PCI and hosted pages
Card data is collected on Confido-hosted payment pages (or in Confido-hosted iframes when you embed a link). Your servers never handle raw card numbers, which is why Payment Links are a common way to stay out of PCI scope for card entry. Your integration should still follow general security practices (TLS, protecting API tokens, etc.).When a payment link is paid
A payment link’sstatus becomes paid when successful payments cover its outstanding balance. An ACH payment in PENDING counts. The link is paid before that ACH deposits. A later ACH return reverses that payment and can move the link back to unpaid or partially_paid.
Trust vs operating splits
Before creating or sending a Payment Link with a trust or operating split, confirm the Firm has the right default deposit accounts and bank accounts. Use thebankAccountsList / bankAccount queries (see the GraphQL playground) to verify accountCategory (trust vs operating) and IDs. If you specify a trust amount but the Firm has no usable default trust account, account resolution can fail or produce invalid configuration—validate in your integration rather than assuming every ACTIVE Firm has both categories in every edge case.
Surcharging
Surcharging is controlled at the Firm level (whether surcharging is allowed and defaults) and can be overridden per Payment Link via thesurchargeEnabled (or equivalent) field on create/update mutations where exposed. Card-brand rules and state laws on credit-card surcharges change over time; firms should enable surcharging only where permitted. Product-level toggles live in the Confido Legal app; partners can also pass through link-level flags where the API allows. When in doubt, direct the Firm to Confido support or counsel for compliance.
For more details on Payment Links, see these knowledge articles
paymentLinkCreate
Use thepaymentLinkCreate mutation to create a Payment Link with one or more
bank-account amounts. Requires the FIRM_ADMIN or FIRM_USER role. For
complete field details, see the GraphQL Playground.
Input
amount is in cents and must be at least 1. Each
bankAccountId must belong to the firm, and bank account ids must be unique
within the list. Optional surchargeRegion is stored on that amount.
clientId
The client the Payment Link belongs to. Must belong to the firm.
matterId
Optional matter for the Payment Link. When set, it must belong to the same
client and firm.
memo
Optional. Pass null to store no memo. An empty string is rejected.
metadata
Optional Record<string, string> stored on the Payment Link.
partialPaymentAllowed
Optional override for partial payments. Pass null to use the firm default.
Omit the field to leave the entity default unset.
paymentMethodsAllowed
Optional list of methods payers may use (ACH, CREDIT, DEBIT). Check is
not accepted. When omitted, the firm default methods apply. When present, the
list must not be empty.
sendReceipts
Optional boolean. When omitted, the Payment Link uses the entity default
(true). When set, pass true or false. null is rejected.
surchargeEnabled
Optional. Omit this field or pass null to store no override on the link.
Pass true or false to store that choice on the link. On the created
Payment Link, surchargeEnabled always reads back as the effective hierarchy
boolean; usingDefaultSurchargeEnabled is a separate read-only field that is
true when no override was stored.
paymentLinkGet
Use thepaymentLinkGet query to read one Payment Link by id. Requires the
FIRM_ADMIN or FIRM_USER role. For complete field details, see the GraphQL
Playground.
id
The Payment Link to load. Must belong to the firm.
Result
Returns { paymentLink }. paymentLink is the Payment Link for that id.
paymentLinkUpdate
Use thepaymentLinkUpdate mutation to update a Payment Link. Requires the
FIRM_ADMIN or FIRM_USER role. Omitted fields stay as stored. For complete
field details, see the GraphQL Playground.
Input
null to leave
existing amounts unchanged. An empty list is rejected. Each amount is in
cents and may be 0. Bank account ids must be unique and belong to the firm.
An amount in the list updates the matching bank account, a new bank account is
added, and amounts left off the list are removed.
surchargeRegion (on each amount)
When amounts is submitted, each amount’s region comes from this field only.
Omit or pass null to store no region. Pass a region to store that value.
Omit does not keep a previously stored region for that bank account.
clientId
Omit to keep the current client. A sent id must belong to the firm. null is
rejected.
matterId
Omit to keep the current matter. Pass null to clear it. A sent id must belong
to the client that will be stored and to the firm.
memo
Omit to keep the current memo. Pass null to clear it. An empty string is
rejected.
metadata
A Record<string, string>. Omit to keep the current metadata. Pass null to
clear it.
partialPaymentAllowed
Omit to keep the stored value. Pass null to use the firm default.
paymentMethodsAllowed
Methods payers may use (ACH, CREDIT, DEBIT). Check is not accepted. Omit
to keep the stored list. Pass null to use the firm default methods. An empty
list is rejected.
sendReceipts
Omit to keep the stored value. null is rejected.
surchargeEnabled
Omit to keep the stored value. Pass null to clear it and resolve surcharge at
payment time. Pass true or false to store that choice.