---
title: "Approve quote and create hosted checkout"
method: POST
path: "/api/checkout"
---

# Approve quote and create hosted checkout

`POST /api/checkout`

## Request

- Base URL: `https://postedly.com`
- URL: `https://postedly.com/api/checkout`
- Auth: HTTP bearer

Call only after the sender explicitly approves the exact final proof or item, recipient, total and terms. A verified sender email matching the connected owner is required. This REST endpoint normally records approval and creates/reuses the order. When the quote contains addressWarnings it instead returns a ReviewLink without an order or payment: the sender must accept the exact address risk on that scoped browser page. Caller-supplied risk flags never bypass this review. Agents should normally use MCP postedly_checkout instead: it returns a private browser review link where the user verifies their own receipt email and approves without changing the connected creator or the quoted postal sender. On an ambiguous result, read existing orders before deciding what to do; never blindly replay checkout or create a replacement quote/order.

## Request body

- object
  - `quoteId` string, uuid, required
  - `acceptedTerms` unknown, required
  - `confirmedDocument` unknown, required

## Response `200`

Approved order and hosted payment URL, or a private ReviewLink when address-risk approval is required. Neither confirms payment or sending.

- union
  - Checkout: An approved order and hosted Stripe payment URL. Receiving this response is not payment or fulfillment confirmation. REST POST /api/checkout normally records approval and creates/reuses an order, but quotes with addressWarnings return a ReviewLink until the human accepts the risk on the scoped browser review page.
    - `url` string, uri, required: Private hosted Stripe Checkout URL. Let the user enter payment details there, never in chat.
    - `orderId` string, uuid, required: Retain for GET /api/orders/{id} even if the browser closes or payment is interrupted.
  - ReviewLink: Returned by the MCP postedly_checkout tool and by REST checkout for quotes requiring address-risk review. Creates a private review link without recording approval, creating an order, charging or sending.
    - `url` string, uri, required: Secret capability URL. Share only with the intended human payer; do not log it or make it public. The browser verifies the receipt email and grants that account access only to this order.
    - `requiresBrowserApproval` unknown, required
    - `expiresAt` string, date-time, required
    - `instructions` string, required

## Other responses

- `400`: APPROVAL_REQUIRED: explicit document and terms confirmation missing
- `401`: Authentication required
- `403`: INSUFFICIENT_SCOPE or EMAIL_VERIFICATION_REQUIRED
- `404`: Quote not found or belongs to another owner
- `409`: QUOTE_EXPIRED, CHECKOUT_EXPIRED, CHECKOUT_CONFLICT, ORDER_CANCELLED or ORDER_ALREADY_PAID; use the existing order status or request a fresh quote only when appropriate
- `429`: Order or recipient limit exceeded
- `500`: Order or checkout outcome unconfirmed; inspect existing orders
- `502`: CHECKOUT_FAILED: hosted checkout could not be opened
- `503`: Service, secure checkout or mail capacity unavailable

---

[API](https://skmtc.dev/postedly/apis/postedly-send-api.md) · [All operations](https://skmtc.dev/postedly/apis/postedly-send-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postedly/apis/postedly-send-api/revisions/c7c71c05f64b?raw)