Capture, refund and void existing transactions

Manage a transaction

If the order was retried, a capture, refund or void sent with an earlier attempt's ID acts on the order's latest attempt.

Capture Refund Void Credit

CAPTURE on a AUTHORIZE transaction

Collects funds from a previously authorized transaction. Supports partial or full capture up to the original authorized amount.

Request rules

Field	Description
`reference`	The original order reference.
`amount`	Less than or equal to the original transaction amount.
`currency`	Same as the original transaction.
`parent_transaction_id`	Optional. Runs the operation against this specific transaction.
`options`	Optional, for example `final_capture`.

cURLNode.js

POST /api/transactions/manage

curl -X POST https://api.qorepayments.com/api/transactions/manage \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "terminal_id": "TERM001",
    "reference": "ORDER-123456",
    "transaction_type": "CAPTURE",
    "amount": 4990,
    "currency": "EUR"
  }'

POST /api/transactions/manage

const res = await fetch('https://api.qorepayments.com/api/transactions/manage', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${accessToken}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    terminal_id: 'TERM001',
    reference: 'ORDER-123456', // original order reference
    transaction_type: 'CAPTURE',
    amount: 4990, // full capture
    currency: 'EUR',
  }),
});

const { status, approved } = await res.json();

REFUND on a PURCHASE transaction

Returns funds to the customer for a completed or captured transaction. Supports partial or full refund amounts.

Request rules

Field	Description
`reference`	The original order reference.
`amount`	Less than or equal to the original transaction amount.
`currency`	Same as the original transaction.
`parent_transaction_id`	Optional. Runs the operation against this specific transaction.
`options`	Optional, for example `final_capture`.

cURLNode.js

POST /api/transactions/manage

curl -X POST https://api.qorepayments.com/api/transactions/manage \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "terminal_id": "TERM001",
    "reference": "ORDER-123456",
    "transaction_type": "REFUND",
    "amount": 2000,
    "currency": "EUR"
  }'

POST /api/transactions/manage

const res = await fetch('https://api.qorepayments.com/api/transactions/manage', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${accessToken}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    terminal_id: 'TERM001',
    reference: 'ORDER-123456', // original order reference
    transaction_type: 'REFUND',
    amount: 2000, // partial refund
    currency: 'EUR',
  }),
});

const { status, approved } = await res.json();

VOID on a AUTHORIZE transaction

Cancels an authorized or pending transaction before capture, releasing the held funds back to the customer.

Request rules

Field	Description
`reference`	The original order reference.
`amount`	Less than or equal to the original transaction amount.
`currency`	Same as the original transaction.
`parent_transaction_id`	Optional. Runs the operation against this specific transaction.
`options`	Optional, for example `final_capture`.

cURLNode.js

POST /api/transactions/manage

curl -X POST https://api.qorepayments.com/api/transactions/manage \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "terminal_id": "TERM001",
    "reference": "ORDER-123456",
    "transaction_type": "VOID",
    "amount": 4990,
    "currency": "EUR"
  }'

POST /api/transactions/manage

const res = await fetch('https://api.qorepayments.com/api/transactions/manage', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${accessToken}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    terminal_id: 'TERM001',
    reference: 'ORDER-123456', // original order reference
    transaction_type: 'VOID',
    amount: 4990, // original amount
    currency: 'EUR',
  }),
});

const { status, approved } = await res.json();

CREDIT on a PURCHASE or CAPTURE transaction

Pays money out to the card of an approved payment. Unlike a refund, it is not capped by the payment amount, and several credits may follow one payment. Available only where the payment provider supports it and credits are turned on for your terminal and the payment's provider account (today: Ilixium). A payment can be credited within 120 days; within 90 days for Mastercard payments and for token payments whose card brand is not known.

The provider treats every credit request as a new payout, so every credit needs its own transaction_reference. Sending the same credit again (same transaction_reference, payment and amount) returns the first credit, whatever its status, and pays nothing more. The same transaction_reference with another payment or amount is refused with 422. A credit's outcome reaches you with the general transaction-svc:transaction:management:approved and transaction-svc:transaction:management:declined webhook events; there is no credit-specific event. A credit whose answer was lost stays PENDING until the provider's records settle it; do not send a new credit with a new transaction_reference meanwhile, it would be a second payout.

Request rules

Field	Description
`reference`	The original order reference.
`amount`	Any positive amount.
`currency`	Same as the original transaction.
`transaction_reference`	Required. Your unique id for this credit; a repeat with the same value, payment and amount returns the first credit, the same value with another payment or amount is refused with `422`.
`parent_transaction_id`	Optional. Runs the operation against this specific transaction.

cURLNode.js

POST /api/transactions/manage

curl -X POST https://api.qorepayments.com/api/transactions/manage \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "terminal_id": "TERM001",
    "reference": "ORDER-123456",
    "transaction_type": "CREDIT",
    "amount": 2000,
    "currency": "EUR",
    "transaction_reference": "CREDIT-7781"
  }'

POST /api/transactions/manage

const res = await fetch('https://api.qorepayments.com/api/transactions/manage', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${accessToken}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    terminal_id: 'TERM001',
    reference: 'ORDER-123456', // original order reference
    transaction_type: 'CREDIT',
    amount: 2000, // any amount
    currency: 'EUR',
    transaction_reference: 'CREDIT-7781', // unique per credit: a repeat returns the first one
  }),
});

const { status, approved } = await res.json();

Receive webhooks

Qore Payments sends an HTTP POST to your endpoint when a transaction is processed. Every request is signed with a JWT.

Register your endpoint

Add your HTTPS endpoint under Webhooks in the merchant portal, pick the events, and send a test event from the Test endpoint tab. See Configure webhooks in the portal.

Verify the signature

Hash the raw body with SHA-512 and compare it to SHA512 in the JWT data claim. Then verify the JWT with the merchant’s public key.

Respond quickly

Return a 2xx status, ideally within 2 seconds and never later than 15. Reject invalid requests with 401.

Handle retries

A failed delivery is retried 3 times with exponential backoff, and more often when your endpoint is slow (see Delivery and Retry Policy). Make processing idempotent.

Node.js

webhook.js · your server

// The merchant public key is Base64 DER with no PEM header: wrap it once.
const merchantPublicKeyPem = '-----BEGIN PUBLIC KEY-----\n'
  + merchantPublicKey.match(/.{1,64}/g).join('\n')
  + '\n-----END PUBLIC KEY-----\n';

app.post('/webhooks/payments', (req, res) => {
  const token = req.headers.authorization.split(' ')[1];
  const { data } = jwt.decode(token);

  const digest = crypto.createHash('sha512')
    .update(req.rawBody).digest('hex');
  if (digest !== data.SHA512) return res.sendStatus(401);

  // clockTolerance: accept up to 60 s of clock skew between the gateway and your server when checking exp.
  try { jwt.verify(token, merchantPublicKeyPem, { algorithms: ['RS256'], clockTolerance: 60 }); }
  catch { return res.sendStatus(401); }

  res.sendStatus(200);
  handleEvent(req.body); // idempotent
});

Transaction Manage API Documentation

Welcome to the Transaction Manage API, part of the Qore Payments payment platform. This API enables merchants and integrators to manage existing transactions by initiating follow-up actions such as captures, refunds, and voids based on original transaction references.

This is a general transaction management API and may support additional management operations in the future, allowing for expanded flexibility as integration needs evolve.

Use Cases

The API supports a variety of transaction management operations, including:

Partial or full capture of previously authorized transactions
Partial or full refunds of completed purchases or captured transactions
Void operations on authorized or pending transactions

Note: Availability of specific transaction types (e.g., capture, void, refund) depends on:

The underlying integration with the payment service provider (PSP)

The type of credentials issued by the third-party PSP to your merchant account

Supported Transaction Types

The gateway supports two categories of transaction types: management transaction types used to perform follow-up operations on existing transactions via this API, and initial transaction types used when creating a new transaction.

Management Transaction Types

These transaction types are submitted to /api/transactions/manage to perform follow-up operations on an existing transaction:

Transaction Type	Description
`CAPTURE`	Collects funds from a previously authorized (`AUTHORIZE`) transaction. Supports partial or full capture up to the original authorized amount.
`REFUND`	Returns funds to the customer for a completed or captured transaction. Supports partial or full refund amounts.
`VOID`	Cancels an authorized or pending transaction before capture, releasing the held funds back to the customer.
`CREDIT`	Pays money out to the card of an approved payment, not capped by the payment amount. Needs a unique `transaction_reference`. Only where the payment provider supports it and credits are turned on.

Note: Availability of specific management transaction types depends on the underlying integration with the payment service provider (PSP) and the credentials issued to your merchant account.

Initial Transaction Types

These transaction types are submitted at the point of authorization to create a new transaction:

Transaction Type	Endpoint	Description
`PURCHASE`	`/api/transactions/authorize`	Combined authorization and immediate capture in a single step. Funds are reserved and collected at once. The most common type for standard card payments.
`AUTHORIZE`	`/api/transactions/authorize`	Reserves (holds) funds on the customer's card without capturing them immediately. A separate `CAPTURE` management operation must follow to collect the funds. Use when the final charge amount may change (e.g. hotel reservations, car rentals).
`OCT`	`/api/transactions/authorize`	Original Credit Transaction — pushes funds directly to a cardholder's card. Used for payouts, disbursements, and marketplace seller payments.
`PAYOUT`	`/api/transactions/authorize`	Sends funds to a card recipient via a payout flow.
`PAYMENT`	`/api/transactions/payment`	Alternative payment methods such as Open Banking, UPI, wallets, bank transfer, or QR code. The `transaction_type` is fixed to `PAYMENT` automatically for this endpoint.