Buyer
You describe the person paying with two separate fields:
buyer: the buyer's personal details; name, identity number, email, phone, IP address and more. It is passed to the payment institution and used in the risk assessment.customerId: the buyer's customer key in your own system. It lets you list payments by customer, store cards under the customer, and have the buyer recognised in wallet payments.
Endpoints that take the buyer
| Endpoint | buyer | customerId |
|---|---|---|
POST /payments/intents, POST /payments/marketplace/intents (Checkout Form) | Yes; every field optional | Yes |
POST /payments/direct/payment (Payment) | Yes; if you send it, the required fields must be filled | Yes |
POST /payments/marketplace/2d, /marketplace/3d (Marketplace) | Yes; if you send it, the required fields must be filled | Yes |
- Payment Links do not take
buyerorcustomerId. You choose which details to ask the buyer for withbuyerFieldsand pass what you already know withprefill; see Creating Links. - There is no separate email or phone field at the top level of the request. Send the buyer's email as
buyer.emailand their phone asbuyer.gsmNumber.
buyer fields
buyer is optional. If you send it, every field marked "Yes" below must be filled. On a Checkout Form intent (POST /payments/intents, POST /payments/marketplace/intents) this rule does not apply: every field is optional, and the fields you send are checked for type and length.
| Field | Type | Required | Example |
|---|---|---|---|
id | string | No | CUST-1 |
name | string | Yes | Ada |
surname | string | Yes | Yılmaz |
identityNumber | string | Yes | 11111111111 |
email | string (email) | Yes | [email protected] |
gsmNumber | string | Yes | +905000000000 |
city | string | Yes | Istanbul |
country | string | Yes | Turkey |
zipCode | string | Yes | 34732 |
ip | string | Yes | The buyer's IP address |
registrationDate | string | No | 2024-04-21 15:12:09 |
lastLoginDate | string | No | 2026-10-05 12:43:35 |
registrationAddress | string | No | Registered address |
Required-field rule
- The
buyerobject itself is optional on every endpoint. - On
POST /payments/direct/paymentand onPOST /payments/marketplace/2dand/marketplace/3d, if you sendbuyer, thenname,surname,identityNumber,email,gsmNumber,city,country,zipCodeandipmust be non-empty strings. An empty string counts as missing. - Wherever
emailis sent, it must be a valid email address. - On a Checkout Form intent (
POST /payments/intents,POST /payments/marketplace/intents) every field is optional. The fields you send must be strings no longer than:
| Field | Maximum characters |
|---|---|
id | 64 |
name, surname | 120 |
identityNumber | 32 |
email | 254 |
gsmNumber | 32 |
registrationDate, lastLoginDate | 40 |
registrationAddress | 500 |
city, country | 120 |
zipCode | 20 |
ip | 64 |
- If you send a field that is not defined (e.g.
buyer.phone), the request is rejected.
buyer.id versus customerId
Both look like a "customer ID", but they do different jobs and do not stand in for each other: sending one does not fill the other.
buyer.id | customerId | |
|---|---|---|
| Where | Inside the buyer object | At the top level of the request |
| What it does | Passed to the payment institution with the buyer details; used as the buyer's identity in the risk assessment | Ties the payment to your customer key: listing, card storage and wallet payments work with this key |
customerId is used in these places:
- Listing payments:
GET /payments?customerId=…returns only that customer's payments; see Listing Payments. - Stored cards: A card saved during a payment is stored under the customer key, and that key is
customerId. On the Checkout Form you can sendcardUserKeyto use a different key; if you do not,customerIdis used. You list stored cards with the same key viaGET /payments/cards?cardUserKey=…. If the payment has no customer key, the card is not stored and the payment still goes through. Details: Stored Cards. - Wallet payments: The buyer is identified by
customerId; see Pay with Wallet › Buyer identity.
Why send it
- Payment institution: The
buyerdetails are passed to the payment institution. - Risk assessment:
buyer.idandbuyer.emailare assessed as the buyer's identity.buyer.registrationDatedetermines whether the buyer is a new customer of yours. The buyer's country is read from the billing address, from the shipping address when there is no billing address, and frombuyer.countrywhen there is neither. - Method fields (Payment): In a
POST /payments/direct/paymentrequest, when you leave out a field of the method block, the buyer data named in that field'sprefilldefinition is used:buyer.gsmNumber,buyer.email,buyer.identityNumber,buyer.nameorbuyer.surname. For example, in mobile billingbuyer.gsmNumberis used whenmobileBilling.gsmNumberis omitted. See Listing Methods › Method fields.
Validation errors
An error inside buyer returns 400 VALIDATION_ERROR. details.errors[] first gives the buyer entry, then the dotted path of the failing field:
{
"status": "failure",
"code": "VALIDATION_ERROR",
"message": "Validation failed — check the submitted fields.",
"statusCode": 400,
"requestId": "4b0e6c1a-2f3d-4e5a-9b8c-7d6e5f4a3b2c",
"details": {
"errors": [
{ "field": "buyer", "errors": [] },
{ "field": "buyer.email", "errors": ["email must be an email"] }
]
}
}| Case | field |
|---|---|
| Required field missing or empty (Payment, marketplace 2D/3D) | The field's path: buyer.name, buyer.identityNumber, buyer.ip … |
| Invalid email | buyer.email |
| Too long (Checkout Form) | The field's path: buyer.identityNumber … |
| Field not defined | The field's path: buyer.phone; message property phone should not exist |
buyer is not an object | buyer; the reason is in that entry's own errors list |
- The
buyerentry always comes first; the reason for the failure is in the path entries that follow it. - Branch in your code on
codeandfield, not onmessage. Error envelope: Errors.
Next
- Order Details: endpoints and a sample request with all three
- Addresses: shipping and billing address
- Stored Cards: storing cards under a customer key