API OverviewPayments

Collect CVV

View as Markdown
Start one isolated secure collection workflow for the Session. The Gateway never receives, stores, logs, or returns the collected card digits. Card collection accepts 12–19 digits and applies Luhn validation inside the trusted payment path; security-code collection accepts exactly three digits. A `202` response is only admission. The terminal result is delivered as a sanitized payment webhook. See [Payment lifecycle events](/api/payments#lifecycle-events) for complete payload schemas and examples.

Authentication

AuthorizationBearer
Application auth. Send `Authorization: Bearer <app_uuid>:<api_key>` using any active key in the app's collection. See [Authentication](https://voice-platform.docs.buildwithfern.com/api/authentication) for details.

Path parameters

uuidstringRequired

Session identifier.

Headers

Idempotency-KeystringOptionalformat: "^[a-zA-Z0-9._-]+$"<=128 characters
Optional key for safely retrying mutating requests. See [Idempotency](https://voice-platform.docs.buildwithfern.com/idempotency) for details.
Operation-IdstringOptionalformat: "uuid"

optional client-supplied lowercase RFC-4122 v4 UUID returned as operation_uuid; platform generates one when omitted; correlation metadata distinct from Idempotency-Key.

Request

This endpoint expects an object.
between_digits_timeout_msintegerRequired100-10000
Milliseconds to wait between digits.
first_digit_timeout_msintegerRequired1000-300000
Milliseconds to wait for the first digit.
terminatorslist of enumsRequired
Distinct DTMF terminators. An empty array collects to the fixed secure length or timeout.
Allowed values:
prompt_fileslist of stringsOptional

Optional HTTP/HTTPS WAV or MP3 prompts played before the secure collection window opens.

Response

Command accepted for async execution
operation_uuidstringformat: "uuid"
statusenum
already_endedtrueOptional

Optional. Set to true on idempotent terminal commands when the session was already in a terminal state at the time the request was received. Absent otherwise.

Errors

400
Bad Request Error
401
Unauthorized Error
404
Not Found Error
409
Conflict Error
413
Content Too Large Error
415
Unsupported Media Type Error
422
Unprocessable Entity Error
429
Too Many Requests Error
500
Internal Server Error
502
Bad Gateway Error
503
Service Unavailable Error