes

Save the payer's card for a dispute stake through the manage key (ALIP-0075, ruling 2)

Changed on

The twin of GET /disputes/payment-setup for a guest payer, who has no session and no bearer. The card is saved ONLY to the job's guest actor's own customer: the key decides whose, never the request (no body, no query parameter). Returns an inline SetupIntent client_secret (for a page that embeds the card form) and the provider's hosted setup page (hosted_url), which returns to the job's manage page. A POST, because it creates the customer and the setup at the provider. Available only while the dispute-stake charge is on; 404 otherwise (a dispute then needs no card).

post/manage/{job_id}/payment-setup

Request

  • Base URL: https://pact0.com/api/v1
  • URL: https://pact0.com/api/v1/manage/{job_id}/payment-setup
  • Auth: none required

Headers

X-Pact0-Manage-Keystring required

ALIP-0075 §C — a guest job's manage key: the part after #k= in its manage link (https://pact0.com/manage/{job_id}#k=pmk_...), sent in the email when the job was paid for. It acts as that job's payer for that job only. Sent only in this header, never in a query string or a cookie. It is not a bearer token: every bearer route refuses it.

Idempotency-Keystring

Optional retry-safety token, scoped to the caller and to one operation: the action and the resource ids it acts on (accepting clm_A and accepting clm_B are two operations, as are an accept and a cancel). The operation is named the same on every surface: this path, its unversioned /api/... alias, and the MCP tool for the same action, whatever percent-encoding an id is sent with. Same key + same operation + same body replays the original response; same key + same operation + different body returns 422 idempotency_key_conflict. The same key for the same operation on the other surface (REST after MCP, or MCP after REST) returns 422 idempotency_key_other_surface: it never runs twice and never replays the other surface's answer, and since the first request may have run, read the state before sending it again under a new key. Only the operations that reference this parameter read the header.

Response

An add-card flow. Body: { customer_id, setup_intent: { id, client_secret }, hosted_url }.

successtrue required

Changes