# Submit refund

> POST `/secure/refunds/submit`
> Part of the Payments API reference. Source: https://hub.ozow.com/api-reference/payments-api/post-secure-refunds-submit/

Server: `https://api.ozow.com` (Production)

Other environments: `https://stagingapi.ozow.com` (Staging)

Submit refunds to Ozow for processing.

## Authentication

- `BearerToken` (HTTP bearer)
  - The token generated by the `Get API token` operation. The same token is used for every request until it expires.

## Request body

An array of refund requests.

**application/json**

array of RefundRequest

**application/x-www-form-urlencoded**

- `transactionId` (string, uuid, required) - The transaction identifier. This is the identifier for the payment that was originally processed on Ozow.
- `amount` (number, double, required) - The amount that needs to be refunded. This can be less than the original transaction amount but not more.
- `refundReason` (string, max length 500) - The reason for the refund.
- `notifyUrl` (string, uri, max length 500) - The URL Ozow will send a notification to once the refund has been finalised.
- `hashCheck` (string, required, max length 150) - SHA512 hash proving the request has not been altered after you generated it. Concatenate four fields in this order, with no separator, then append your private key: 1. `transactionId` 2. `amount`, formatted with two decimal places, so `100.00` 3. `refundReason` 4. `notifyUrl` Hash the result with SHA512 and send the digest as lowercase hexadecimal. **Unlike the payment request hash, do not convert the concatenated string to lowercase before hashing.** Refunds hash the string exactly as you built it, so the case of your reason and your notify URL matters. Only the digest is compared case insensitively.
- `isRtc` (boolean, default false) - Whether the refund should be processed as an RTC refund.

## Responses

### 200 OK

**application/json**

- `refundId` (string, uuid, required) - The identifier for the refund that was created. No identifier is returned if there was an error creating the refunds.
- `transactionId` (string, uuid, required) - The transaction identifier. This will correspond to one of the transaction identifiers passed through in the request.
- `refundAmount` (string, required) - The refund amount.
- `errors` (array of string) - Validation errors for the specific refund.

**application/xml**

`RefundResponse`, the same schema listed in full earlier in this document. Its own page: https://hub.ozow.com/api-reference/payments-api/schemas/refund-response.md

### 400 Bad Request. The operation could not be carried out. The body is a message rather than a structured error.

string

Example (example 1):

```json
There was an error processing your request
```

### 401 Unauthorized. The `ApiKey` header is missing or does not match the site, or for a `Secure` operation the bearer token is missing, expired or invalid.

string

Example (example 1):

```json
API key is missing or invalid.
```