Create checkout

Outcome

Reconciles or creates the cart’s Pay subscription and returns payment-intent information.

Before you start

• Verify the intended environment, authenticated identity and explicitly authorized ownership context.
• Discover the published workflows:write permission and any required resource grant.
• Approve the actual effects before confirming the unchanged planned request. Fixture identifiers, recipients and provider responses authorize no live operation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_one.checkout.create --detail --json

Request

POST /api/cart/checkout

Inspect and test this action.

Input fields

Inspect nested fields.

Interpret the response

Inspect reconciled, subscriptionId, intentKind, status and price. An incomplete subscription or clientSecret is not a paid invoice, successful charge or provisioned entitlement.

Inspect the declared output schema and captured variants.

Worked examples

Actual exported One Worker with local Miniflare D1/KV. Authentication, application discovery, checkout, billing and remote widget providers are controlled synthetic responses; outbound access is sealed. No live provider outcome is established.

Save the reviewed input below as payload.json; substitute discovered identifiers and bind credential/resource context separately. CLI:

topolo actions validate app_topolo_one.checkout.create --data @payload.json --json
topolo actions plan app_topolo_one.checkout.create --data @payload.json --json
topolo actions call app_topolo_one.checkout.create --data @payload.json --confirm --detail --json

MCP planning and execution use the same reviewed input:

{
  "tool": "topolo_prepare_action",
  "arguments": {
    "actionId": "app_topolo_one.checkout.create",
    "input": {
      "items": [
        {
          "slug": "fixture-paid",
          "seats": 3
        }
      ],
      "billing": "monthly"
    }
  }
}

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_one.checkout.create",
    "input": {
      "items": [
        {
          "slug": "fixture-paid",
          "seats": 3
        }
      ],
      "billing": "monthly"
    },
    "confirm": true,
    "detail": true
  }
}

Successful response · HTTP 200

Input · payload.json:

{
  "items": [
    {
      "slug": "fixture-paid",
      "seats": 3
    }
  ],
  "billing": "monthly"
}

Captured response:

{
  "success": true,
  "reconciled": false,
  "subscriptionId": "sub_fixture",
  "clientSecret": "pi_fixture_secret_synthetic",
  "intentKind": "payment",
  "status": "incomplete",
  "price": {
    "billing": "monthly",
    "interval": "month",
    "coreAppCount": 0,
    "grandMonthly": 27,
    "chargedTotalCents": 3375,
    "lines": [
      {
        "slug": "fixture-paid",
        "tier": "non_core",
        "seats": 3,
        "perSeatMonthly": 9,
        "lineMonthly": 27
      }
    ]
  }
}

Inspect reconciled, subscriptionId, intentKind, status and price. An incomplete subscription or clientSecret is not a paid invoice, successful charge or provisioned entitlement.

Refused request · HTTP 403 · permission_denied

Input · payload.json:

{
  "items": [
    {
      "slug": "fixture-paid"
    }
  ]
}

Captured response:

{
  "success": false,
  "error": "Only an organization owner or admin can purchase apps"
}

Discover the required permission and resource grants; re-authentication alone does not grant access.

Refused request · HTTP 401 · auth_error

Input · payload.json:

{
  "items": [
    {
      "slug": "fixture-paid",
      "seats": 3
    }
  ],
  "billing": "monthly"
}

Captured response:

{
  "error": "Token validation failed"
}

Authenticate using the required credential type for this action; service-only actions require the registered Auth service identity.

Verify the result

• Inspect reconciled, subscriptionId, intentKind, status and price. An incomplete subscription or clientSecret is not a paid invoice, successful charge or provisioned entitlement.

Errors and recovery

• permission_denied (HTTP 403): Discover the required permission and resource grants; re-authentication alone does not grant access.
• auth_error (HTTP 401): Authenticate using the required credential type for this action; service-only actions require the registered Auth service identity.

These are observed local refusals; inspect the raw error body because one SDK code can represent several handler messages. Preserve the request id when available.

Recovery boundary

Discover the retained Pay subscription after an uncertain request before retrying. Continue payment or cancellation through the actual provider lifecycle; do not assume an unused intent expires automatically.

Evidence

Actual exported One Worker with local Miniflare D1/KV. Authentication, application discovery, checkout, billing and remote widget providers are controlled synthetic responses; outbound access is sealed. No live provider outcome is established.