Skip to content
Sawfish Docs

Process Payment

POST https://api-staging.sawfish.com.au/graphql

Processes a payment via the Sawfish platform. It will try to validate the credit card details before processing the payment. An error may be returned regarding an invalid credit card to avoid processing the payment.

Headers

Section titled “Headers”
Header Type Required
x-jwt-token string ✅

Requires a valid token (expires every 10 minutes - refresh required).

Mutation

Section titled “Mutation”
mutation processPaymentRequest($input: ProcessPaymentRequestInput!) {
  processPaymentRequest(input: $input) {
    amount
    payment_gateway_fee
    paid_at
    status {
      name
    }
    uuid
  }
}

Example Request

Section titled “Example Request”
Terminal window
curl --request POST \
     --url https://api-staging.sawfish.com.au/graphql \
     --header 'Accept: application/json' \
     --header 'Content-Type: application/json' \
     --header 'x-jwt-token: your-jwt-token' \
     --data '
{
  "query": "mutation processPaymentRequest($input: ProcessPaymentRequestInput!) { processPaymentRequest(input: $input) { amount payment_gateway_fee paid_at status { name } uuid } }",
  "variables": {
    "input": {
      "amount": 100,
      "fees": 1.75,
      "credit_card": {
        "full_name": "John Doe",
        "card_number": "4444333322221111",
        "expiry_month": "01",
        "expiry_year": "30",
        "cvv": "123"
      },
      "contact": {
        "first_name": "John",
        "last_name": "Doe",
        "email": "j.doe@example.com",
        "country": "Australia"
      },
      "payment_reference": {
        "description": "Invoice #1234",
        "reference_no": "INV-1234"
      },
      "metadata": { "invoice_id": "1234" }
    }
  }
}
'

payment_reference (with description and reference_no) is required. Expiry month and year are each 2 digits. Instead of raw card details you can pass credit_card.card_account_uid from a prior fee calculation. metadata is optional JSON echoed back in the webhook.

Device screening (optional)

Section titled “Device screening (optional)”

Two optional fields improve fraud screening on card payments:

Field Type Description
zai_device_id string A device fingerprint captured from the payer’s browser. When you take card details through the React widget, the onPaymentSuccess and onCardAccountCreated callbacks hand you { deviceId, ipAddress } - pass deviceId through here.
ip_address string The payer’s IP address. Defaults to the requesting IP when omitted - only set it when your server calls the API on the payer’s behalf, so the payer’s real IP is screened rather than your server’s.

Response

Section titled “Response”
{
  "data": {
    "processPaymentRequest": {
      "amount": 100,
      "payment_gateway_fee": 1.75,
      "paid_at": "2025-09-17T08:35:00Z",
      "status": {
        "name": "processing"
      },
      "uuid": "payment-uuid-1234"
    }
  }
}

The initial status confirms the payment request has been initiated. The final status (success or failure) is delivered via the payment confirmation webhook.

See Interfaces for the full ProcessPaymentRequestInput definition, and Error Handling for validation error examples.