Capability library / Application package

Adyen package v1.0.0

Adyen Checkout: read payment links and session results, create payment sessions and payments, and capture or refund payments.

Review state: Reviewed · Distributable: yes, digest matches the release manifest

This page describes AAES Govern’s controls. AAES Operate has private-work permissions, operational reviews and recorded-spend limits; it does not include Govern. About AAES Govern

Before you enable this package

Budgets apply to the amount declared in the task, not to the amount the provider actually sends or moves. The package registers the test host and Checkout API v71. Live use requires the merchant’s prefixed live host, the /checkout/v71 path, matching resource locators and egress allowlists, and a live API key; changing only the host is insufficient.

Read each action's effects and exclusions below. Before installation, also read the complete package requirements, including credential issuance, scope, expiry, and provider permissions. These are deployment prerequisites, not capabilities this package supplies.

Capabilities (6)

Each capability below is one registered operation. The complete package JSON includes its exact network destination allowlist. The repository stores it at packs/adyen.json and embeds a copy in the release binary.

Risk tiers. R0 is the minimum for reads. R2 is the minimum for write, create, update, execute, and invoke. R3 is the minimum for delete, send, pay, deploy, approve, share, and transfer. Operators can raise these levels. A minimum tier does not measure the operation's business or confidentiality risk.

On supported execution paths routed through AAES Govern, the R3 actions listed below require approval by an authorized person. Bypass paths and observation-only registrations are outside that guarantee. A provider's restoration feature does not remove this approval requirement. A provider-side approval, such as approving a GitLab merge request, is also separate from AAES Govern human approval. The capability matrix shows which execution paths are implemented, restricted to lab use, or refused at startup. Live compatibility must be tested in your environment.

Field guide. Endpoint is the service address and request method. Connector is the adapter that makes the call. Custody describes how the credential is held; the credential reference identifies the value to resolve. Data class sets handling requirements: pii means personal data, financial means financial records, and internal means internal organizational data.

adyen.payment_links.read v1.0.0R0

Kind
tool
Action
read
Endpoint
GET https://checkout-test.adyen.com/v71/paymentLinks/LINK_ID
Connector
http
Custody
customer_vault
Credential ref
secret-ref-adyen-api-key
Data class
financial

Read payment links.

Read one payment link's record, including its status. LINK_ID is a placeholder to replace before enabling.

adyen.payment_sessions.result.read v1.0.0R0

Kind
tool
Action
read
Endpoint
GET https://checkout-test.adyen.com/v71/sessions/SESSION_ID
Connector
http
Custody
customer_vault
Credential ref
secret-ref-adyen-api-key
Data class
financial

Read payment session results.

Read the status of one payment session by session id; Adyen's docs require the sessionResult value from the Drop-in/Component as a query parameter. SESSION_ID is a placeholder to replace before enabling.

adyen.payment_sessions.create v1.0.0R3

Kind
tool
Action
pay
Endpoint
POST https://checkout-test.adyen.com/v71/sessions
Connector
http
Custody
customer_vault
Credential ref
secret-ref-adyen-api-key
Data class
financial

Create payment sessions.

Create a payment session for Drop-in/Components or Hosted Checkout. The call creates a session object — money moves only later, when the shopper completes the session — but the session carries the amount and currency and is the documented first call of a payment workflow, so the action is pay at the minimum R3 tier, and pay is one of the designated actions requiring human approval.

The registered cost ceiling is a budget control on the declared amount: the gateway refuses a declared amount above it and commits the ceiling against the task budget; it does not bound the amount the provider request encodes — currency and minor units are the deployment's review.

On supported execution paths mediated by AAES Govern, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.

adyen.payments.create v1.0.0R3

Kind
tool
Action
pay
Endpoint
POST https://checkout-test.adyen.com/v71/payments
Connector
http
Custody
customer_vault
Credential ref
secret-ref-adyen-api-key
Data class
financial

Create payments.

Make a payment. A single call can result in an authorised payment, and where the account or payment method captures automatically, authorisation is followed by capture without a further call — so one call can move money, not merely create an object; the resultCode distinguishes Authorised (funds reserved) from RedirectShopper or an action object (request accepted, shopper step pending) from Refused. The action is pay at the minimum R3 tier, and pay is one of the designated actions requiring human approval.

The registered cost ceiling is a budget control on the declared amount: the gateway refuses a declared amount above it and commits the ceiling against the task budget; it does not bound the amount the provider request encodes.

On supported execution paths mediated by AAES Govern, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.

adyen.payments.capture v1.0.0R3

Kind
tool
Action
pay
Endpoint
POST https://checkout-test.adyen.com/v71/payments/PAYMENT_PSP_REFERENCE/captures
Connector
http
Custody
customer_vault
Credential ref
secret-ref-adyen-api-key
Data class
financial

Capture payments.

Capture an authorised payment: capture is the step that requests transfer of the reserved funds. Adyen processes captures asynchronously and answers with status received — request accepted for processing, not money moved. The subsequent CAPTURE webhook distinguishes acceptance/processing from settlement: success true means the capture request was validated and submitted to the card scheme/processor — in rare cases the scheme can still reject the capture afterwards, even days later, which arrives as a CAPTURE_FAILED webhook, so success true is not the money-moved confirmation and must not be reported as one. A failed validation arrives as CAPTURE with success false and a reason.

The deployment must consume the CAPTURE and CAPTURE_FAILED webhooks (inbound webhooks are not capabilities of this pack) and handle failed captures per Adyen's failure guidance before treating funds as captured. The action is pay at the minimum R3 tier, and pay is one of the designated actions requiring human approval. PAYMENT_PSP_REFERENCE is a placeholder to replace before enabling.

The registered cost ceiling is a budget control on the declared amount and does not bound the amount the provider request encodes.

On supported execution paths mediated by AAES Govern, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.

adyen.payments.refund v1.0.0R3

Kind
tool
Action
pay
Endpoint
POST https://checkout-test.adyen.com/v71/payments/PAYMENT_PSP_REFERENCE/refunds
Connector
http
Custody
customer_vault
Credential ref
secret-ref-adyen-api-key
Data class
financial

Refund payments.

Refund a captured payment: requests that money move back to the shopper. The API acknowledges the request asynchronously — the response status is received (request accepted for processing), not completed shopper receipt. The subsequent REFUND webhook with success true means Adyen's validations passed and the refund was sent to the card scheme — in rare cases the scheme can still reject it afterwards (REFUND_FAILED, possibly days later), and for some payment methods a refund already marked Refunded can later be reversed (REFUNDED_REVERSED: the funds return to the merchant's account); funds can take up to 40 business days to reach the shopper depending on the payment method.

Request success must not be presented as completed shopper receipt: the deployment must consume the REFUND, REFUND_FAILED and REFUNDED_REVERSED webhooks (inbound webhooks are not capabilities of this pack) and handle failure and reversal per Adyen's guidance. The request names the amount in minor units — the currency must match the authorisation and the value may not exceed the captured amount — so full and partial refunds ride on the same call.

The action is pay at the minimum R3 tier, and pay is one of the designated actions requiring human approval. PAYMENT_PSP_REFERENCE is a placeholder to replace before enabling.

The registered cost ceiling is a budget control on the declared amount: the gateway refuses a declared amount above it and commits the ceiling against the task budget; it does not bound the amount the provider request encodes.

On supported execution paths mediated by AAES Govern, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.

Credential reference

The credential field names a reference rather than containing credential material. Packs are designed not to contain secrets; the format checks cover only known credential formats and cannot prove that arbitrary text contains no secrets. Installing a package registers its capabilities. Configure the provider credentials, endpoints, and network access, then test the integration in your environment before enabling it.

Reference
secret-ref-adyen-api-key
Custody
customer_vault
Injection
header (X-API-Key)

Configure the value and injection format specified in the package. Assign responsibility for credential rotation and revocation, restrict provider permissions, and keep credential material out of logs and responses.

Complete credential requirements

An Adyen API key generated in the Customer Area under Developers > API credentials, held in the client's own secret manager. The stored material must be the complete X-API-Key header value — the raw key, with no scheme prefix. Provisioning and rotation are external: keys are created, and can be revoked and regenerated, in the Customer Area, and Adyen does not document automatic expiry for API keys — a key remains valid until revoked or regenerated there, so rotation cadence and revocation-on-suspicion are the deployment's process, and a revoked key fails closed.

The credential's roles are chosen in the Customer Area, and the minimum that makes these capabilities work — the Checkout webservice role for the merchant account in question — is the required set. Test and live keys are different credentials from different Customer Areas: point this reference at a live key only when the deployment has also substituted its prefixed live host and the /checkout/v71 path form (see the pack notes) and is meant to move real money.

Executor hygiene: the resolved material must exist only in the executor process's memory for the moment of injection, must never be written to logs, traces or diagnostics, and must never appear in crash reports; the executor's memory, log and crash handling are otherwise the deployment's review.

Resources

  • adyen-merchant-account (api, financial): https://checkout-test.adyen.com/v71

Technical package and review record

Complete provider requirements and exclusions

The Adyen Checkout API is write-first: it documents no list or get endpoint for payments themselves — payment outcomes are delivered on webhooks and read in the Customer Area — so this pack's reads are the record reads the API actually documents (a payment link, a session result). Hosts are per environment and, for live, per merchant: Adyen documents the test host https://checkout-test.adyen.com and the live pattern https://{PREFIX}-checkout-live.adyenpayments.com/checkout/{version}/{method}, where {PREFIX} — a hex random part plus the company name — comes from the live Customer Area under Developers > API URLs.

This pack registers the test host and version v71; going live means BOTH substituting the deployment's prefixed live authority and changing the path — /v71/... becomes /checkout/v71/... — in every endpoint and in the resource locator, with the egress allowlist updated in step, and pointing the credential reference at a live API key (host-only substitution produces wrong URLs); test and live keys are different credentials from different Customer Areas.

Exclusions, scoped to this pack and version: this pack does not register Adyen's Balance Platform, Management or payout APIs, which use different base hosts and credential roles, nor the Classic Payments API. Stored-payment-method (recurring token) operations also exist within this same Checkout API and version on these same hosts, and the registered /payments and /sessions requests document storePaymentMethod/recurring fields — so the exclusion of stored-payment-method operations is a scoping choice of this pack, not a property of the API surface or of the host, and a deployment that must keep tokenisation out of scope has to constrain those request fields at the wiring layer.

Webhooks are inbound and are not capabilities — but the capture and refund capabilities' outcomes arrive only on webhooks (CAPTURE/CAPTURE_FAILED, REFUND/REFUND_FAILED/REFUNDED_REVERSED), so the deployment must consume them to learn what actually happened. AAES has not been certified by Adyen; the endpoints here are configuration to review and test; the vendor has not endorsed it. Source annotation for https://docs.adyen.com/online-payments/capture/ (retrieved 2026-09-21): manual capture flow; CAPTURE webhook success true is scheme submission, CAPTURE_FAILED can follow even days later Source annotation for https://docs.adyen.com/online-payments/refund/ (retrieved 2026-09-21): asynchronous refund acknowledgement; REFUND, REFUND_FAILED and REFUNDED_REVERSED webhook outcomes

Download the complete package JSON for exact network allowlists, credential requirements, exclusions, and setup notes. Read these requirements before installation.

The full documentation review record is supplied in the evaluation package. The evaluation package runs in your environment and comes only with the paid design partnership. This page reproduces the source links and review block; the full record is available for evaluation. Discuss a design partnership to inspect it before installation.

Review block

This section reproduces the review block recorded in the pack file. The evidence and approval record is separate: for a reviewed pack, it is in the evaluation materials and in the release binary's embedded assets.

Review completed: 2026-09-22

11 sources, retrieved 2026-09-21

Current documentation links are navigation aids. They do not change the package, its historical sources or its review date. Review dates describe a documentation review, not a live integration test. No package is provider-endorsed or yet tested against a live provider tenant.

Release identity

SHA-256 of the pack file bytes: 93a9bf88273fd251156162db4b5a604eca776d20d8419b1760cfe50698713f12

Distributable: yes, digest matches the release manifest. Editing a package changes its release identity. A deployment plan checks its own file digests; it does not restore reviewed status or authenticate approval.