> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Complete a secure-payment session

> Finalizes a capturing secure-payment session after the downstream PSP tokenizes the card. Resumes SIPREC recording (enforcing the recording-consent gate), unmasks DTMF, and stores ONLY the masked summary (`card_last4` — exactly the last four PAN digits — plus `card_brand` and an opaque `psp_token_ref`). The full PAN must NEVER be sent to this endpoint.



## OpenAPI

````yaml /openapi.yaml post /api/v1/voice/calls/{id}/secure-payment/complete
openapi: 3.1.0
info:
  title: Devotel CPaaS API
  description: Orbit by Devotel — Communications Platform as a Service API
  version: 1.0.0
  contact:
    name: Devotel
    url: https://devotel.io
    email: support@devotel.io
  license:
    name: Proprietary
servers:
  - url: https://api.orbit.devotel.io
    description: Production
security:
  - Bearer: []
  - ApiKey: []
tags:
  - name: Messages
    description: >-
      Send and manage messages across all channels (SMS, WhatsApp, RCS, Email,
      Viber, etc.)
  - name: Fax
    description: >-
      List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers
      (sending flows through the Messaging API)
  - name: Agents
    description: AI agent creation, configuration, and execution
  - name: Voice
    description: Voice calls, IVR, conferencing, and SIP trunking
  - name: OnCall
    description: On-call rotations and escalation policy planning for incident alerting
  - name: Webhooks
    description: Webhook endpoint management and delivery logs
  - name: Numbers
    description: Phone number search, provisioning, and configuration
  - name: Brand Identity
    description: >-
      Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp,
      RCS, branded calling, number KYC)
  - name: Contacts
    description: Contact management, segmentation, and lifecycle tracking
  - name: Campaigns
    description: Marketing campaign orchestration and analytics
  - name: Flows
    description: Automation flow builder and execution engine
  - name: Templates
    description: Message template management and approval workflows
  - name: Settings
    description: Organization, channel, and user preference settings
  - name: Verify
    description: OTP generation and verification across channels
  - name: Push
    description: Push notification delivery via FCM and APNs
  - name: Integrations
    description: Third-party service connections and OAuth management
  - name: CDP
    description: >-
      Customer Data Platform — activation surface (CRM object sync, streaming
      destinations, ad-audience activation)
  - name: Files
    description: >-
      Server-to-server media upload, listing, retrieval, and deletion
      (signed-URL backed)
  - name: Commerce
    description: >-
      Omnichannel conversational-commerce — persistent cart + checkout state
      machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout,
      and AP2-style agent payment mandates.
  - name: Sync
    description: >-
      Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps,
      Lists, and ephemeral Streams, with change events relayed over the
      /api/v1/ws/sync WebSocket gateway
paths:
  /api/v1/voice/calls/{id}/secure-payment/complete:
    post:
      tags:
        - Voice
      summary: Complete a secure-payment session
      description: >-
        Finalizes a capturing secure-payment session after the downstream PSP
        tokenizes the card. Resumes SIPREC recording (enforcing the
        recording-consent gate), unmasks DTMF, and stores ONLY the masked
        summary (`card_last4` — exactly the last four PAN digits — plus
        `card_brand` and an opaque `psp_token_ref`). The full PAN must NEVER be
        sent to this endpoint.
      parameters:
        - schema:
            type: string
            minLength: 1
          in: path
          name: id
          required: true
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - session_id
              properties:
                session_id:
                  type: string
                  minLength: 1
                  description: >-
                    The capture session identifier returned by the start
                    operation.
                card_last4:
                  type: string
                  pattern: ^\d{4}$
                  description: >-
                    Exactly the last four digits of the PAN. The full card
                    number must never be sent.
                card_brand:
                  type: string
                  maxLength: 32
                  description: Card brand reported by the PSP (e.g. visa, mastercard).
                psp_token_ref:
                  type: string
                  maxLength: 256
                  description: Opaque PSP token reference for the captured card.
                consent_receipt_id:
                  type: string
                  maxLength: 256
                  description: >-
                    Recording-consent receipt id, required by two-party-consent
                    tenants to resume recording.
      responses:
        '200':
          description: Secure-payment session completed
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      call_id:
                        type: string
                      session_id:
                        type: string
                      status:
                        type: string
                        enum:
                          - captured
                      dtmf_masked:
                        type: boolean
                      recording_resumed:
                        type: boolean
                      card_last4:
                        type:
                          - 'null'
                          - string
                      card_brand:
                        type:
                          - 'null'
                          - string
                  meta:
                    type: object
                    properties:
                      request_id:
                        type: string
                      timestamp:
                        type: string
                        format: date-time
        '404':
          description: No secure-payment session with that id on this call
        '409':
          description: Session is not in the capturing state
        '422':
          description: Validation error (e.g. card_last4 is not exactly 4 digits)
components:
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Dashboard JWT token from Clerk
    ApiKey:
      type: apiKey
      name: X-API-Key
      in: header
      description: Server-to-server API key (dv_live_sk_*)

````