POST /v1/public/checkout

Authentication

This endpoint is public. It takes no credential and no organisation — it is what our own marketing site and AI answer engines read.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/public/checkout \
  -H "Content-Type: application/json" \
  -d '{ "cart_token": <string>, "email": <string>, "billing": <PublicBilling> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Converts an anonymous cart into a real tenant: it creates the organization and the user at this point, captures the billing details, and places an immutable order. Availability is re-verified live against the registrar first, so a name taken while the customer was typing aborts the whole call (409) with nothing created. Tax is computed against billing.country (§2.8). It never takes a card, and what it does next depends entirely on the total. The response is {order_id, org_id, next} plus the order's own currency, subtotal_minor, tax_minor and total_minor: - "payment" — the order has something to pay and is left pending_payment. Taking payment is the authenticated step that follows, because a brand-new organization has no payment mandate on file. - "done" — the total is zero (a free trial, a zero-priced plan, a 100% discount), so the order is settled and provisioned inside this call: a zero Payment is recorded, the order becomes paid, and the fulfilment workflow starts. No gateway is contacted — a brand-new organization has none to resolve, and there is nothing to charge. Owner ruling 2026-08-09: a free trial takes no card and starts immediately. ⛔ Between that ruling and 2026-08-12 this endpoint answered "done" and performed none of it — the order stayed pending_payment with no payment, no fulfilment and no workflow, so the customer was told their trial had started and no site was ever built. Anything that keys off next should key off it alone; the order state now follows it. Idempotent on the cart. A double-submit — concurrent or an hour later — produces one organization, one user and one order; the repeat returns the same ids. There is no Idempotency-Key header to send: the cart token is the key. If the email already has an account the call is refused with 409 and nothing is created: the purchase must be completed signed in, so that an unauthenticated request can never attach an order to somebody else's tenant. The cart stays open. Cross-origin callers. Besides zinndigital.com, this route answers the browsers of the hosting sites' on-page free trial — zinnhosting.com, zinnhosting.co.uk and the zinndigital country sites (engine.api.trial_cors, list generated from the product-sites registry into engine/engine/api/trial_origins.json). Exact origins only, never credentials; the route's own budgets, Turnstile and trial guard apply unchanged (docs/749 §16).

Request body

Response

Errors this endpoint can return

404 · 409 · 422 · 429 · 503