Check the Status
Read a session or its payment from your server, and know which status to trust.
We recommend webhooks for real-time updates, but you can also read the result at any time from your server. This is useful:
- When a customer returns to your
success_urlorreturn_urland you need to confirm the final status before showing an order confirmation. - For reconciliation scripts that check pending orders.
- As a fallback if your webhook endpoint fails.
| You have | Call | You get |
|---|---|---|
The session id | Get a session | The session, its status and the transaction_status of the latest attempt. |
The payment_id | Get a payment | Result, amount, method, card brand and last four digits, decline reason. |
A direct_transaction_id | Look up a Direct API transaction | One specific payment attempt. |
For order fulfillment, base your logic on the transaction status (transaction_status), not
on the session status alone. The meaning of each value is in the
Reference.
Get a session
Returns the session with current values. Use the id you received when you created it.
Authorization
Authorization Your public API key, with the word Token and a space in front of it. Example: Token 6534bc0a7e1f4d2b9c8e3a5f7b1d2c4e6f8a9b0c — that whole value is the header. Sending the key alone returns 401 'Authentication credentials were not provided'. In this playground you may paste just the key; the prefix is added for you.
In: header
Path Parameters
The session id returned when the session was created.
Response Body
application/json
application/json
curl -X GET "https://example.com/checkout/v1/sessions/cs_97_41528_42434df6c3644b9610df7b64a1fa9925e3b9562b05972097"{
"id": "cs_97_41528_42434df6c3644b9610df7b64a1fa9925e3b9562b05972097",
"status": "completed",
"session_type": "payment",
"payment_id": 41528,
"payment_flow": "direct",
"direct_transaction_id": "190e4fd9-6f0a-4a57-9b1e-3c2f1c0d7a11",
"transaction_status": "Success",
"amount_total": 150,
"currency": "MXN",
"external_id": "ORD-001",
"paid_at": 1751483767348
}{
"code": "E004",
"message": "The request was invalid. Please check your input and try again.",
"metadata": {},
"name": "TNDR004",
"statusCode": 400
}Get a payment
Returns the details of the session's payment. It takes the numeric payment_id returned when
the session was created, and it works whether or not your account uses the Direct API. If the
customer has not tried to pay yet, the response has no transaction details.
Authorization
Authorization Your public API key, with the word Token and a space in front of it. Example: Token 6534bc0a7e1f4d2b9c8e3a5f7b1d2c4e6f8a9b0c — that whole value is the header. Sending the key alone returns 401 'Authentication credentials were not provided'. In this playground you may paste just the key; the prefix is added for you.
In: header
Path Parameters
The numeric payment_id of the session (digits only).
Response Body
application/json
application/json
application/json
curl -X GET "https://example.com/checkout/v1/payments/41530"{
"payment_id": 41530,
"transaction_status": "Declined",
"transaction_type": "PAYMENT",
"operation_date": "2025-07-02T14:50:05.010068-05:00",
"amount_total": 2,
"currency": "MXN",
"payment_method_name": "card",
"provider": "tonder",
"card": {
"brand": "",
"last_four_digits": "0085"
},
"decline": {
"code": "04",
"description": "Declined by 3-D Secure"
},
"external_id": "ORD-001",
"metadata": {},
"session": {
"id": "cs_97_41530_403e3eff24789695e8e44ac9eba6a0c70dcc91ab41931be8",
"status": "pending",
"session_type": "payment"
}
}{
"code": "E004",
"message": "The request was invalid. Please check your input and try again.",
"metadata": {},
"name": "TNDR004",
"statusCode": 400
}{
"code": "E003",
"message": "The requested resource was not found.",
"metadata": {},
"name": "TNDR003",
"statusCode": 404
}| HTTP status | Code | Meaning | What to do |
|---|---|---|---|
| 404 | E003 | No payment with this id, or the id is not a number (for example a direct_transaction_id). | Send the numeric payment_id. |
| 400 | E0014 | The session is an enrollment: there is no payment. | Use Get a session instead. |
Look up a Direct API transaction
If you hold a direct_transaction_id — from a session, an embedded event or your Web SDK
integration — read it with the Direct API transaction endpoint, using the same API key. Hosted
Checkout does not offer a separate lookup for this id.
curl 'https://stage.tonder.io/api/v1/transactions/190e4fd9-6f0a-4a57-9b1e-3c2f1c0d7a11/' \
-H 'Authorization: Token YOUR_TEST_API_KEY'curl 'https://app.tonder.io/api/v1/transactions/190e4fd9-6f0a-4a57-9b1e-3c2f1c0d7a11/' \
-H 'Authorization: Token YOUR_API_KEY'The response is the one documented in
Get transaction status. Remember that
direct_transaction_id is the customer's latest attempt and changes when they retry;
payment_id does not.