Bizum API Rest
Bizum API Rest is a fully transparent, backend-to-backend integration that processes payments without redirecting the customer to an external gateway. Getnet provides no hosted payment page, so you build the checkout interface your customer sees. The customer gets a push notification in the Bizum app and approves the transaction there. The Global API supports Bizum API Rest across four flows:
- Single-step flow – authorize and capture the payment in one request using
INSTANT_TRANSFER_REST. - Two-step flow – validate the customer's Bizum account using
INSTANT_TRANSFER_PREAUTH_REST. Then capture the payment later (within 30 days), when you are ready to fulfill the order. - Recurring flow – charge the customer again without asking them to approve each payment. The customer approves only the first payment in the Bizum app.
- Payout flow – send funds to a customer using only their Bizum-registered phone number.
Important: Purchase flows are asynchronous, so the first API response returnsWAITING. This is expected, not an error: the status changes toAUTHORIZEDonly after the customer approves in the Bizum app.
APPROVED directly. To receive status updates, register webhook events through the Webhooks API. Alternatively, poll the Get Transaction endpoint to detect the change.Available features
Use the matrix below to confirm the scenarios currently supported for Bizum API Rest.
| Payment flow | Supported countries | Purchases | Refunds | Partial refunds | Multiple refunds | Pre-authorizations | Recurring | Payout |
|---|---|---|---|---|---|---|---|---|
| REST | Spain | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Shared characteristics
The table below summarizes the shared behavior and requirements across all Bizum API Rest flows.
| Capability | Details |
|---|---|
| Integration type | Transparent, no customer redirect required |
| Customer approval | Customer receives a push notification in the Bizum app and approves from there (purchase flows) |
| Initial status | WAITING for purchase flows until the customer approves in the app. Subsequent recurring payments return APPROVED directly |
| Post-approval status | Transitions to AUTHORIZED after the customer approves in the app (purchase flows only) |
_links, merchant_data, signature, or signature_version in additional_data. There is no HTML form to build and no gateway URL to redirect the customer to.Requirements
Before you integrate Bizum API Rest:
- Generate an access token through the Authentication endpoint. Payment requests and Bizum Check use the same credentials and token.
- Collect the customer's Bizum-registered phone number before you start the payment or run Bizum Check.
- Register webhook events through the Webhooks API to receive asynchronous status updates for purchase flows.
- Review the market requirements before going live: Currency codes, Document types, and Local taxes and regulations.
EUR). Contact your Account Manager to enable this payment method for your seller account. Recurring payments need a separate activation, so ask for it too if you plan to use the recurring flow. Bizum Check needs no extra activation.Bizum transactions are capped at €15,000. The customer's bank can enforce a lower limit, so the bank may still refuse a transaction below €15,000.
Bizum Check (pre-payment query)
Bizum Check is a REST query that tells you which Bizum payment options a customer has before you create the payment. You send the customer's phone number, and Getnet asks Bizum for that customer's capabilities. Use the result to pick the right payment flow and avoid payment attempts that can't succeed.
Bizum Check works for any seller with Bizum enabled. It uses the same credentials as your payment requests and needs no extra activation. It supports three queries:
- RTP eligibility – check whether the customer has Bizum and whether their account supports RTP.
- Recurring identifier validation – check whether a
cof_transaction_idfrom an initial recurring payment is still valid. See Validate a recurring identifier. - SCA exemptions query – get the SCA exemptions that the customer's account supports.
Important: Bizum Check is not an authorization. It creates no payment, charge, or settlement, and it doesn't appear in your reports. A positive result tells you which flow to use. It doesn't guarantee payment approval.
How Bizum Check works
The table below summarizes the behavior shared by all Bizum Check queries.
| Capability | Details |
|---|---|
| Availability | Any seller with Bizum enabled. No extra activation |
| Integration type | Backend-to-backend REST query. No customer interaction |
| Customer key | The customer's phone number identifies the Bizum account |
| Financial impact | None. Bizum Check creates no payment, charge, or settlement |
| Result | Synchronous. The response carries the result of the check |
| When to run it | After the customer selects Bizum and before you create the payment |
Bizum Check fits between the customer's choice of Bizum and the payment request:
- The customer selects Bizum at checkout and enters their phone number.
- You send a Bizum Check with the customer's phone number.
- You read the result and pick a flow: Bizum API Rest, Bizum Redirect, or another payment method.
- You create the payment in the flow you picked.
- Getnet notifies you of the payment result.
You can also run a check outside checkout. For example, validate a recurring identifier before a subsequent payment. Another use is to re-check a stored phone number and see whether it still supports RTP.
Bizum Check request fields
All Bizum Check queries use the same endpoint and body structure. Add the conditional fields to run the recurring identifier validation or the SCA exemptions query.
POST /dpm/security-gwproxy/v1/payment/checkorder_id goes inside data.payment, and the customer object sits directly under data. The phone number also takes the country prefix, and the + sign is optional.| Field | Type | Required | Description |
|---|---|---|---|
idempotency_key | String (UUID) | Yes | Unique identifier that stops Getnet from processing the request twice. Use UUID v4 format and generate a new value for every check |
data.payment.payment_method | String | Yes | Bizum payment method. Accepted values: INSTANT_TRANSFER, INSTANT_TRANSFER_PREAUTH, INSTANT_TRANSFER_REST, INSTANT_TRANSFER_PREAUTH_REST, PAYOUT |
data.payment.brand | String | Yes | Must be BIZUM |
data.payment.order_id | String | Yes | Order identifier. Required even though the check creates no transaction. Must be between 4 and 12 alphanumeric characters. You can repeat the same value |
data.customer.phone_number | String | Yes | Customer's phone number with the country prefix (e.g., +34700000000). Must be between 5 and 15 digits. The + sign is optional |
data.payment.cof_transaction_id | String | Recurring identifier validation only | The cof_transaction_id from the initial recurring payment's record. Maximum 15 alphanumeric characters |
data.payment.request_sca_exemptions | Boolean | SCA exemptions query only | Send true to get the SCA exemptions the customer's account supports |
Bizum Check response fields
All Bizum Check queries return the same response structure. The response leaves out fields with no value.
| Field | Type | Description |
|---|---|---|
idempotency_key | String | The idempotency_key you sent |
order_id | String | The order_id you sent |
brand | String | Always BIZUM |
status | String | OK when the customer has Bizum and RTP. KO otherwise |
message | String | Describes the result. Read it with status to tell the results apart. See Pick the payment flow |
cof_transaction_status | String | OK when the recurring identifier is valid. KO when it is no longer valid. Returned only when you send cof_transaction_id |
sca_exemptions | String | Comma-separated list of the SCA exemptions the customer's account supports. Returned only when you send request_sca_exemptions |
Send the RTP check
Run this query at checkout. It shows whether you can charge the customer with Bizum API Rest, Bizum Redirect, or neither. Call the Bizum Check endpoint with the required fields only.
curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "5f1c9a2e-7b34-4d8e-9a61-2c0e8b7d4f13",
"data": {
"payment": {
"payment_method": "INSTANT_TRANSFER",
"brand": "BIZUM",
"order_id": "CHK7A2F9K1Q"
},
"customer": {
"phone_number": "+34700000000"
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "5f1c9a2e-7b34-4d8e-9a61-2c0e8b7d4f13",
"data": {
"payment": {
"payment_method": "INSTANT_TRANSFER",
"brand": "BIZUM",
"order_id": "CHK7A2F9K1Q"
},
"customer": {
"phone_number": "+34700000000"
}
}
}'For a customer with Bizum and RTP, the API returns the following response:
{
"idempotency_key": "5f1c9a2e-7b34-4d8e-9a61-2c0e8b7d4f13",
"order_id": "CHK7A2F9K1Q",
"brand": "BIZUM",
"status": "OK",
"message": "Operation completed successfully"
}{
"idempotency_key": "5f1c9a2e-7b34-4d8e-9a61-2c0e8b7d4f13",
"order_id": "CHK7A2F9K1Q",
"brand": "BIZUM",
"status": "OK",
"message": "Operation completed successfully"
}Pick the payment flow
status and message to decide how to charge the customer. Both negative results return KO, so read message to tell them apart. OK is the only result that confirms RTP.status | message | Meaning | Next action |
|---|---|---|---|
OK | Operation completed successfully | The customer has Bizum and RTP | Create the payment with a Bizum API Rest flow on this page |
KO | Operation completed successfully | The customer has Bizum, but not RTP | Create the payment with Bizum Redirect |
KO | User not found (does not have Bizum) | The phone number has no Bizum account | Offer another payment method |
Validate a recurring identifier
cof_transaction_id is still valid before you create a subsequent recurring payment. An identifier stops being valid when it is revoked, for example when the customer cancels the recurrence.data.payment.cof_transaction_id to the request with the identifier you stored. To get the identifier, see Step 3 of the Recurring flow.curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "b8e04d71-3a95-4c2f-8e6d-91f7a0c5b2e8",
"data": {
"payment": {
"payment_method": "INSTANT_TRANSFER",
"brand": "BIZUM",
"order_id": "CHK3M8R2T5W",
"cof_transaction_id": "176758480922815"
},
"customer": {
"phone_number": "+34700000000"
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "b8e04d71-3a95-4c2f-8e6d-91f7a0c5b2e8",
"data": {
"payment": {
"payment_method": "INSTANT_TRANSFER",
"brand": "BIZUM",
"order_id": "CHK3M8R2T5W",
"cof_transaction_id": "176758480922815"
},
"customer": {
"phone_number": "+34700000000"
}
}
}'cof_transaction_status field:{
"idempotency_key": "b8e04d71-3a95-4c2f-8e6d-91f7a0c5b2e8",
"order_id": "CHK3M8R2T5W",
"brand": "BIZUM",
"status": "OK",
"message": "Operation completed successfully",
"cof_transaction_status": "OK"
}{
"idempotency_key": "b8e04d71-3a95-4c2f-8e6d-91f7a0c5b2e8",
"order_id": "CHK3M8R2T5W",
"brand": "BIZUM",
"status": "OK",
"message": "Operation completed successfully",
"cof_transaction_status": "OK"
}cof_transaction_status value.cof_transaction_status | Meaning | Next action |
|---|---|---|
OK | The recurring identifier is valid | Create the subsequent payment with this identifier |
KO | The identifier was revoked | Create a new initial recurring payment to get a new identifier. See Recurring flow |
Query SCA exemptions
data.payment.request_sca_exemptions to the request and set it to true.curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "e3a91c56-0d4b-4f7e-a2c8-6b5d9f1e7a04",
"data": {
"payment": {
"payment_method": "INSTANT_TRANSFER",
"brand": "BIZUM",
"order_id": "CHK5H1V7J3D",
"request_sca_exemptions": true
},
"customer": {
"phone_number": "+34700000000"
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/security-gwproxy/v1/payment/check \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "e3a91c56-0d4b-4f7e-a2c8-6b5d9f1e7a04",
"data": {
"payment": {
"payment_method": "INSTANT_TRANSFER",
"brand": "BIZUM",
"order_id": "CHK5H1V7J3D",
"request_sca_exemptions": true
},
"customer": {
"phone_number": "+34700000000"
}
}
}'sca_exemptions field:{
"idempotency_key": "e3a91c56-0d4b-4f7e-a2c8-6b5d9f1e7a04",
"order_id": "CHK5H1V7J3D",
"brand": "BIZUM",
"status": "OK",
"message": "Operation completed successfully",
"sca_exemptions": "MIT,LWV,TRA"
}{
"idempotency_key": "e3a91c56-0d4b-4f7e-a2c8-6b5d9f1e7a04",
"order_id": "CHK5H1V7J3D",
"brand": "BIZUM",
"status": "OK",
"message": "Operation completed successfully",
"sca_exemptions": "MIT,LWV,TRA"
}sca_exemptions field can include the following values:| Value | Exemption |
|---|---|
MIT | Merchant-initiated transaction, such as a subsequent recurring payment |
LWV | Low-value payment, under €30 |
TRA | Transaction risk analysis |
cof_transaction_id and request_sca_exemptions, and the response returns both fields.Handle Bizum Check errors
idempotency_key.| HTTP status | Error code | Cause | Next action |
|---|---|---|---|
400 | INVALID_REQUEST | A required field is missing. The message names the field (e.g., phone_number is required for Bizum RTP check) | Add the missing field |
400 | GENERIC-400 | payment_method is not an accepted value | Send one of the values listed in Bizum Check request fields |
400, 408, 502 | PAYMENTS-999 | Bizum returned an error or didn't respond in time. The description reads Instant payment error. | Check the request values. For 408 or 502, retry the check |
For the full list of error codes, see the Errors reference.
Bizum Check best practices
Follow these recommendations when you implement Bizum Check:
- Run the check after the customer selects Bizum and before you create the payment.
- Read both
statusandmessage. The two negative results share theKOstatus. - Validate a stored
cof_transaction_idbefore each subsequent recurring payment. - Use a new
idempotency_keyfor every check. - Don't treat an
OKresult as a payment approval. Always confirm the payment result through webhooks or the Get Transaction endpoint.
Request structure
All Bizum API Rest purchase requests share the same top-level body structure and the same endpoint. The table below documents the common fields. Each flow section describes its flow-specific fields.
| Field | Type | Required | Description |
|---|---|---|---|
idempotency_key | String (UUID) | Yes | Unique identifier that stops Getnet from processing the request twice. Use UUID v4 format |
request_id | String (UUID) | Yes | Unique identifier for tracking the request across systems |
order_id | String | Yes | Unique identifier for the purchase, used for reconciliation. Must be between 4 and 12 alphanumeric characters |
data.amount | Integer | Yes | Transaction amount in cents. For example, 400 represents €4.00. Maximum 1500000 (€15,000) |
data.currency | String | Yes | ISO 4217 currency code. Must be EUR |
data.payment.payment_id | String | Yes | Merchant-defined payment identifier. Must be a maximum of 255 alphanumeric characters |
data.payment.payment_method | String | Yes | Flow-specific value. See each section below |
data.payment.brand | String | Yes | Must be BIZUM |
data.payment.soft_descriptor | String | No | Optional transaction description or preferred reference ID used in the reconciliation file. Maximum 22 characters. Getnet removes special characters |
data.additional_data.customer.email | String | No | Customer's email address |
data.additional_data.customer.document_number | String | No | Customer's identification document number |
data.additional_data.customer.document_type | String | No | Document type (e.g., dni). See Document types |
data.additional_data.customer.name | String | No | Customer's full name |
data.additional_data.customer.phone_number | String | Yes | Customer's Bizum-registered phone number without the + sign (e.g., 34700000000). Not needed on subsequent recurring payments |
data.additional_data.customer.billing_address | Object | No | Customer's billing address. See Billing address fields |
Billing address fields
billing_address object accepts the following fields.| Field | Type | Description |
|---|---|---|
street | String | Street name |
number | String | Building number |
complement | String | Additional address details (e.g., Suite 1) |
district | String | Neighborhood or district |
city | String | City name |
state | String | State or province code |
country | String | ISO 3166-1 alpha-2 country code (e.g., ES) |
postal_code | String | Postal or ZIP code |
Single-step flow (immediate capture)
Use this flow when you can fulfill the order immediately. A single request authorizes and captures the payment. The customer receives a push notification in the Bizum app to approve the transaction.
1. Create the payment request
payment_method to INSTANT_TRANSFER_REST.curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "ccb0a152-3733-4df4-bcfa-9c2fe49eb991",
"request_id": "e80f8efd-75ac-4889-a72c-4840f01cc96a",
"order_id": "ORD10187385",
"data": {
"amount": 400,
"currency": "EUR",
"payment": {
"payment_id": "7b78ebc8-8f52-48a5-8e31-22e0c22ce390",
"payment_method": "INSTANT_TRANSFER_REST",
"brand": "BIZUM",
"soft_descriptor": "BIZUM STORE"
},
"additional_data": {
"customer": {
"email": "customer@example.com",
"document_number": "50506468",
"document_type": "dni",
"name": "Jose da Silva",
"phone_number": "34700000000",
"billing_address": {
"street": "Calle Mayor",
"number": "10",
"complement": "2A",
"district": "Centro",
"city": "Madrid",
"state": "MD",
"country": "ES",
"postal_code": "28001"
}
}
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "ccb0a152-3733-4df4-bcfa-9c2fe49eb991",
"request_id": "e80f8efd-75ac-4889-a72c-4840f01cc96a",
"order_id": "ORD10187385",
"data": {
"amount": 400,
"currency": "EUR",
"payment": {
"payment_id": "7b78ebc8-8f52-48a5-8e31-22e0c22ce390",
"payment_method": "INSTANT_TRANSFER_REST",
"brand": "BIZUM",
"soft_descriptor": "BIZUM STORE"
},
"additional_data": {
"customer": {
"email": "customer@example.com",
"document_number": "50506468",
"document_type": "dni",
"name": "Jose da Silva",
"phone_number": "34700000000",
"billing_address": {
"street": "Calle Mayor",
"number": "10",
"complement": "2A",
"district": "Centro",
"city": "Madrid",
"state": "MD",
"country": "ES",
"postal_code": "28001"
}
}
}
}
}'WAITING status. This is the expected response. The transaction completes only after the customer approves it in the Bizum app.{
"idempotency_key": "ccb0a152-3733-4df4-bcfa-9c2fe49eb991",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "7b78ebc8-8f52-48a5-8e31-22e0c22ce390",
"order_id": "ORD10187385",
"amount": "400",
"currency": "EUR",
"status": "WAITING",
"received_at": "2025-11-03T14:18:59.991Z",
"reason_code": "00",
"reason_message": "Waiting payment flow."
}{
"idempotency_key": "ccb0a152-3733-4df4-bcfa-9c2fe49eb991",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "7b78ebc8-8f52-48a5-8e31-22e0c22ce390",
"order_id": "ORD10187385",
"amount": "400",
"currency": "EUR",
"status": "WAITING",
"received_at": "2025-11-03T14:18:59.991Z",
"reason_code": "00",
"reason_message": "Waiting payment flow."
}2. Handle the asynchronous status
WAITING to AUTHORIZED, then immediately to CAPTURED for single-step payments.3. Verify the status
CAPTURED status. Prefer webhooks over polling for production implementations.Two-step flow (validation + capture)
Choose this flow when you need to validate the customer's Bizum account first and capture the payment after fulfillment. This flow validates the account in one step and lets you capture within 30 days.
Important: An authorization does not "hold" funds in Bizum. If the customer's balance drops before you capture the payment, the transaction fails due to insufficient funds.
1. Validate the payment
payment_method to INSTANT_TRANSFER_PREAUTH_REST.curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "3ac6f22d-5689-470c-bb98-47f91a6ee5d6",
"request_id": "3f09943b-7aca-4e37-abb4-ec8d846a8ca1",
"order_id": "ORD10187386",
"data": {
"amount": 400,
"currency": "EUR",
"payment": {
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"payment_method": "INSTANT_TRANSFER_PREAUTH_REST",
"brand": "BIZUM",
"soft_descriptor": "BIZUM STORE"
},
"additional_data": {
"customer": {
"email": "customer@example.com",
"document_number": "50506468",
"document_type": "dni",
"name": "Jose da Silva",
"phone_number": "34700000000",
"billing_address": {
"street": "Calle Mayor",
"number": "10",
"complement": "2A",
"district": "Centro",
"city": "Madrid",
"state": "MD",
"country": "ES",
"postal_code": "28001"
}
}
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "3ac6f22d-5689-470c-bb98-47f91a6ee5d6",
"request_id": "3f09943b-7aca-4e37-abb4-ec8d846a8ca1",
"order_id": "ORD10187386",
"data": {
"amount": 400,
"currency": "EUR",
"payment": {
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"payment_method": "INSTANT_TRANSFER_PREAUTH_REST",
"brand": "BIZUM",
"soft_descriptor": "BIZUM STORE"
},
"additional_data": {
"customer": {
"email": "customer@example.com",
"document_number": "50506468",
"document_type": "dni",
"name": "Jose da Silva",
"phone_number": "34700000000",
"billing_address": {
"street": "Calle Mayor",
"number": "10",
"complement": "2A",
"district": "Centro",
"city": "Madrid",
"state": "MD",
"country": "ES",
"postal_code": "28001"
}
}
}
}
}'WAITING status immediately. After the customer approves in the Bizum app, the status changes to AUTHORIZED. Getnet sends the update through the Webhooks API.{
"idempotency_key": "3ac6f22d-5689-470c-bb98-47f91a6ee5d6",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"order_id": "ORD10187386",
"amount": "400",
"currency": "EUR",
"status": "WAITING",
"received_at": "2025-11-03T14:18:59.991Z",
"reason_code": "00",
"reason_message": "Waiting payment flow."
}{
"idempotency_key": "3ac6f22d-5689-470c-bb98-47f91a6ee5d6",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"order_id": "ORD10187386",
"amount": "400",
"currency": "EUR",
"status": "WAITING",
"received_at": "2025-11-03T14:18:59.991Z",
"reason_code": "00",
"reason_message": "Waiting payment flow."
}"status": "AUTHORIZED". Use the same payment_id to call the Capture endpoint.2. Capture the validated payment
To complete the sale, call the Capture endpoint. You can capture the payment within 30 days of validation.
curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments/capture \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "11c7f8ee-51a6-470d-bb76-ef762b62bfb1",
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"payment_method": "INSTANT_TRANSFER_PREAUTH_REST",
"amount": 400
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments/capture \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "11c7f8ee-51a6-470d-bb76-ef762b62bfb1",
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"payment_method": "INSTANT_TRANSFER_PREAUTH_REST",
"amount": 400
}'A successful capture returns the following response:
{
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"idempotency_key": "11c7f8ee-51a6-470d-bb76-ef762b62bfb1",
"order_id": "ORD10187386",
"amount": 400,
"currency": "EUR",
"status": "CAPTURED",
"reason_code": "00",
"reason_message": "Captured successfully",
"captured_at": "2025-11-03T15:20:30.456Z"
}{
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "8ad911d5-257b-48b8-becb-37d5f440c336",
"idempotency_key": "11c7f8ee-51a6-470d-bb76-ef762b62bfb1",
"order_id": "ORD10187386",
"amount": 400,
"currency": "EUR",
"status": "CAPTURED",
"reason_code": "00",
"reason_message": "Captured successfully",
"captured_at": "2025-11-03T15:20:30.456Z"
}3. Confirm settlement
AUTHORIZED to CAPTURED.Recurring flow
Use this flow to charge a customer again without asking them to approve each payment in the Bizum app. The customer approves only the first payment. You then send its recurring transaction identifier with every later payment.
WAITING until the customer approves it. The recurring transaction identifier is available only after the status changes to AUTHORIZED.A recurring sequence starts with an initial payment that the customer approves. You then create subsequent payments on your own schedule:
- The customer selects Bizum at checkout.
- You create the initial payment. Getnet sends a push notification to the customer's Bizum app.
- The customer approves the payment and the recurrence in the app.
- Getnet notifies you of the result.
- You query the payment records to get the recurring transaction identifier,
cof_transaction_id. - Optionally, you validate the identifier with Bizum Check before a subsequent payment. See Validate a recurring identifier.
- You create each subsequent payment with that identifier. Getnet charges the customer with no action from them.
cof_transaction_id does not expire. You can reuse it for as many subsequent payments as you need. Each payment must have the same amount as the initial payment.Recurring request fields
data.payment values below.| Field | Type | Required | Description |
|---|---|---|---|
data.payment.payment_method | String | Yes | Must be INSTANT_TRANSFER_REST |
data.payment.brand | String | Yes | Must be BIZUM |
data.payment.transaction_type | String | Yes | Must be FULL |
data.payment.credentials_on_file_type | String | Yes | Use RECURRING for the initial payment and RECURRING_PAYMENT for each subsequent payment |
data.payment.transaction_id | String | Subsequent payments only | The cof_transaction_id value from the initial payment's record. Maximum 15 characters. See Step 3 |
INSTANT_TRANSFER_PREAUTH_REST, Getnet processes it as INSTANT_TRANSFER_REST.1. Create the initial payment
credentials_on_file_type set to RECURRING. Include the customer's phone number. Do not send transaction_id on this request.idempotency_key, request_id, and payment_id on every request.curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "63c7f8ee-51a6-470d-bb76-ef762b62bfb9",
"request_id": "1d2b7e4a-9c3f-4a61-8e05-7b9f2c6d0a13",
"order_id": "ORD20250001A",
"data": {
"amount": 100,
"currency": "EUR",
"payment": {
"payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8",
"payment_method": "INSTANT_TRANSFER_REST",
"brand": "BIZUM",
"transaction_type": "FULL",
"credentials_on_file_type": "RECURRING"
},
"additional_data": {
"customer": {
"phone_number": "34700000000"
}
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "63c7f8ee-51a6-470d-bb76-ef762b62bfb9",
"request_id": "1d2b7e4a-9c3f-4a61-8e05-7b9f2c6d0a13",
"order_id": "ORD20250001A",
"data": {
"amount": 100,
"currency": "EUR",
"payment": {
"payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8",
"payment_method": "INSTANT_TRANSFER_REST",
"brand": "BIZUM",
"transaction_type": "FULL",
"credentials_on_file_type": "RECURRING"
},
"additional_data": {
"customer": {
"phone_number": "34700000000"
}
}
}
}'WAITING status. The customer now receives a push notification in the Bizum app.{
"idempotency_key": "63c7f8ee-51a6-470d-bb76-ef762b62bfb9",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8",
"order_id": "ORD20250001A",
"amount": "100",
"currency": "EUR",
"status": "WAITING",
"received_at": "2025-11-03T14:18:59.991Z",
"reason_code": "00",
"reason_message": "Waiting payment flow."
}{
"idempotency_key": "63c7f8ee-51a6-470d-bb76-ef762b62bfb9",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8",
"order_id": "ORD20250001A",
"amount": "100",
"currency": "EUR",
"status": "WAITING",
"received_at": "2025-11-03T14:18:59.991Z",
"reason_code": "00",
"reason_message": "Waiting payment flow."
}payment_id to query the payment records in Step 3. Save it from this response, or get it later from the webhook notification for this payment.2. Confirm the initial payment
WAITING to AUTHORIZED, and Getnet sends the update through the webhook events you registered.The initial payment uses the same webhook events and statuses as a single-step payment. See Webhooks and Status Reference.
If you do not receive a webhook, poll the Get Transaction endpoint as a fallback.
3. Get the recurring transaction identifier
cof_transaction_id. After the payment reaches AUTHORIZED, Getnet adds it to the payment record. You get it in two calls.payment_id from Step 1.curl --request GET \
--url https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8 \
--header 'Authorization: Bearer <your-token>'curl --request GET \
--url https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8 \
--header 'Authorization: Bearer <your-token>'records array. The Bizum payment record has rel set to APM, and its href field holds the URL of the full record.{
"payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8",
"order_id": "ORD20250001A",
"status": "AUTHORIZED",
"payment": {
"payment_method": "INSTANT_TRANSFER_REST",
"amount": 100,
"currency": "EUR",
"transaction_type": "FULL",
"soft_descriptor": "7b2e9c4f1a6d8e3b5c0f2a",
"brand": "BIZUM",
"credentials_on_file_type": "RECURRING",
"save_card_data": false
},
"records": [
{
"rel": "APM",
"idempotency_key": "4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47",
"country": "ES",
"tenant": "santander",
"registered_at": "2025-11-03T14:20:12.573Z",
"href": "https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8/4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47"
}
]
}{
"payment_id": "3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8",
"order_id": "ORD20250001A",
"status": "AUTHORIZED",
"payment": {
"payment_method": "INSTANT_TRANSFER_REST",
"amount": 100,
"currency": "EUR",
"transaction_type": "FULL",
"soft_descriptor": "7b2e9c4f1a6d8e3b5c0f2a",
"brand": "BIZUM",
"credentials_on_file_type": "RECURRING",
"save_card_data": false
},
"records": [
{
"rel": "APM",
"idempotency_key": "4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47",
"country": "ES",
"tenant": "santander",
"registered_at": "2025-11-03T14:20:12.573Z",
"href": "https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8/4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47"
}
]
}GET request to the record's href. This URL calls the Get by Idempotent Key endpoint, so it needs the same Authorization header.curl --request GET \
--url https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8/4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47 \
--header 'Authorization: Bearer <your-token>'curl --request GET \
--url https://api-sbx.globalgetnet.com/dpm/hub-payment-info/v1/payments/info/3f6c2a9e-8b41-4d7a-9c15-2e7b0d4a61f8/4b8f2e61-7d3a-4c95-a1e8-6f0b9c2d5e47 \
--header 'Authorization: Bearer <your-token>'cof_transaction_id value from this response. Store it with the customer's details. You send it on every subsequent payment.Before a subsequent payment, you can confirm that the identifier is still valid with Bizum Check. See Validate a recurring identifier.
4. Create subsequent payments
For each later charge, call the Create – Authorize endpoint with these values:
credentials_on_file_typeset toRECURRING_PAYMENTtransaction_idset to thecof_transaction_idyou stored in Step 3amountequal to the initial payment amount
You don't need to send the customer's phone number on subsequent payments. The request below shows the minimum body.
curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "8a4e1c7b-2f93-4d58-b6a0-5c1e9d3f7b24",
"request_id": "c5f0a2d8-6b17-4e39-9a4c-0d8e3b1f6a75",
"order_id": "ORD20250002A",
"data": {
"amount": 100,
"currency": "EUR",
"payment": {
"payment_id": "7e9d3b15-4a2c-4f86-8b07-e1c6a5f2d930",
"payment_method": "INSTANT_TRANSFER_REST",
"brand": "BIZUM",
"transaction_type": "FULL",
"credentials_on_file_type": "RECURRING_PAYMENT",
"transaction_id": "176758480922815"
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "8a4e1c7b-2f93-4d58-b6a0-5c1e9d3f7b24",
"request_id": "c5f0a2d8-6b17-4e39-9a4c-0d8e3b1f6a75",
"order_id": "ORD20250002A",
"data": {
"amount": 100,
"currency": "EUR",
"payment": {
"payment_id": "7e9d3b15-4a2c-4f86-8b07-e1c6a5f2d930",
"payment_method": "INSTANT_TRANSFER_REST",
"brand": "BIZUM",
"transaction_type": "FULL",
"credentials_on_file_type": "RECURRING_PAYMENT",
"transaction_id": "176758480922815"
}
}
}'APPROVED status directly in the response.Handle recurring errors
400 with error details. For example, a transaction_id longer than 15 characters returns the error below.{
"message": "Instant payment error.",
"name": "HTTP_ERROR",
"status_code": 400,
"details": [
{
"status": "ERROR",
"error_code": "PAYMENTS-999",
"description": "Instant payment error.",
"description_detail": "Validation failed: COF Transaction ID cannot exceed 15 characters"
}
]
}{
"message": "Instant payment error.",
"name": "HTTP_ERROR",
"status_code": 400,
"details": [
{
"status": "ERROR",
"error_code": "PAYMENTS-999",
"description": "Instant payment error.",
"description_detail": "Validation failed: COF Transaction ID cannot exceed 15 characters"
}
]
}description_detail to find the field that failed validation. Correct the request and send it again with a new idempotency_key. For the full list of error codes, see the Errors reference.Recurring best practices
Follow these recommendations when you implement Bizum recurring payments:
- Wait for the initial payment to reach
AUTHORIZEDbefore you query thecof_transaction_id. - Store the
cof_transaction_idsecurely and link it to the customer's account. - Validate a stored
cof_transaction_idwith Bizum Check before a subsequent payment, so you don't send a charge that will fail. See Validate a recurring identifier. - Send the same amount on every subsequent payment. To charge a different amount, create a new initial payment.
- Use a new
idempotency_key,payment_id, andorder_idfor every subsequent payment. - Use webhooks in production and status polling only as a fallback.
For refunds of initial or subsequent payments, see the Refund a Payment guide.
Payout flow
additional_data.customer.phone_number. Use this flow for disbursements, marketplace payouts, or any scenario where you need to push money to a customer.1. Create the payout request
payment_method to PAYOUT and include the recipient's details in the additional_data.customer object. Getnet processes the payout synchronously and returns the final APPROVED status in the API response.curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "d6ac5037-c299-460f-ae21-4a93f785424e",
"request_id": "0f2da57a-2d9b-4e12-929d-7cc9c586c0d6",
"order_id": "PAY10187387",
"data": {
"amount": 400,
"currency": "EUR",
"payment": {
"payment_id": "a3c2ac1d-4e96-4599-97d8-bc79a2fa874b",
"payment_method": "PAYOUT",
"brand": "BIZUM",
"soft_descriptor": "BIZUM STORE"
},
"additional_data": {
"customer": {
"email": "recipient@example.com",
"document_number": "50506468",
"document_type": "dni",
"name": "Jose da Silva",
"phone_number": "34700000000",
"billing_address": {
"street": "Calle Mayor",
"number": "10",
"complement": "2A",
"district": "Centro",
"city": "Madrid",
"state": "MD",
"country": "ES",
"postal_code": "28001"
}
}
}
}
}'curl --request POST \
--url https://api-sbx.globalgetnet.com/dpm/payments-gwproxy/v2/payments \
--header 'Authorization: Bearer <your-token>' \
--header 'Content-Type: application/json' \
--data '{
"idempotency_key": "d6ac5037-c299-460f-ae21-4a93f785424e",
"request_id": "0f2da57a-2d9b-4e12-929d-7cc9c586c0d6",
"order_id": "PAY10187387",
"data": {
"amount": 400,
"currency": "EUR",
"payment": {
"payment_id": "a3c2ac1d-4e96-4599-97d8-bc79a2fa874b",
"payment_method": "PAYOUT",
"brand": "BIZUM",
"soft_descriptor": "BIZUM STORE"
},
"additional_data": {
"customer": {
"email": "recipient@example.com",
"document_number": "50506468",
"document_type": "dni",
"name": "Jose da Silva",
"phone_number": "34700000000",
"billing_address": {
"street": "Calle Mayor",
"number": "10",
"complement": "2A",
"district": "Centro",
"city": "Madrid",
"state": "MD",
"country": "ES",
"postal_code": "28001"
}
}
}
}
}'APPROVED synchronously:{
"idempotency_key": "d6ac5037-c299-460f-ae21-4a93f785424e",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "a3c2ac1d-4e96-4599-97d8-bc79a2fa874b",
"order_id": "PAY10187387",
"amount": 400,
"currency": "EUR",
"status": "APPROVED",
"received_at": "2026-04-07T12:40:10.633Z",
"reason_code": "00",
"reason_message": "Operation completed successfully."
}{
"idempotency_key": "d6ac5037-c299-460f-ae21-4a93f785424e",
"seller_id": "2ab3e585-3607-467e-b2e8-420fcd45f48e",
"payment_id": "a3c2ac1d-4e96-4599-97d8-bc79a2fa874b",
"order_id": "PAY10187387",
"amount": 400,
"currency": "EUR",
"status": "APPROVED",
"received_at": "2026-04-07T12:40:10.633Z",
"reason_code": "00",
"reason_message": "Operation completed successfully."
}Webhooks
To receive asynchronous status updates for Bizum API Rest transactions, register webhook events through the Webhooks API. Bizum API Rest webhook events differ from card payment webhooks. Register each event below to cover the full transaction lifecycle.
| Event | Description |
|---|---|
APPROVED_TRANSACTIONS | Sent for every payout or subsequent recurring payment |
AUTHORIZED_TRANSACTIONS | Sent whenever a transaction is authorized (Single-step, Two-step, or recurring initial payment) |
CAPTURED_TRANSACTIONS | Sent whenever a capture occurs after authorization (Two-step flow) |
CANCELLED_TRANSACTIONS | Sent whenever you cancel a transaction through the /cancel service |
PENDING_TRANSACTIONS | Sent whenever a transaction is created and pending payment confirmation in the Bizum app |
Status reference
The table below describes the full status lifecycle for Bizum API Rest transactions.
| Status | Flows | Description | Next action |
|---|---|---|---|
WAITING | Purchase (except subsequent recurring payments) | Request accepted. Customer has not yet approved the transaction in the Bizum app | Await webhook event or poll the Get Transaction endpoint |
AUTHORIZED | Purchase (except subsequent recurring payments) | Customer approved in the Bizum app. Two-step payments still need a capture; funds are not held | Call the Capture endpoint (two-step only) |
CAPTURED | Purchase (except subsequent recurring payments) | Payment fully processed. Funds are secured (single-step) or captured after pre-authorization | Record for reconciliation |
APPROVED | Payout, subsequent recurring payments | Payout or subsequent recurring payment processed successfully | Record for reconciliation; no further action required |
CANCELLED | Purchase (all) | You cancelled the transaction through the /cancel service | Record the cancellation for reconciliation. No further action is needed |
Test Bizum API Rest payments
When you test Bizum API Rest payments in the sandbox environment, use the following credentials and amounts to simulate different scenarios.
Test phone number
Use the following phone number to test Bizum API Rest transactions in the sandbox environment:
34700000000WAITING to AUTHORIZED without a real device. In production, customers must approve the transaction manually through the Bizum banking app. Always implement webhook event handling or polling for production purchase flows.Test amounts
Different transaction amounts simulate different payment outcomes in the sandbox environment. Use the table below to test various scenarios:
INSTANT_TRANSFER_REST and INSTANT_TRANSFER_PREAUTH_REST flows. The sandbox always approves payout transactions (PAYOUT), regardless of the amount.| Amount | Outcome | Description |
|---|---|---|
| Less than €5 | Payment confirmed | Transaction is successful and immediately approved |
| €5 to €10 | Payment confirmed | Transaction is successful with normal processing |
| €10 to €500 | Payment confirmed | Transaction is successful for standard amounts |
| More than €500 | Payment refused | The sandbox declines the transaction to simulate high-value rejections |
These test scenarios are only available in the sandbox environment. In production, the outcome depends on the customer's actual Bizum account status and balance.
Test recurring payments
Use the test phone number on the initial payment. The sandbox approves it automatically, so you do not need a real device. Test the following scenarios before going live:
| Scenario | How to test | Expected result |
|---|---|---|
| Successful recurring flow | Create an initial payment, get its cof_transaction_id, then create one or more subsequent payments | The initial payment reaches AUTHORIZED. Each subsequent payment returns APPROVED |
| Invalid recurring identifier | Create a subsequent payment with a transaction_id longer than 15 characters | HTTP 400 with error_code PAYMENTS-999 |
Next steps
Use the resources below to continue your integration.
On this page