---
title: "Initiate checkout"
method: POST
path: "/agent/checkout"
tags: ["Checkout"]
---

# Initiate checkout

`POST /agent/checkout`

## Request

- Base URL: `https://api.trusteed.xyz/api/v1`
- URL: `https://api.trusteed.xyz/api/v1/agent/checkout`
- Auth: API key in header `X-Agent-Api-Key`

Initiate checkout for a cart (ACP by default). Requires the agent key's `checkout` scope; not available to SANDBOX-tier keys. Runs the KYAI risk gate before settlement (observe or enforce, per SPEC005_KYAI_GATE_MODE) and may return 202 user_action_required for a human-in-the-loop step-up. Requests detected as a different protocol (AP2, x402, UCP, ... via the `x-protocol` header or body shape) are routed through the Protocol Bridge instead, with a different response shape. payment_rail='x402' dispatches settlement over x402 and may return 402 or 207 (partial multi-store success).

## Request body

- InitiateCheckoutRequest
  - `cartId` string, uuid, required
  - `payment_rail` 'stripe' | 'x402'
  - `x402_payload` object: Required when payment_rail='x402'. Full x402 v2 PaymentPayload (X402PaymentPayloadSchema) — see the x402 protocol spec.
  - `x402_config` object: Required when payment_rail='x402'. The merchant's server-configured x402 wallet/facilitator overrides this when present; a mismatched merchant_wallet_address is rejected when SPEC005_X402_CONFIG_ENFORCED=true, otherwise observed and overridden.
    - `merchant_wallet_address` string, required
    - `network` string, required
    - `facilitator_url` string, uri, required
    - `asset_address` string
    - `facilitator_version` 'v1' | 'v2'

## Response `200`

Checkout initiated (ACP flow) or completed

## Other responses

- `202`: user_action_required — human confirmation needed
- `207`: Partial success across a multi-store x402 checkout
- `400`: Invalid cart ID or missing x402 fields
- `402`: Payment required (x402)
- `403`: Missing `checkout` scope, SANDBOX-tier key, KYAI policy block, or Shopify store on a non-native rail
- `404`: Cart not found (including cross-tenant ownership mismatch)

---

[API](https://skmtc.dev/trusteed/apis/trusteed-api.md) · [All operations](https://skmtc.dev/trusteed/apis/trusteed-api/llms.txt) · [OpenAPI document](https://skmtc.dev/trusteed/apis/trusteed-api/revisions/14ce607accce?raw)