> ## Documentation Index
> Fetch the complete documentation index at: https://docs.papp.sa/llms.txt
> Use this file to discover all available pages before exploring further.

# Begin checkout for a replacing order

> Starts a checkout session for a replacing (redeem + pay) order using the merchant's public key. This endpoint does **not** require the `x-api-key` header — the public key in the path authenticates the call.
When `phone_number` is provided but no matching customer exists, the returned `checkout_url` lands on an onboarding page where the customer can register before paying. The response shape is identical in both cases.




## OpenAPI

````yaml /openapi/points-api-v1.yaml post /v1/orders/checkout/{publicKey}
openapi: 3.0.3
info:
  title: Points API
  version: 1.0.0
  description: >
    OpenAPI definition for the `/api/v1` endpoints defined in
    `routes/api_v1.php`. This spec reflects the behaviour of the Laravel backend
    and is the source of truth for integrators.
  contact:
    name: Points API Support
    email: support@papp.sa
    url: https://docs.papp.sa
servers:
  - url: https://business.papp.sa/api
    description: Production server
  - url: https://sandbox.papp.sa/api
    description: Sandbox server
security:
  - ApiKeyAuth: []
tags:
  - name: Orders
    description: Operations for creating and managing orders
  - name: Webhooks
    description: CRUD operations for merchant webhooks
  - name: Integration
    description: External-platform toggle state (e.g. Matajer's "ربط بوينتس" switch)
paths:
  /v1/orders/checkout/{publicKey}:
    post:
      tags:
        - Orders
      summary: Begin checkout for a replacing order
      description: >
        Starts a checkout session for a replacing (redeem + pay) order using the
        merchant's public key. This endpoint does **not** require the
        `x-api-key` header — the public key in the path authenticates the call.

        When `phone_number` is provided but no matching customer exists, the
        returned `checkout_url` lands on an onboarding page where the customer
        can register before paying. The response shape is identical in both
        cases.
      operationId: checkoutOrder
      parameters:
        - name: publicKey
          in: path
          required: true
          schema:
            type: string
          description: Public key that identifies the merchant.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckoutRequest'
      responses:
        '200':
          description: Checkout URL generated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckoutResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '422':
          $ref: '#/components/responses/ValidationError'
      security: []
components:
  schemas:
    CheckoutRequest:
      type: object
      required:
        - total_price
        - order_number
      properties:
        phone_number:
          type: string
          nullable: true
          description: >
            Customer phone number. Accepted formats: `+966XXXXXXXXX`,
            `00966XXXXXXXXX`, `966XXXXXXXXX`, `0XXXXXXXXX`, or bare `5XXXXXXXX`.
            Normalised server-side to `5\d{8}`.
          example: '512345678'
        name:
          type: string
          maxLength: 255
          nullable: true
          description: Customer name.
          example: Ahmed Al-Saud
        total_price:
          type: number
          format: float
          minimum: 0
          description: Checkout amount (SAR).
          example: 150.75
        shipping_amount:
          type: number
          format: float
          minimum: 0
          nullable: true
          example: 15
        tax_amount:
          type: number
          format: float
          minimum: 0
          nullable: true
          example: 22.5
        discount_amount:
          type: number
          format: float
          minimum: 0
          nullable: true
          example: 10
        shipping_address:
          $ref: '#/components/schemas/ShippingAddress'
        products:
          type: array
          nullable: true
          minItems: 1
          description: >-
            Line items. Nullable — orders can be created without per-item
            detail.
          items:
            $ref: '#/components/schemas/ProductLine'
        metadata:
          type: object
          nullable: true
          additionalProperties: true
          description: Optional metadata that will be stored with the order.
          example:
            source: mobile_app
            notes: Deliver ASAP
        order_number:
          type: string
          description: |
            Merchant order reference. A leading `#` is stripped server-side.
          example: ORD-2024-0001
        callback_url:
          type: string
          format: uri
          nullable: true
          description: URL to redirect the customer after checkout completion.
          example: https://merchant.example.com/callback
    CheckoutResponse:
      allOf:
        - $ref: '#/components/schemas/ApiMetadata'
        - type: object
          required:
            - data
          properties:
            data:
              type: object
              required:
                - checkout_url
              properties:
                checkout_url:
                  type: string
                  format: uri
                  example: https://pay.papp.sa/session/abcd1234
    ShippingAddress:
      type: object
      nullable: true
      description: Optional shipping address. All fields are individually optional.
      properties:
        city:
          type: string
          maxLength: 100
          nullable: true
          example: Riyadh
        line1:
          type: string
          maxLength: 255
          nullable: true
          example: 1234 King Fahd Rd, Al Olaya
    ProductLine:
      type: object
      required:
        - product_name
        - product_price
        - quantity
      properties:
        product_name:
          type: string
          example: Cappuccino
        product_price:
          type: number
          format: float
          minimum: 0
          example: 18.5
        quantity:
          type: integer
          minimum: 1
          example: 2
    ApiMetadata:
      type: object
      required:
        - status
        - message
        - appended_data
      properties:
        status:
          type: boolean
          example: true
        message:
          type: string
          nullable: true
          example: ''
        appended_data:
          type: object
          additionalProperties: true
          example: {}
    ErrorResponse:
      type: object
      required:
        - status
        - message
        - appended_data
      properties:
        status:
          type: boolean
          example: false
        message:
          type: string
          example: Invalid or inactive API key
        appended_data:
          type: object
          additionalProperties: true
          example: {}
    ValidationErrorResponse:
      type: object
      required:
        - status
        - message
        - appended_data
      properties:
        status:
          type: boolean
          example: false
        message:
          type: string
          example: The given data was invalid.
        appended_data:
          type: object
          additionalProperties: true
          example: {}
        errors:
          type: object
          description: >
            Field-level validation errors. Keys are field names (dot-notation
            for nested fields, e.g. `products.0.product_price`). Values are
            arrays of error message strings.
          additionalProperties:
            type: array
            items:
              type: string
          example:
            total_price:
              - The total price field is required.
            products.0.quantity:
              - The quantity must be at least 1.
  responses:
    BadRequest:
      description: >
        The API key is missing, invalid, or inactive. Note: the Points API
        returns `400` (not `401`) for auth failures.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: >
        The authenticated merchant is not allowed to perform this action (e.g.
        merchant is unverified, or the feature is disabled on this account).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ValidationError:
      description: Request body failed validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationErrorResponse'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key

````