Caisse

Retour du prestataire (navigateur)

GET/checkout/{id}/return

Incoming query and Referer are stripped at the gateway before frontend rendering or logging. Return values never establish financial success. A subsequent metadata request requires buyer authority. Requires the HttpOnly cookie bound to this checkout ID, acquired by the one-use launch form. Merchant sessions and API keys do not grant buyer authority. Cookie names are per-session and cannot be templated by an OpenAPI security scheme.