Bizum API Rest

bizum

Bizum API Rest is a fully transparent, backend-to-backend integration that processes payments without redirecting the customer to an external gateway. Getnet provides no hosted payment page, so you build the checkout interface your customer sees. The customer gets a push notification in the Bizum app and approves the transaction there. The Global API supports Bizum API Rest across four flows:

  • Single-step flow – authorize and capture the payment in one request using INSTANT_TRANSFER_REST.
  • Two-step flow – validate the customer's Bizum account using INSTANT_TRANSFER_PREAUTH_REST. Then capture the payment later (within 30 days), when you are ready to fulfill the order.
  • Recurring flow – charge the customer again without asking them to approve each payment. The customer approves only the first payment in the Bizum app.
  • Payout flow – send funds to a customer using only their Bizum-registered phone number.
Before you create a payment, you can run Bizum Check. This query tells you whether the customer has Bizum and supports Request to Pay (RTP). RTP is the push notification flow that Bizum API Rest uses. Bizum Check also validates recurring identifiers and returns the customer's Strong Customer Authentication (SCA) exemptions. It works for any seller with Bizum enabled. See Bizum Check.
information icon
Important: Purchase flows are asynchronous, so the first API response returns WAITING. This is expected, not an error: the status changes to AUTHORIZED only after the customer approves in the Bizum app.
Subsequent recurring payments are the exception and return APPROVED directly. To receive status updates, register webhook events through the Webhooks API. Alternatively, poll the Get Transaction endpoint to detect the change.

Available features

Use the matrix below to confirm the scenarios currently supported for Bizum API Rest.

Payment flowSupported countriesPurchasesRefundsPartial refundsMultiple refundsPre-authorizationsRecurringPayout
RESTSpain✅✅✅✅✅✅✅

Shared characteristics

The table below summarizes the shared behavior and requirements across all Bizum API Rest flows.

CapabilityDetails
Integration typeTransparent, no customer redirect required
Customer approvalCustomer receives a push notification in the Bizum app and approves from there (purchase flows)
Initial statusWAITING for purchase flows until the customer approves in the app. Subsequent recurring payments return APPROVED directly
Post-approval statusTransitions to AUTHORIZED after the customer approves in the app (purchase flows only)
Unlike the Redirect flow, Bizum API Rest responses do not include _links, merchant_data, signature, or signature_version in additional_data. There is no HTML form to build and no gateway URL to redirect the customer to.

Requirements

Before you integrate Bizum API Rest:

  • Generate an access token through the Authentication endpoint. Payment requests and Bizum Check use the same credentials and token.
  • Collect the customer's Bizum-registered phone number before you start the payment or run Bizum Check.
  • Register webhook events through the Webhooks API to receive asynchronous status updates for purchase flows.
  • Review the market requirements before going live: Currency codes, Document types, and Local taxes and regulations.
Bizum API Rest is only available in Spain (EUR). Contact your Account Manager to enable this payment method for your seller account. Recurring payments need a separate activation, so ask for it too if you plan to use the recurring flow. Bizum Check needs no extra activation.

Bizum transactions are capped at €15,000. The customer's bank can enforce a lower limit, so the bank may still refuse a transaction below €15,000.

Bizum Check (pre-payment query)

Bizum Check is a REST query that tells you which Bizum payment options a customer has before you create the payment. You send the customer's phone number, and Getnet asks Bizum for that customer's capabilities. Use the result to pick the right payment flow and avoid payment attempts that can't succeed.

Bizum Check works for any seller with Bizum enabled. It uses the same credentials as your payment requests and needs no extra activation. It supports three queries:

  • RTP eligibility – check whether the customer has Bizum and whether their account supports RTP.
  • Recurring identifier validation – check whether a cof_transaction_id from an initial recurring payment is still valid. See Validate a recurring identifier.
  • SCA exemptions query – get the SCA exemptions that the customer's account supports.
information icon
Important: Bizum Check is not an authorization. It creates no payment, charge, or settlement, and it doesn't appear in your reports. A positive result tells you which flow to use. It doesn't guarantee payment approval.

How Bizum Check works

The table below summarizes the behavior shared by all Bizum Check queries.

CapabilityDetails
AvailabilityAny seller with Bizum enabled. No extra activation
Integration typeBackend-to-backend REST query. No customer interaction
Customer keyThe customer's phone number identifies the Bizum account
Financial impactNone. Bizum Check creates no payment, charge, or settlement
ResultSynchronous. The response carries the result of the check
When to run itAfter the customer selects Bizum and before you create the payment

Bizum Check fits between the customer's choice of Bizum and the payment request:

  1. The customer selects Bizum at checkout and enters their phone number.
  2. You send a Bizum Check with the customer's phone number.
  3. You read the result and pick a flow: Bizum API Rest, Bizum Redirect, or another payment method.
  4. You create the payment in the flow you picked.
  5. Getnet notifies you of the payment result.

You can also run a check outside checkout. For example, validate a recurring identifier before a subsequent payment. Another use is to re-check a stored phone number and see whether it still supports RTP.

Bizum Check request fields

All Bizum Check queries use the same endpoint and body structure. Add the conditional fields to run the recurring identifier validation or the SCA exemptions query.

POST /dpm/security-gwproxy/v1/payment/check
The body differs from a payment request. order_id goes inside data.payment, and the customer object sits directly under data. The phone number also takes the country prefix, and the + sign is optional.
FieldTypeRequiredDescription
idempotency_keyString (UUID)YesUnique identifier that stops Getnet from processing the request twice. Use UUID v4 format and generate a new value for every check
data.payment.payment_methodStringYesBizum payment method. Accepted values: INSTANT_TRANSFER, INSTANT_TRANSFER_PREAUTH, INSTANT_TRANSFER_REST, INSTANT_TRANSFER_PREAUTH_REST, PAYOUT
data.payment.brandStringYesMust be BIZUM
data.payment.order_idStringYesOrder identifier. Required even though the check creates no transaction. Must be between 4 and 12 alphanumeric characters. You can repeat the same value
data.customer.phone_numberStringYesCustomer's phone number with the country prefix (e.g., +34700000000). Must be between 5 and 15 digits. The + sign is optional
data.payment.cof_transaction_idStringRecurring identifier validation onlyThe cof_transaction_id from the initial recurring payment's record. Maximum 15 alphanumeric characters
data.payment.request_sca_exemptionsBooleanSCA exemptions query onlySend true to get the SCA exemptions the customer's account supports

Bizum Check response fields

All Bizum Check queries return the same response structure. The response leaves out fields with no value.

FieldTypeDescription
idempotency_keyStringThe idempotency_key you sent
order_idStringThe order_id you sent
brandStringAlways BIZUM
statusStringOK when the customer has Bizum and RTP. KO otherwise
messageStringDescribes the result. Read it with status to tell the results apart. See Pick the payment flow
cof_transaction_statusStringOK when the recurring identifier is valid. KO when it is no longer valid. Returned only when you send cof_transaction_id
sca_exemptionsStringComma-separated list of the SCA exemptions the customer's account supports. Returned only when you send request_sca_exemptions

Send the RTP check

Run this query at checkout. It shows whether you can charge the customer with Bizum API Rest, Bizum Redirect, or neither. Call the Bizum Check endpoint with the required fields only.

bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "5f1c9a2e-7b34-4d8e-9a61-2c0e8b7d4f13", "data": { "payment": { "payment_method": "INSTANT_TRANSFER", "brand": "BIZUM", "order_id": "CHK7A2F9K1Q" }, "customer": { "phone_number": "+34700000000" } } }'

For a customer with Bizum and RTP, the API returns the following response:

json
{ "idempotency_key": "5f1c9a2e-7b34-4d8e-9a61-2c0e8b7d4f13", "order_id": "CHK7A2F9K1Q", "brand": "BIZUM", "status": "OK", "message": "Operation completed successfully" }

Pick the payment flow

Use status and message to decide how to charge the customer. Both negative results return KO, so read message to tell them apart. OK is the only result that confirms RTP.
statusmessageMeaningNext action
OKOperation completed successfullyThe customer has Bizum and RTPCreate the payment with a Bizum API Rest flow on this page
KOOperation completed successfullyThe customer has Bizum, but not RTPCreate the payment with Bizum Redirect
KOUser not found (does not have Bizum)The phone number has no Bizum accountOffer another payment method

Validate a recurring identifier

Use this query to confirm that a stored cof_transaction_id is still valid before you create a subsequent recurring payment. An identifier stops being valid when it is revoked, for example when the customer cancels the recurrence.
Add data.payment.cof_transaction_id to the request with the identifier you stored. To get the identifier, see Step 3 of the Recurring flow.
bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "b8e04d71-3a95-4c2f-8e6d-91f7a0c5b2e8", "data": { "payment": { "payment_method": "INSTANT_TRANSFER", "brand": "BIZUM", "order_id": "CHK3M8R2T5W", "cof_transaction_id": "176758480922815" }, "customer": { "phone_number": "+34700000000" } } }'
The response adds the cof_transaction_status field:
json
{ "idempotency_key": "b8e04d71-3a95-4c2f-8e6d-91f7a0c5b2e8", "order_id": "CHK3M8R2T5W", "brand": "BIZUM", "status": "OK", "message": "Operation completed successfully", "cof_transaction_status": "OK" }
The table below describes each cof_transaction_status value.
cof_transaction_statusMeaningNext action
OKThe recurring identifier is validCreate the subsequent payment with this identifier
KOThe identifier was revokedCreate a new initial recurring payment to get a new identifier. See Recurring flow

Query SCA exemptions

Use this query to find out which SCA exemptions the customer's account supports. Add data.payment.request_sca_exemptions to the request and set it to true.
bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "e3a91c56-0d4b-4f7e-a2c8-6b5d9f1e7a04", "data": { "payment": { "payment_method": "INSTANT_TRANSFER", "brand": "BIZUM", "order_id": "CHK5H1V7J3D", "request_sca_exemptions": true }, "customer": { "phone_number": "+34700000000" } } }'
The response adds the sca_exemptions field:
json
{ "idempotency_key": "e3a91c56-0d4b-4f7e-a2c8-6b5d9f1e7a04", "order_id": "CHK5H1V7J3D", "brand": "BIZUM", "status": "OK", "message": "Operation completed successfully", "sca_exemptions": "MIT,LWV,TRA" }
The sca_exemptions field can include the following values:
ValueExemption
MITMerchant-initiated transaction, such as a subsequent recurring payment
LWVLow-value payment, under €30
TRATransaction risk analysis
You can combine the recurring identifier validation and the SCA exemptions query in one request. Send both cof_transaction_id and request_sca_exemptions, and the response returns both fields.

Handle Bizum Check errors

If the request fails, the API returns an HTTP error with an error code. Follow the next action in the table below, then send the request again with a new idempotency_key.
HTTP statusError codeCauseNext action
400INVALID_REQUESTA required field is missing. The message names the field (e.g., phone_number is required for Bizum RTP check)Add the missing field
400GENERIC-400payment_method is not an accepted valueSend one of the values listed in Bizum Check request fields
400, 408, 502PAYMENTS-999Bizum returned an error or didn't respond in time. The description reads Instant payment error.Check the request values. For 408 or 502, retry the check

For the full list of error codes, see the Errors reference.

Bizum Check best practices

Follow these recommendations when you implement Bizum Check:

  • Run the check after the customer selects Bizum and before you create the payment.
  • Read both status and message. The two negative results share the KO status.
  • Validate a stored cof_transaction_id before each subsequent recurring payment.
  • Use a new idempotency_key for every check.
  • Don't treat an OK result as a payment approval. Always confirm the payment result through webhooks or the Get Transaction endpoint.

Request structure

All Bizum API Rest purchase requests share the same top-level body structure and the same endpoint. The table below documents the common fields. Each flow section describes its flow-specific fields.

FieldTypeRequiredDescription
idempotency_keyString (UUID)YesUnique identifier that stops Getnet from processing the request twice. Use UUID v4 format
request_idString (UUID)YesUnique identifier for tracking the request across systems
order_idStringYesUnique identifier for the purchase, used for reconciliation. Must be between 4 and 12 alphanumeric characters
data.amountIntegerYesTransaction amount in cents. For example, 400 represents €4.00. Maximum 1500000 (€15,000)
data.currencyStringYesISO 4217 currency code. Must be EUR
data.payment.payment_idStringYesMerchant-defined payment identifier. Must be a maximum of 255 alphanumeric characters
data.payment.payment_methodStringYesFlow-specific value. See each section below
data.payment.brandStringYesMust be BIZUM
data.payment.soft_descriptorStringNoOptional transaction description or preferred reference ID used in the reconciliation file. Maximum 22 characters. Getnet removes special characters
data.additional_data.customer.emailStringNoCustomer's email address
data.additional_data.customer.document_numberStringNoCustomer's identification document number
data.additional_data.customer.document_typeStringNoDocument type (e.g., dni). See Document types
data.additional_data.customer.nameStringNoCustomer's full name
data.additional_data.customer.phone_numberStringYesCustomer's Bizum-registered phone number without the + sign (e.g., 34700000000). Not needed on subsequent recurring payments
data.additional_data.customer.billing_addressObjectNoCustomer's billing address. See Billing address fields

Billing address fields

The billing_address object accepts the following fields.
FieldTypeDescription
streetStringStreet name
numberStringBuilding number
complementStringAdditional address details (e.g., Suite 1)
districtStringNeighborhood or district
cityStringCity name
stateStringState or province code
countryStringISO 3166-1 alpha-2 country code (e.g., ES)
postal_codeStringPostal or ZIP code

Single-step flow (immediate capture)

Use this flow when you can fulfill the order immediately. A single request authorizes and captures the payment. The customer receives a push notification in the Bizum app to approve the transaction.

1. Create the payment request

To create the payment, call the Create – Authorize endpoint and set payment_method to INSTANT_TRANSFER_REST.
bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "ccb0a152-3733-4df4-bcfa-9c2fe49eb991", "request_id": "e80f8efd-75ac-4889-a72c-4840f01cc96a", "order_id": "ORD10187385", "data": { "amount": 400, "currency": "EUR", "payment": { "payment_id": "7b78ebc8-8f52-48a5-8e31-22e0c22ce390", "payment_method": "INSTANT_TRANSFER_REST", "brand": "BIZUM", "soft_descriptor": "BIZUM STORE" }, "additional_data": { "customer": { "email": "customer@example.com", "document_number": "50506468", "document_type": "dni", "name": "Jose da Silva", "phone_number": "34700000000", "billing_address": { "street": "Calle Mayor", "number": "10", "complement": "2A", "district": "Centro", "city": "Madrid", "state": "MD", "country": "ES", "postal_code": "28001" } } } } }'
The API immediately returns a WAITING status. This is the expected response. The transaction completes only after the customer approves it in the Bizum app.
json
{ "idempotency_key": "ccb0a152-3733-4df4-bcfa-9c2fe49eb991", "seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e", "payment_id": "7b78ebc8-8f52-48a5-8e31-22e0c22ce390", "order_id": "ORD10187385", "amount": "400", "currency": "EUR", "status": "WAITING", "received_at": "2025-11-03T14:18:59.991Z", "reason_code": "00", "reason_message": "Waiting payment flow." }

2. Handle the asynchronous status

After you create the request, the customer receives a push notification in the Bizum app. Once they approve the transaction, Getnet sends a status update through the Webhooks API. The status transitions from WAITING to AUTHORIZED, then immediately to CAPTURED for single-step payments.

3. Verify the status

To verify the final status, poll the Get Transaction endpoint as a fallback and check for the CAPTURED status. Prefer webhooks over polling for production implementations.

Two-step flow (validation + capture)

Choose this flow when you need to validate the customer's Bizum account first and capture the payment after fulfillment. This flow validates the account in one step and lets you capture within 30 days.

information icon
Important: An authorization does not "hold" funds in Bizum. If the customer's balance drops before you capture the payment, the transaction fails due to insufficient funds.

1. Validate the payment

To validate the payment, call the Create – Authorize endpoint and set payment_method to INSTANT_TRANSFER_PREAUTH_REST.
bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "3ac6f22d-5689-470c-bb98-47f91a6ee5d6", "request_id": "3f09943b-7aca-4e37-abb4-ec8d846a8ca1", "order_id": "ORD10187386", "data": { "amount": 400, "currency": "EUR", "payment": { "payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336", "payment_method": "INSTANT_TRANSFER_PREAUTH_REST", "brand": "BIZUM", "soft_descriptor": "BIZUM STORE" }, "additional_data": { "customer": { "email": "customer@example.com", "document_number": "50506468", "document_type": "dni", "name": "Jose da Silva", "phone_number": "34700000000", "billing_address": { "street": "Calle Mayor", "number": "10", "complement": "2A", "district": "Centro", "city": "Madrid", "state": "MD", "country": "ES", "postal_code": "28001" } } } } }'
The API returns a WAITING status immediately. After the customer approves in the Bizum app, the status changes to AUTHORIZED. Getnet sends the update through the Webhooks API.
json
{ "idempotency_key": "3ac6f22d-5689-470c-bb98-47f91a6ee5d6", "seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e", "payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336", "order_id": "ORD10187386", "amount": "400", "currency": "EUR", "status": "WAITING", "received_at": "2025-11-03T14:18:59.991Z", "reason_code": "00", "reason_message": "Waiting payment flow." }
Once the customer approves in the Bizum app, the Webhooks API delivers an update with "status": "AUTHORIZED". Use the same payment_id to call the Capture endpoint.

2. Capture the validated payment

To complete the sale, call the Capture endpoint. You can capture the payment within 30 days of validation.

bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments/capture \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "11c7f8ee-51a6-470d-bb76-ef762b62bfb1", "payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336", "payment_method": "INSTANT_TRANSFER_PREAUTH_REST", "amount": 400 }'

A successful capture returns the following response:

json
{ "seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e", "payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336", "idempotency_key": "11c7f8ee-51a6-470d-bb76-ef762b62bfb1", "order_id": "ORD10187386", "amount": 400, "currency": "EUR", "status": "CAPTURED", "reason_code": "00", "reason_message": "Captured successfully", "captured_at": "2025-11-03T15:20:30.456Z" }

3. Confirm settlement

Check the transaction status or rely on webhook events to confirm that the payment has transitioned from AUTHORIZED to CAPTURED.

Recurring flow

Use this flow to charge a customer again without asking them to approve each payment in the Bizum app. The customer approves only the first payment. You then send its recurring transaction identifier with every later payment.

The initial payment returns WAITING until the customer approves it. The recurring transaction identifier is available only after the status changes to AUTHORIZED.

A recurring sequence starts with an initial payment that the customer approves. You then create subsequent payments on your own schedule:

  1. The customer selects Bizum at checkout.
  2. You create the initial payment. Getnet sends a push notification to the customer's Bizum app.
  3. The customer approves the payment and the recurrence in the app.
  4. Getnet notifies you of the result.
  5. You query the payment records to get the recurring transaction identifier, cof_transaction_id.
  6. Optionally, you validate the identifier with Bizum Check before a subsequent payment. See Validate a recurring identifier.
  7. You create each subsequent payment with that identifier. Getnet charges the customer with no action from them.
The cof_transaction_id does not expire. You can reuse it for as many subsequent payments as you need. Each payment must have the same amount as the initial payment.

Recurring request fields

Recurring payments use the common request structure, with the data.payment values below.
FieldTypeRequiredDescription
data.payment.payment_methodStringYesMust be INSTANT_TRANSFER_REST
data.payment.brandStringYesMust be BIZUM
data.payment.transaction_typeStringYesMust be FULL
data.payment.credentials_on_file_typeStringYesUse RECURRING for the initial payment and RECURRING_PAYMENT for each subsequent payment
data.payment.transaction_idStringSubsequent payments onlyThe cof_transaction_id value from the initial payment's record. Maximum 15 characters. See Step 3
Recurring payments always follow the single-step flow, because the customer must pay the initial payment in full. If you send INSTANT_TRANSFER_PREAUTH_REST, Getnet processes it as INSTANT_TRANSFER_REST.

1. Create the initial payment

Call the Create – Authorize endpoint with credentials_on_file_type set to RECURRING. Include the customer's phone number. Do not send transaction_id on this request.
Generate a new UUID v4 for idempotency_key, request_id, and payment_id on every request.
bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "63c7f8ee-51a6-470d-bb76-ef762b62bfb9", "request_id": "1d2b7e4a-9c3f-4a61-8e05-7b9f2c6d0a13", "order_id": "ORD20250001A", "data": { "amount": 100, "currency": "EUR", "payment": { "payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8", "payment_method": "INSTANT_TRANSFER_REST", "brand": "BIZUM", "transaction_type": "FULL", "credentials_on_file_type": "RECURRING" }, "additional_data": { "customer": { "phone_number": "34700000000" } } } }'
The API returns a WAITING status. The customer now receives a push notification in the Bizum app.
json
{ "idempotency_key": "63c7f8ee-51a6-470d-bb76-ef762b62bfb9", "seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e", "payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8", "order_id": "ORD20250001A", "amount": "100", "currency": "EUR", "status": "WAITING", "received_at": "2025-11-03T14:18:59.991Z", "reason_code": "00", "reason_message": "Waiting payment flow." }
You need the payment_id to query the payment records in Step 3. Save it from this response, or get it later from the webhook notification for this payment.

2. Confirm the initial payment

The customer approves the payment in the Bizum app. This approval also confirms their consent to the recurrence. The status then changes from WAITING to AUTHORIZED, and Getnet sends the update through the webhook events you registered.

The initial payment uses the same webhook events and statuses as a single-step payment. See Webhooks and Status Reference.

If you do not receive a webhook, poll the Get Transaction endpoint as a fallback.

3. Get the recurring transaction identifier

The initial payment response does not include cof_transaction_id. After the payment reaches AUTHORIZED, Getnet adds it to the payment record. You get it in two calls.
First, call the Get Transaction endpoint with the payment_id from Step 1.
bash
curl --request GET \ --url https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8 \ --header 'Authorization: Bearer <your-token>'
The response includes a records array. The Bizum payment record has rel set to APM, and its href field holds the URL of the full record.
json
{ "payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8", "order_id": "ORD20250001A", "status": "AUTHORIZED", "payment": { "payment_method": "INSTANT_TRANSFER_REST", "amount": 100, "currency": "EUR", "transaction_type": "FULL", "soft_descriptor": "7b2e9c4f1a6d8e3b5c0f2a", "brand": "BIZUM", "credentials_on_file_type": "RECURRING", "save_card_data": false }, "records": [ { "rel": "APM", "idempotency_key": "4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47", "country": "ES", "tenant": "santander", "registered_at": "2025-11-03T14:20:12.573Z", "href": "https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8/4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47" } ] }
Then, send a GET request to the record's href. This URL calls the Get by Idempotent Key endpoint, so it needs the same Authorization header.
bash
curl --request GET \ --url https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8/4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47 \ --header 'Authorization: Bearer <your-token>'
Read the cof_transaction_id value from this response. Store it with the customer's details. You send it on every subsequent payment.

Before a subsequent payment, you can confirm that the identifier is still valid with Bizum Check. See Validate a recurring identifier.

4. Create subsequent payments

For each later charge, call the Create – Authorize endpoint with these values:

  • credentials_on_file_type set to RECURRING_PAYMENT
  • transaction_id set to the cof_transaction_id you stored in Step 3
  • amount equal to the initial payment amount

You don't need to send the customer's phone number on subsequent payments. The request below shows the minimum body.

bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "8a4e1c7b-2f93-4d58-b6a0-5c1e9d3f7b24", "request_id": "c5f0a2d8-6b17-4e39-9a4c-0d8e3b1f6a75", "order_id": "ORD20250002A", "data": { "amount": 100, "currency": "EUR", "payment": { "payment_id": "7e9d3b15-4a2c-4f86-8b07-e1c6a5f2d930", "payment_method": "INSTANT_TRANSFER_REST", "brand": "BIZUM", "transaction_type": "FULL", "credentials_on_file_type": "RECURRING_PAYMENT", "transaction_id": "176758480922815" } } }'
The customer does not approve subsequent payments in the Bizum app. The API returns the APPROVED status directly in the response.

Handle recurring errors

If the request fails validation, the API returns HTTP 400 with error details. For example, a transaction_id longer than 15 characters returns the error below.
json
{ "message": "Instant payment error.", "name": "HTTP_ERROR", "status_code": 400, "details": [ { "status": "ERROR", "error_code": "PAYMENTS-999", "description": "Instant payment error.", "description_detail": "Validation failed: COF Transaction ID cannot exceed 15 characters" } ] }
Check description_detail to find the field that failed validation. Correct the request and send it again with a new idempotency_key. For the full list of error codes, see the Errors reference.

Recurring best practices

Follow these recommendations when you implement Bizum recurring payments:

  • Wait for the initial payment to reach AUTHORIZED before you query the cof_transaction_id.
  • Store the cof_transaction_id securely and link it to the customer's account.
  • Validate a stored cof_transaction_id with Bizum Check before a subsequent payment, so you don't send a charge that will fail. See Validate a recurring identifier.
  • Send the same amount on every subsequent payment. To charge a different amount, create a new initial payment.
  • Use a new idempotency_key, payment_id, and order_id for every subsequent payment.
  • Use webhooks in production and status polling only as a fallback.

For refunds of initial or subsequent payments, see the Refund a Payment guide.

Payout flow

The Payout flow transfers funds directly to a customer's Bizum-registered phone number. You need only the recipient's phone number, passed as additional_data.customer.phone_number. Use this flow for disbursements, marketplace payouts, or any scenario where you need to push money to a customer.

1. Create the payout request

To create the payout, set payment_method to PAYOUT and include the recipient's details in the additional_data.customer object. Getnet processes the payout synchronously and returns the final APPROVED status in the API response.
bash
curl --request POST \ --url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \ --header 'Authorization: Bearer <your-token>' \ --header 'Content-Type: application/json' \ --data '{ "idempotency_key": "d6ac5037-c299-460f-ae21-4a93f785424e", "request_id": "0f2da57a-2d9b-4e12-929d-7cc9c586c0d6", "order_id": "PAY10187387", "data": { "amount": 400, "currency": "EUR", "payment": { "payment_id": "a3c2ac1d-4e96-4599-97d8-bc79a2fa874b", "payment_method": "PAYOUT", "brand": "BIZUM", "soft_descriptor": "BIZUM STORE" }, "additional_data": { "customer": { "email": "recipient@example.com", "document_number": "50506468", "document_type": "dni", "name": "Jose da Silva", "phone_number": "34700000000", "billing_address": { "street": "Calle Mayor", "number": "10", "complement": "2A", "district": "Centro", "city": "Madrid", "state": "MD", "country": "ES", "postal_code": "28001" } } } } }'
A successful payout returns APPROVED synchronously:
json
{ "idempotency_key": "d6ac5037-c299-460f-ae21-4a93f785424e", "seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e", "payment_id": "a3c2ac1d-4e96-4599-97d8-bc79a2fa874b", "order_id": "PAY10187387", "amount": 400, "currency": "EUR", "status": "APPROVED", "received_at": "2026-04-07T12:40:10.633Z", "reason_code": "00", "reason_message": "Operation completed successfully." }

Webhooks

To receive asynchronous status updates for Bizum API Rest transactions, register webhook events through the Webhooks API. Bizum API Rest webhook events differ from card payment webhooks. Register each event below to cover the full transaction lifecycle.

EventDescription
APPROVED_TRANSACTIONSSent for every payout or subsequent recurring payment
AUTHORIZED_TRANSACTIONSSent whenever a transaction is authorized (Single-step, Two-step, or recurring initial payment)
CAPTURED_TRANSACTIONSSent whenever a capture occurs after authorization (Two-step flow)
CANCELLED_TRANSACTIONSSent whenever you cancel a transaction through the /cancel service
PENDING_TRANSACTIONSSent whenever a transaction is created and pending payment confirmation in the Bizum app

Status reference

The table below describes the full status lifecycle for Bizum API Rest transactions.

StatusFlowsDescriptionNext action
WAITINGPurchase (except subsequent recurring payments)Request accepted. Customer has not yet approved the transaction in the Bizum appAwait webhook event or poll the Get Transaction endpoint
AUTHORIZEDPurchase (except subsequent recurring payments)Customer approved in the Bizum app. Two-step payments still need a capture; funds are not heldCall the Capture endpoint (two-step only)
CAPTUREDPurchase (except subsequent recurring payments)Payment fully processed. Funds are secured (single-step) or captured after pre-authorizationRecord for reconciliation
APPROVEDPayout, subsequent recurring paymentsPayout or subsequent recurring payment processed successfullyRecord for reconciliation; no further action required
CANCELLEDPurchase (all)You cancelled the transaction through the /cancel serviceRecord the cancellation for reconciliation. No further action is needed

Test Bizum API Rest payments

When you test Bizum API Rest payments in the sandbox environment, use the following credentials and amounts to simulate different scenarios.

Test phone number

Use the following phone number to test Bizum API Rest transactions in the sandbox environment:

Test Phone Number: 34700000000
In the sandbox (UAT) environment, this phone number automatically bypasses the Bizum app one-time password (OTP) and authentication step. The transaction moves from WAITING to AUTHORIZED without a real device. In production, customers must approve the transaction manually through the Bizum banking app. Always implement webhook event handling or polling for production purchase flows.

Test amounts

Different transaction amounts simulate different payment outcomes in the sandbox environment. Use the table below to test various scenarios:

These amounts apply only to INSTANT_TRANSFER_REST and INSTANT_TRANSFER_PREAUTH_REST flows. The sandbox always approves payout transactions (PAYOUT), regardless of the amount.
AmountOutcomeDescription
Less than €5Payment confirmedTransaction is successful and immediately approved
€5 to €10Payment confirmedTransaction is successful with normal processing
€10 to €500Payment confirmedTransaction is successful for standard amounts
More than €500Payment refusedThe sandbox declines the transaction to simulate high-value rejections

These test scenarios are only available in the sandbox environment. In production, the outcome depends on the customer's actual Bizum account status and balance.

Test recurring payments

Use the test phone number on the initial payment. The sandbox approves it automatically, so you do not need a real device. Test the following scenarios before going live:

ScenarioHow to testExpected result
Successful recurring flowCreate an initial payment, get its cof_transaction_id, then create one or more subsequent paymentsThe initial payment reaches AUTHORIZED. Each subsequent payment returns APPROVED
Invalid recurring identifierCreate a subsequent payment with a transaction_id longer than 15 charactersHTTP 400 with error_code PAYMENTS-999

Next steps

Use the resources below to continue your integration.