> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sapiom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Sapiom Pay is for platforms whose agent shops for many end users. Each end user is a buyer with their own Sapiom key and saved cards.
> Use the buyer's key for every call made on that buyer's behalf. Never use one buyer's key for another user, and never give the agent the platform key.
> Agents call the hosted MCP tools at https://api.sapiom.ai/v1/mcp. Backends call the REST API at https://api.sapiom.ai/v1. Both take the key in an x-api-key header.
> Never ask a buyer for a card number, expiry date or CVV in chat. Buyers enter card details only on Sapiom's hosted pages.
> Follow the nextAction in each transaction result. Action links are secrets for the intended buyer only.
> Use one idempotencyKey per transaction. After a timeout, retry with the same key. Never start a new transaction to escape an uncertain outcome.
> Report an order as placed only when order.outcome is confirmed. If it is unknown, stop and hand off to a person.

# Relay a card request

> Sends a card request that Browser Pay paused in the buyer's browser on to the payment provider. The request carries the transaction's placeholder card; the card provider replaces it with the real card, at most once per placeholder. The response is the payment provider's answer, or a typed refusal. Requires a [buyer key](/api-reference/overview#authentication).



## OpenAPI

````yaml /api-reference/openapi.json post /v1/transactions/{transactionId}/payment/relay
openapi: 3.0.0
info:
  title: Sapiom Pay API
  version: '1.0'
  description: >-
    Create buyers, save their cards and authorize transactions. Send your
    platform key or a buyer key in the `x-api-key` header.
servers:
  - url: https://api.sapiom.ai
    description: Production
security:
  - api-key: []
tags:
  - name: Buyers
    description: One buyer per end user. Called tenants in the API.
  - name: Cards
    description: Hosted card setup links and the buyer's saved cards.
  - name: Spending limits
    description: Limits on what each card can spend.
  - name: Merchants
    description: Check whether Sapiom can buy from a merchant.
  - name: Transactions
    description: Create a transaction and drive its UCP checkout.
  - name: Browser checkout
    description: Placeholder cards and the relay Browser Pay uses.
paths:
  /v1/transactions/{transactionId}/payment/relay:
    post:
      tags:
        - Browser checkout
      summary: Relay a card request
      description: >-
        Sends a card request that Browser Pay paused in the buyer's browser on
        to the payment provider. The request carries the transaction's
        placeholder card; the card provider replaces it with the real card, at
        most once per placeholder. The response is the payment provider's
        answer, or a typed refusal. Requires a [buyer
        key](/api-reference/overview#authentication).
      operationId: CardRelayController_relay
      parameters:
        - name: transactionId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RelayRequestDto'
      responses:
        '200':
          description: '`relayed`, `refused` with a reason, or `unknown`'
      security:
        - api-key: []
components:
  schemas:
    RelayRequestDto:
      type: object
      properties:
        injectionRef:
          type: string
          format: uuid
          description: The placeholder's `injectionRef`.
        profileId:
          type: string
          maxLength: 64
          example: shopify-card-vault
        pageOrigin:
          type: string
          maxLength: 200
          example: https://store.myshopify.com
          description: The top-level page's origin.
        request:
          $ref: '#/components/schemas/PausedRequestDto'
        idempotencyKey:
          type: string
          maxLength: 255
          description: Repeating a relay with the same key returns its first result.
      required:
        - injectionRef
        - profileId
        - pageOrigin
        - request
        - idempotencyKey
    PausedRequestDto:
      type: object
      properties:
        method:
          type: string
          maxLength: 16
          example: POST
        url:
          type: string
          maxLength: 2048
          example: https://checkout.pci.shopifyinc.com/sessions
        headers:
          type: object
          description: Only the profile's forwarded headers, names in lower case.
        body:
          type: string
          maxLength: 65536
          description: The paused body as the form wrote it, placeholder included.
      required:
        - method
        - url
        - headers
        - body
  securitySchemes:
    api-key:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your platform key for buyer management, or a buyer key for everything
        else.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.