Skip to main content
POST
/
api
/
pay
/
{projectId}
/
transactions
/
authreverse
Reverse Authorization
curl --request POST \
  --url https://localhost:44371/api/pay/{projectId}/transactions/authreverse \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'
{
  "success": true,
  "code": 200,
  "errorMessage": null,
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
}

​
Description

Cancels a previous authorization and releases the held funds on the customer’s payment method. This operation is used when you no longer need to capture an authorized transaction. Unlike void operations which cancel unsettled transactions, authorization reversals specifically target the authorization hold itself.

​
Input

  • Path Parameter: projectId (guid, required) — Project identifier matching authenticated API key.
  • Body: model (TransactionAuthReverseCommandRequest, required) — Reversal request with transactionId and optional reason.

​
Output

Returns a TransactionAuthReverseCommandResponse indicating whether the authorization was successfully reversed and processor response details.

​
Example Request

POST /api/payment/projects/{projectId}/transactions/auth-reverse
Content-Type: application/json

{
  "transactionId": "7b8c9d0e-1234-5678-9abc-def012345678",
  "reason": "Customer cancelled order"
}

​
Example Response

{
  "success": true,
  "code": 200,
  "status": "Reversed"
}

​
Errors

  • 400 Bad Request — Transaction not in authorized state or already reversed.
  • 404 Not Found — Transaction not found.
  • 401 Unauthorized — Invalid API key.

​
Notes

  • Auth reverse only works on transactions in “Authorized” state that have not been captured.
  • Not all payment processors support explicit auth reversal.
  • For processors without auth reverse support, authorizations typically expire automatically after 7-30 days.

Authorizations

​
Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Path Parameters

​
projectId
string<guid>
required

The unique identifier of the project containing the transaction (must match authenticated API key).

Body

application/json

The authorization reversal request containing the transaction ID and optional reason for the reversal.

Base structure for command requests that modify data. Represents a request to reverse a previously authorized transaction. Sent when merchants void CyberSource or Payflow authorizations before settlement.

​
processorType
enum<string>

Processor that handled the original transaction. Determines whether CyberSource or Payflow specific logic is applied during the reversal.

Available options:
CreditCard,
Amazon,
ExpressCheckout
​
referenceTransactionId
string<guid>

Identifier of the transaction to reverse. Must reference an existing authorization that is eligible for voiding.

​
reason
string | null

Reason supplied for the reversal. Logged with the transaction history to explain why the authorization was voided.

​
transactionItems
object[] | null

Optional item details included when reversing CyberSource authorizations. Allows merchants to mirror the line items associated with the original charge.

Response

Always returned. Check the success property in the response body to determine if the reversal succeeded.

Standard response structure containing operation status and error information. Standard command response indicating the result of a data modification. Create response containing the identifier of the newly created entity. Represents the outcome of an authorization reversal request. Inherits base command metadata that indicates whether the reversal succeeded.

​
success
boolean

True if the operation completed successfully; false if an error occurred.

Example:

true

​
code
enum<string>

Result code indicating the outcome of the operation.

Available options:
Unknown,
Success,
BadRequest,
Unauthorized,
NotFound,
Error
Example:

200

​
errorMessage
string | null

Human-readable error message when an error occurs.

Example:

null

​
id
string<guid>

Unique identifier of the newly created entity.

Example:

"3fa85f64-5717-4562-b3fc-2c963f66afa6"