> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lite.sa/llms.txt
> Use this file to discover all available pages before exploring further.

# Update a payment link

> Updates a payment link's fields, its status, or both. Send only the fields
that should change.

Deactivating or reactivating a link (`status`: `ACTIVE` ↔ `DISABLED`) is
always permitted. Editing any other field is rejected with `400` once the
link has been used — that is, it has a successful payment or a payment
currently in flight — so terms cannot change under a customer mid-checkout.

`mode`, `merchant_reference_id` and `max_uses` cannot be changed after
creation.



## OpenAPI

````yaml /openapi/payment-acceptance.json patch /payment-links/{link_id}
openapi: 3.1.0
info:
  title: lite - Payment Acceptance
  version: 1.0.0
servers:
  - url: https://api.lite.sa/api/v1
    description: Production
security:
  - ApiKeyAuth: []
  - BearerAuth: []
tags:
  - name: 3DS Authentication
    description: Standalone payer authentication via the 3DS standard
  - name: Hosted Checkout
    description: Create, manage and deploy hosted checkout pages
  - name: Payment Links
    description: Create, manage and audit shareable payment links
  - name: Server-to-Server Payments
    description: Direct payment API for server-side integrations
paths:
  /payment-links/{link_id}:
    patch:
      tags:
        - Payment Links
      summary: Update a payment link
      description: >-
        Updates a payment link's fields, its status, or both. Send only the
        fields

        that should change.


        Deactivating or reactivating a link (`status`: `ACTIVE` ↔ `DISABLED`) is

        always permitted. Editing any other field is rejected with `400` once
        the

        link has been used — that is, it has a successful payment or a payment

        currently in flight — so terms cannot change under a customer
        mid-checkout.


        `mode`, `merchant_reference_id` and `max_uses` cannot be changed after

        creation.
      operationId: lite.paymentLinks.updatePaymentLink
      parameters:
        - $ref: '#/components/parameters/x-correlation-id'
        - $ref: '#/components/parameters/x-idempotency-key'
        - $ref: '#/components/parameters/link_id'
      requestBody:
        $ref: '#/components/requestBodies/UpdatePaymentLink'
      responses:
        '200':
          $ref: '#/components/responses/PaymentLinkUpdated'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  parameters:
    x-correlation-id:
      name: x-correlation-id
      in: header
      required: false
      description: >-
        Unique identifier for request tracing. Generated by the client or server
        if not provided.
      schema:
        type: string
        format: uuid
        example: 550e8400-e29b-41d4-a716-446655440000
    x-idempotency-key:
      name: x-idempotency-key
      in: header
      required: false
      description: >-
        Unique key for idempotent request processing. Duplicate requests with
        the same key are safely ignored.
      schema:
        type: string
        format: uuid
        example: baf6a8e2-0c89-46ef-9ca5-faa65b99bcd5
    link_id:
      name: link_id
      in: path
      required: true
      description: Unique identifier of the payment link
      schema:
        type: string
        format: uuid
        example: 550e8400-e29b-41d4-a716-446655440000
  requestBodies:
    UpdatePaymentLink:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UpdatePaymentLinkRequest'
  responses:
    PaymentLinkUpdated:
      description: Payment link updated successfully.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PaymentLink'
    BadRequest:
      description: >
        The request was invalid or malformed.


        Returned when:

        - Request validation fails (missing required fields, invalid field
        formats)

        - Payment details do not match the session (amount, currency, order
        reference mismatch)

        - The operation is not allowed given the current resource state
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: |
        Authentication failed — missing or invalid token.

        Returned when:
        - The JWT bearer token is missing, expired, or has an invalid signature
        - The API key is missing or invalid
        - The authenticated session token is invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: >
        Request blocked by security policy.


        Returned when:

        - A security threat is detected (SQL injection, XSS, NoSQL injection,
        LDAP injection, path traversal)

        - Header injection or suspicious headers are detected

        - The request payload exceeds the maximum allowed size

        - Geo-region validation fails (user country does not match client
        region)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: |
        The requested resource was not found.

        Returned when:
        - The specified resource ID does not exist
        - The path does not match any known endpoint
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: >
        An unexpected error occurred on the server.


        Returned when an unhandled exception or infrastructure failure prevents
        the request from being processed. Retry the request with exponential
        backoff.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    UpdatePaymentLinkRequest:
      type: object
      description: >-
        Request body for updating a payment link. Every field is optional; send
        only

        what should change.


        Two kinds of update are supported, and they can be combined in one
        request:


        1. **Status flip** — send `status` to deactivate or reactivate the link.
           Permitted at any time, including on links that have already been paid.
        2. **Field edits** — any other field. Rejected with `400` once the link
        has
           been used (it has a successful payment or a payment in flight), so a
           customer can never see terms change mid-flow.

        `mode`, `merchant_reference_id` and `max_uses` are immutable after
        creation.
      minProperties: 1
      properties:
        status:
          type: string
          enum:
            - ACTIVE
            - DISABLED
          description: >-
            Target status. Only `ACTIVE` ↔ `DISABLED` is settable here, so this
            enum is

            deliberately narrower than the `PaymentLinkStatus` returned on
            responses:

            `EXPIRED` and `PAID` are server-controlled and requesting either
            returns

            `400`. Sending the link's current status is a no-op.
          example: DISABLED
        redirect_urls:
          $ref: '#/components/schemas/PaymentLinkRedirectUrls'
        three_ds_required:
          type: boolean
          description: Force 3DS authentication for payments made through this link
          example: true
        description:
          type: string
          description: >-
            Free-form description shown to the customer on the hosted checkout
            page
          example: Invoice
        customer:
          $ref: '#/components/schemas/PaymentLinkCustomerRequest'
        metadata:
          type: object
          description: Replaces the stored metadata object wholesale
          additionalProperties: true
          example:
            invoice_id: INV-4471
            sales_rep: rep_88
        channel_id:
          type: string
          description: Channel to attribute the link to
          example: 3d1f9c60-5a72-4e18-b0c4-9a6d2f5e7b13
        expires_at:
          type: string
          format: date-time
          description: ISO 8601 timestamp after which the link stops being payable
          example: '2026-12-31T23:59:59Z'
        amount:
          type: integer
          minimum: 1
          description: Amount in the currency's minor units
          example: 12500
        currency:
          type: string
          description: ISO 4217 currency code
          example: SAR
    PaymentLink:
      type: object
      description: >-
        A shareable payment link. Sending a customer to `hostedUrl` spawns a
        checkout

        session and redirects them to the hosted checkout page.


        > **Casing note:** this response uses **camelCase** property names,
        while the

        > create and update request bodies accept **snake_case**. This is a
        known

        > divergence from the rest of the Lite API surface, which is snake_case
        in

        > both directions. The contract documented here is what the service
        returns

        > today — integrate against camelCase on the response.
      required:
        - id
        - publicToken
        - hostedUrl
        - merchantId
        - mode
        - status
        - amount
        - currency
        - usedCount
        - paidCount
        - failedCount
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
          format: uuid
          description: Unique payment link identifier
          example: 550e8400-e29b-41d4-a716-446655440000
        publicToken:
          type: string
          description: >-
            Opaque token embedded in `hostedUrl`. Safe to share with customers —
            it

            carries no merchant or amount information.
          example: plive_7c9f2a1b8e4d6035
        hostedUrl:
          type: string
          format: uri
          description: >-
            The customer-facing URL. Opening it consumes a slot on the link,
            creates a

            checkout session and redirects the browser to the hosted checkout
            page.

            Share this URL directly with customers.
          example: https://pay.lite.sa/pay/plive_7c9f2a1b8e4d6035
        merchantId:
          type: string
          format: uuid
          description: Merchant that owns the link
          example: 7f3c8b21-0d4e-4a92-9f65-2b8e1c7a4d30
        merchantReferenceId:
          type:
            - string
            - 'null'
          description: >-
            Merchant-supplied reference. Unique per merchant — a second create
            with the

            same value is rejected with `409`, which prevents duplicate links
            for one

            order.
          example: order-2026-0042
        mode:
          $ref: '#/components/schemas/PaymentLinkMode'
        status:
          $ref: '#/components/schemas/PaymentLinkStatus'
        amount:
          type: integer
          minimum: 1
          description: Amount in the currency's minor units (e.g. 10000 = 100.00 SAR)
          example: 10000
        currency:
          type: string
          description: ISO 4217 currency code
          example: SAR
        redirectUrls:
          oneOf:
            - $ref: '#/components/schemas/PaymentLinkRedirectUrls'
            - type: 'null'
          description: Post-checkout redirect targets, or `null` if none were configured
        threeDsRequired:
          type:
            - boolean
            - 'null'
          description: >-
            Whether 3DS authentication is forced for payments made through this
            link
          example: true
        description:
          type:
            - string
            - 'null'
          description: >-
            Free-form description shown to the customer on the hosted checkout
            page
          example: Invoice
        customer:
          oneOf:
            - $ref: '#/components/schemas/PaymentLinkCustomer'
            - type: 'null'
          description: Prefilled customer details, or `null` if none were configured
        metadata:
          type:
            - object
            - 'null'
          description: >-
            Arbitrary merchant metadata, propagated onto every checkout session
            spawned by this link
          additionalProperties: true
          example:
            invoice_id: INV-4471
            sales_rep: rep_88
        channelId:
          type:
            - string
            - 'null'
          description: Channel the link is attributed to
          example: 3d1f9c60-5a72-4e18-b0c4-9a6d2f5e7b13
        expiresAt:
          type:
            - string
            - 'null'
          format: date-time
          description: >-
            When the link stops being payable. Once passed, the link is promoted
            to

            `EXPIRED` on the next read. `null` means the link never expires.
          example: '2026-12-31T23:59:59.000Z'
        maxUses:
          type:
            - integer
            - 'null'
          description: >-
            Ceiling on successful payments. `null` unless the caller set it
            explicitly;

            either way a `SINGLE_USE` link allows exactly one successful
            payment.
          example: 1
        usedCount:
          type: integer
          description: Number of successful payments. Mirrors `paidCount`.
          example: 2
        paidCount:
          type: integer
          description: >-
            Number of payments through this link that reached a successful
            terminal status
          example: 2
        failedCount:
          type: integer
          description: >-
            Number of payments through this link that reached a failed terminal
            status
          example: 1
        lastPaidAt:
          type:
            - string
            - 'null'
          format: date-time
          description: >-
            Timestamp of the most recent successful payment, or `null` if never
            paid
          example: '2026-06-04T09:12:44.000Z'
        createdAt:
          type: string
          format: date-time
          description: Timestamp when the link was created
          example: '2026-06-01T10:30:00.000Z'
        updatedAt:
          type: string
          format: date-time
          description: Timestamp when the link was last updated
          example: '2026-06-04T09:12:44.000Z'
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - timestamp
          properties:
            code:
              type: string
              description: Error code identifying the type of error
              example: PAYMENT_DETAILS_MISMATCH
            message:
              type: string
              description: Human-readable error description
              example: The request was invalid or malformed
            details:
              type: object
              description: Additional error details
            correlationId:
              type: string
              format: uuid
              description: Correlation ID for tracking the request
              example: 550e8400-e29b-41d4-a716-446655440000
            timestamp:
              type: string
              format: date-time
              description: Timestamp when the error occurred
              example: '2024-12-16T10:30:00.000Z'
    PaymentLinkRedirectUrls:
      type: object
      description: >-
        Where the customer's browser is sent after the hosted checkout
        completes.

        Propagated onto every checkout session spawned by this link.


        Both URLs must be `https://` — the hosted checkout returns the customer
        to

        them after a payment, so plaintext destinations are not accepted.
      properties:
        success:
          type: string
          format: uri
          pattern: ^https://
          description: HTTPS URL the customer is returned to after a successful payment
          example: https://merchant.example.com/success
        failure:
          type: string
          format: uri
          pattern: ^https://
          description: >-
            HTTPS URL the customer is returned to after a failed or abandoned
            payment
          example: https://merchant.example.com/failure
    PaymentLinkCustomerRequest:
      type: object
      description: |-
        Customer details prefilled on the hosted checkout page. Every field is
        optional — omit the object entirely to have the customer enter their own
        details at checkout.
      properties:
        id:
          type: string
          description: Merchant's own identifier for the customer
          example: cus_8f1e2a4b
        first_name:
          type: string
          example: Sara
        last_name:
          type: string
          example: Al-Harbi
        email:
          type: string
          format: email
          example: sara@example.com
        phone_country_code:
          type: string
          example: '+966'
        phone_number:
          type: string
          example: '512345678'
        billing_address:
          $ref: '#/components/schemas/BillingAddressRequest'
    PaymentLinkMode:
      type: string
      description: |-
        How many times the link may be paid.

        - `SINGLE_USE` — exactly one successful payment. The link is promoted to
          `PAID` as soon as a payment reaches a terminal successful status.
      enum:
        - SINGLE_USE
      example: SINGLE_USE
    PaymentLinkStatus:
      type: string
      description: >-
        Lifecycle status of the payment link.


        - `ACTIVE` — payable.

        - `DISABLED` — deactivated by the merchant. Reversible via the update
        endpoint.

        - `EXPIRED` — `expires_at` has passed. Applied automatically when the
        link is
          read or listed; not settable by the caller.
        - `PAID` — the usage ceiling has been reached, i.e. the `SINGLE_USE`
        link has
          been paid. Not settable by the caller.

        Only `ACTIVE` ↔ `DISABLED` transitions are accepted on the update
        endpoint.
      enum:
        - ACTIVE
        - DISABLED
        - EXPIRED
        - PAID
      example: ACTIVE
    PaymentLinkCustomer:
      type: object
      description: >-
        Customer details stored on the link and prefilled on the hosted checkout
        page.


        > **Note:** response fields use camelCase, unlike the snake_case
        accepted on

        > the request body. See `PaymentLink` for details.
      properties:
        id:
          type: string
          description: Merchant's own identifier for the customer
          example: cus_8f1e2a4b
        firstName:
          type: string
          example: Sara
        lastName:
          type: string
          example: Al-Harbi
        email:
          type: string
          format: email
          example: sara@example.com
        phoneCountryCode:
          type: string
          example: '+966'
        phoneNumber:
          type: string
          example: '512345678'
        billingAddress:
          $ref: '#/components/schemas/BillingAddress'
    BillingAddressRequest:
      type: object
      description: Customer billing address, prefilled on the hosted checkout page
      properties:
        line1:
          type: string
          description: First line of the street address
          example: 123 High St.
        line2:
          type: string
          description: Second line of the street address
          example: Apartment 5B
        city:
          type: string
          example: Riyadh
        state:
          type: string
          description: State, province or region
          example: Riyadh Province
        postal_code:
          type: string
          example: '11564'
        country:
          type: string
          description: ISO 3166-1 alpha-2 country code
          example: SA
    BillingAddress:
      type: object
      description: >-
        Customer billing address as stored on the link.


        > **Note:** response fields use camelCase, unlike the snake_case
        accepted on

        > the request body. See `PaymentLink` for details.
      properties:
        line1:
          type: string
          example: 123 High St.
        line2:
          type: string
          example: Apartment 5B
        city:
          type: string
          example: Riyadh
        state:
          type: string
          example: Riyadh Province
        postalCode:
          type: string
          example: '11564'
        country:
          type: string
          description: ISO 3166-1 alpha-2 country code
          example: SA
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: API key for service-to-service or merchant authentication.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        JWT Bearer token obtained from user authentication. Passed as
        Authorization: Bearer <token>.

````