Authentication
Send an API key as a bearer token. The key must carry the billing.payment.manage permission; a key without it is refused with 403, not 404.
Where your organisation id goes
This endpoint takes org_id as a field in the JSON body.
Your organisation id is on the API keys screen in your dashboard, beside the key itself. It is the same id in every call you make.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/extras/{code}/purchase \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Buys the extra: it is charged wallet-first then gateway, and handed to durable fulfilment (an automated workflow, or a staff task). The price and fulfilment path are server-decided (docs/26 §3). Requires `billing.payment.manage`. Two different `422`s, and a client must tell them apart: `PAYMENT_METHOD_REQUIRED` means the organization holds no chargeable payment method, so nothing was presented to any gateway and nothing was refused — the remedy is to add a card and buy again. `UNPROCESSABLE_ENTITY` on this path is a genuine gateway decline. Reporting the first as the second tells a customer who has never entered a card that their bank refused them (`docs/491` §7).
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
code (path) | string | Yes | The extra's code (e.g. `db_maintenance`). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
org_id | Uuid | No | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
site_id | object | No | — |
domain_id | object | No | The domain a **domain-scoped** extra is bought for. Premium DNS (`premium_dns`) is the first: it is applied at the registrar, per zone, on a name held in our registrar account.… |
currency | CurrencyCode | null | No | The currency the customer was quoted in on the catalogue screen. Omit it and the engine uses the `X-Zinn-Currency` header. `Extra` rows are stored in the base currency only, so… |
pay_with | string<card, credit> | No | Where the money comes from. Owner ruling 2026-08-24: *"Credit pays, or card — customer picks"*. Only the AI products (`ai_webmaster`, `ai_update_guard` and any other row in thos… |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | Uuid | Yes | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
org_id | Uuid | Yes | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
extra_id | Uuid | Yes | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
site_id | object | No | — |
domain_id | object | No | — |
status | ExtraPurchaseStatus | Yes | An extra purchase's lifecycle state. |
category | string | Yes | — |
fulfilment_type | ExtraFulfilmentType | Yes | How an extra is delivered. |
interval | ExtraInterval | Yes | One-off charge or a recurring subscription. |
price | MoneyAmount | Yes | A money value — integer minor units + an ISO 4217 code (CLAUDE.md §2.8). |
recurrence | string<none, active, ended> | Yes | Whether the recurrence behind this purchase is still live. `none` = it never recurred (a one-off); `active` = a scheduled charge exists; `ended` = it recurred and no longer does… |
next_renewal_on | object | No | The next charge date, or `null`. Also `null` for a live charge that has no date scheduled yet, so read `recurrence` — not this field — to decide whether a purchase renews at all. |
sla_due_at | object | No | — |
completed_at | object | No | — |
failure_reason | string | No | — |
created_at | string | Yes | — |
updated_at | string | Yes | — |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429