Update a payment link
Updates a payment link’s fields, its status, or both. Send only the fields that should change.
Deactivating or reactivating a link (status: ACTIVE ↔ DISABLED) is
always permitted. Editing any other field is rejected with 400 once the
link has been used — that is, it has a successful payment or a payment
currently in flight — so terms cannot change under a customer mid-checkout.
mode, merchant_reference_id and max_uses cannot be changed after
creation.
Authorizations
API key for service-to-service or merchant authentication.
Headers
Unique identifier for request tracing. Generated by the client or server if not provided.
"550e8400-e29b-41d4-a716-446655440000"
Unique key for idempotent request processing. Duplicate requests with the same key are safely ignored.
"baf6a8e2-0c89-46ef-9ca5-faa65b99bcd5"
Path Parameters
Unique identifier of the payment link
"550e8400-e29b-41d4-a716-446655440000"
Body
Request body for updating a payment link. Every field is optional; send only what should change.
Two kinds of update are supported, and they can be combined in one request:
- Status flip — send
statusto deactivate or reactivate the link. Permitted at any time, including on links that have already been paid. - Field edits — any other field. Rejected with
400once the link has been used (it has a successful payment or a payment in flight), so a customer can never see terms change mid-flow.
mode, merchant_reference_id and max_uses are immutable after creation.
Target status. Only ACTIVE ↔ DISABLED is settable here, so this enum is
deliberately narrower than the PaymentLinkStatus returned on responses:
EXPIRED and PAID are server-controlled and requesting either returns
400. Sending the link's current status is a no-op.
ACTIVE, DISABLED "DISABLED"
Where the customer's browser is sent after the hosted checkout completes. Propagated onto every checkout session spawned by this link.
Both URLs must be https:// — the hosted checkout returns the customer to
them after a payment, so plaintext destinations are not accepted.
Force 3DS authentication for payments made through this link
true
Free-form description shown to the customer on the hosted checkout page
"Invoice"
Customer details prefilled on the hosted checkout page. Every field is optional — omit the object entirely to have the customer enter their own details at checkout.
Replaces the stored metadata object wholesale
Channel to attribute the link to
"3d1f9c60-5a72-4e18-b0c4-9a6d2f5e7b13"
ISO 8601 timestamp after which the link stops being payable
"2026-12-31T23:59:59Z"
Amount in the currency's minor units
x >= 112500
ISO 4217 currency code
"SAR"
Response
Payment link updated successfully.
A shareable payment link. Sending a customer to hostedUrl spawns a checkout
session and redirects them to the hosted checkout page.
Casing note: this response uses camelCase property names, while the create and update request bodies accept snake_case. This is a known divergence from the rest of the Lite API surface, which is snake_case in both directions. The contract documented here is what the service returns today — integrate against camelCase on the response.
Unique payment link identifier
"550e8400-e29b-41d4-a716-446655440000"
Opaque token embedded in hostedUrl. Safe to share with customers — it
carries no merchant or amount information.
"plive_7c9f2a1b8e4d6035"
The customer-facing URL. Opening it consumes a slot on the link, creates a checkout session and redirects the browser to the hosted checkout page. Share this URL directly with customers.
"https://pay.lite.sa/pay/plive_7c9f2a1b8e4d6035"
Merchant that owns the link
"7f3c8b21-0d4e-4a92-9f65-2b8e1c7a4d30"
How many times the link may be paid.
SINGLE_USE— exactly one successful payment. The link is promoted toPAIDas soon as a payment reaches a terminal successful status.
SINGLE_USE "SINGLE_USE"
Lifecycle status of the payment link.
ACTIVE— payable.DISABLED— deactivated by the merchant. Reversible via the update endpoint.EXPIRED—expires_athas passed. Applied automatically when the link is read or listed; not settable by the caller.PAID— the usage ceiling has been reached, i.e. theSINGLE_USElink has been paid. Not settable by the caller.
Only ACTIVE ↔ DISABLED transitions are accepted on the update endpoint.
ACTIVE, DISABLED, EXPIRED, PAID "ACTIVE"
Amount in the currency's minor units (e.g. 10000 = 100.00 SAR)
x >= 110000
ISO 4217 currency code
"SAR"
Number of successful payments. Mirrors paidCount.
2
Number of payments through this link that reached a successful terminal status
2
Number of payments through this link that reached a failed terminal status
1
Timestamp when the link was created
"2026-06-01T10:30:00.000Z"
Timestamp when the link was last updated
"2026-06-04T09:12:44.000Z"
Merchant-supplied reference. Unique per merchant — a second create with the
same value is rejected with 409, which prevents duplicate links for one
order.
"order-2026-0042"
Post-checkout redirect targets, or null if none were configured
Whether 3DS authentication is forced for payments made through this link
true
Free-form description shown to the customer on the hosted checkout page
"Invoice"
Prefilled customer details, or null if none were configured
Arbitrary merchant metadata, propagated onto every checkout session spawned by this link
Channel the link is attributed to
"3d1f9c60-5a72-4e18-b0c4-9a6d2f5e7b13"
When the link stops being payable. Once passed, the link is promoted to
EXPIRED on the next read. null means the link never expires.
"2026-12-31T23:59:59.000Z"
Ceiling on successful payments. null unless the caller set it explicitly;
either way a SINGLE_USE link allows exactly one successful payment.
1
Timestamp of the most recent successful payment, or null if never paid
"2026-06-04T09:12:44.000Z"