POST/apps/accounting/v1/payments

recordPayment

Human-authorized manual payment bookkeeping only; does not initiate money movement. Supports native input and the Core command envelope normalized by the module. Requires an Idempotency-Key; identical replay returns the stored result, changed input conflicts.

App
Accounting
Contract
Accounting API 0.32.0
Lifecycle
preview
Runtime
not-public
Operation ID
recordPayment
Canonical origin
https://accounting.runonvision.com

Purpose and use cases

POST /apps/accounting/v1/payments

The owning App is Vision Accounting. Accounting owns financial records, exact arithmetic, approvals, audit evidence, workspace grants, and ledger invariants.

Request

POST https://accounting.runonvision.com/apps/accounting/v1/payments

Authentication and authorization

Send a Vision-issued bearer token for the exact App audience. The token must include the accounting entitlement and satisfy the aws-… accounting workspace required binding.

  • Required scope: accounting:payments:write

Human roles are not declared in OpenAPI. Record-level and business permission checks remain the owning App's authority.

Headers

  • Authorization: Bearer <access-token> — required.
  • Accept: application/json — recommended where a JSON response is declared.
  • Content-Type: application/json — required for the documented request representation.

Undeclared tracing, idempotency, conditional-request, and version headers are not assumed on this page.

Path and query parameters

NameLocationTypeRulesDescription
Idempotency-Keyheaderstringrequired; minimum length 16; maximum length 160; pattern ^[A-Za-z0-9._:-]+$Not described in the contract.

Request body

Media type: application/json. The body is required.

FieldTypeRulesDescription
schemaVersion"vision-accounting-payment-record.v1"requiredNot described in the contract.
counterpartyReferencestringrequired; pattern ^FCP-[A-Z0-9]{12}$Not described in the contract.
directionreceivedoptional; default "received"Not described in the contract.
methodFamilycash | check | bank_transfer | zelle | ach | wire | card | otherrequiredNot described in the contract.
transactionCurrencystringoptional; pattern ^[A-Z]{3}$Not described in the contract.
transactionScaleintegeroptional; minimum 0; maximum 6Not described in the contract.
grossMinorUnitsintegerrequired; maximum 9007199254740991Not described in the contract.
occurredAtstring · date-timeoptional; pattern ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$Not described in the contract.
settledAtstring · date-time | nulloptionalNot described in the contract.
memostring | nulloptional; default nullNot described in the contract.
referencestring | nulloptional; default nullNot described in the contract.
applicationsarrayoptional; default []; maximum items 200Not described in the contract.
applyToInvoiceReferencestring | nulloptional; default nullNot described in the contract.
receiptEmailstring | nulloptional; default nullNot described in the contract.

Runnable examples

cURL
curl 'https://accounting.runonvision.com/apps/accounting/v1/payments' \
  --request POST \
  --header 'authorization: Bearer ${ACCESS_TOKEN}' \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --data '{
    "schemaVersion": "vision-accounting-payment-record.v1",
    "counterpartyReference": "<counterpartyReference>",
    "direction": "received",
    "methodFamily": "cash",
    "transactionCurrency": "<transactionCurrency>",
    "transactionScale": 0,
    "grossMinorUnits": 1,
    "occurredAt": "2026-08-21T18:00:00Z",
    "settledAt": "2026-08-21T18:00:00Z",
    "memo": null,
    "reference": null,
    "applications": [],
    "applyToInvoiceReference": null,
    "receiptEmail": null
  }'
JavaScript (server-side)
const response = await fetch('https://accounting.runonvision.com/apps/accounting/v1/payments', {
  method: 'POST',
  headers: {
    authorization: `Bearer ${ACCESS_TOKEN}`,
    accept: 'application/json',
    'content-type': 'application/json',
  },
  body: JSON.stringify({
  "schemaVersion": "vision-accounting-payment-record.v1",
  "counterpartyReference": "<counterpartyReference>",
  "direction": "received",
  "methodFamily": "cash",
  "transactionCurrency": "<transactionCurrency>",
  "transactionScale": 0,
  "grossMinorUnits": 1,
  "occurredAt": "2026-08-21T18:00:00Z",
  "settledAt": "2026-08-21T18:00:00Z",
  "memo": null,
  "reference": null,
  "applications": [],
  "applyToInvoiceReference": null,
  "receiptEmail": null
}),
}

if (!response.ok) throw new Error(`Vision API ${response.status}`)
const result = await response.json()
Python 3 standard library
import json
import urllib.parse
import urllib.request

request = urllib.request.Request(
    'https://accounting.runonvision.com/apps/accounting/v1/payments',
    data=json.dumps({"schemaVersion":"vision-accounting-payment-record.v1","counterpartyReference":"<counterpartyReference>","direction":"received","methodFamily":"cash","transactionCurrency":"<transactionCurrency>","transactionScale":0,"grossMinorUnits":1,"occurredAt":"2026-08-21T18:00:00Z","settledAt":"2026-08-21T18:00:00Z","memo":null,"reference":null,"applications":[],"applyToInvoiceReference":null,"receiptEmail":null}).encode(),
    headers={
    "Accept": "application/json",
    "Authorization": "Bearer <ACCESS_TOKEN>",
    "Content-Type": "application/json"
},
    method='POST',
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)

The current TypeScript reference client covers Platform token exchange and core reads. No native SDK helper is declared for this operation; use the HTTP contract directly and follow the SDK guidance.

Responses

StatusMeaningSchema
201Durable Accounting command resultobject
400Safe Accounting errorobject
401Safe Accounting errorobject
403Safe Accounting errorobject
404Safe Accounting errorobject
409Safe Accounting errorobject
422Safe Accounting errorobject
503Safe Accounting errorobject

Success response schema

FieldTypeRulesDescription
schemaVersion"vision-accounting-command-result.v1"requiredNot described in the contract.
operationstringrequiredNot described in the contract.
outcomesucceeded | pendingrequiredNot described in the contract.
commandReceiptReferencestringrequiredNot described in the contract.
subjectReferencestringrequiredNot described in the contract.
recordVersionintegerrequired; minimum 1Not described in the contract.
replayedbooleanrequiredNot described in the contract.
201 illustrative response
{
  "schemaVersion": "vision-accounting-command-result.v1",
  "operation": "<operation>",
  "outcome": "succeeded",
  "commandReceiptReference": "<commandReceiptReference>",
  "subjectReference": "<subjectReference>",
  "recordVersion": 1,
  "replayed": true
}

Errors and troubleshooting

Error bodies and codes are shown only where the approved contract declares them. Use status, the declared error schema, and any correlation identifier returned by the App; do not infer that two Apps share one envelope.

  • 400 — Safe Accounting error
  • 401 — Safe Accounting error
  • 403 — Safe Accounting error
  • 404 — Safe Accounting error
  • 409 — Safe Accounting error
  • 422 — Safe Accounting error
  • 503 — Safe Accounting error

Collection behavior

Pagination: not declared. Filtering/search: not declared. Sorting: not declared.

Cursor lifetime, cursor binding, stable ordering, maximum traversal, and unknown-filter behavior are not assumed unless stated by a parameter description or schema constraint above.

Operational behavior

  • Rate limit: No operation-specific limit or 429 response is declared.
  • Retry: Retry only when the documented error model or response headers authorize it. Timeout and backoff values are not declared by this operation.
  • Idempotency: No idempotency header or replay window is declared.
  • Concurrency: No ETag, If-Match, or optimistic-version header is declared.

Security and privacy

  • Keep client credentials and bearer tokens on trusted servers.
  • Send only to the exact approved HTTPS origin and audience.
  • Treat response data according to the owning App's classification and retention policy; the OpenAPI contract does not itself grant data access.
  • Do not log credentials, tokens, complete private payloads, or secrets.

Edge cases and known documentation gaps

  • One or more parameters have no field-level description.
  • The request body has no purpose or conditional-rule description.
  • Business roles, timeout, retry budget, rate value, idempotency window, and concurrency behavior are absent unless explicitly stated above.

Contract history and evidence