Initial step with the chosen method

POST /Cards/Sbp/create

The token travels in the Authorization: Bearer <token> header, as the widget document requires (the iframe URL itself carries it as ?token=). ?method= picks sbp, alfapay or sberpay. The step follows the subscription terms, not the method: the first period is paid together with the binding; when BillingStartTimeUtc is in the future the first payment is deferred and only sbp is offered — a binding without a charge. T-Pay is temporarily off (400 METHOD_UNAVAILABLE).

Idempotent: a repeated call with the same method returns the operation already started — no second paid authorization. Another method for a started operation is rejected with 409 METHOD_LOCKED; the response carries can_change_method: false.

The token is verified before the database is touched; an unknown one yields 401, not 404 — otherwise session identifiers could be enumerated.

⚠️ The bodies are a sandbox contract (the document describes only the addresses and the meaning). binds_account: true — every method binds the account; is_first_payment — whether the first period is paid in this step. sandbox_confirm_url exists in the sandbox only.

Sandbox

Response example


{
  "success": true,
  "data": {
    "reference": "1000000001",
    "method": "sbp",
    "screen": "qr",
    "deeplink_url": "https://subs-sandbox.digitalspb.com/Cards/TB/0d0f3c58-9b1e-4a77-9a0c-000000000003/sbp/confirm",
    "qr_payload": "https://subs-sandbox.digitalspb.com/Cards/TB/0d0f3c58-9b1e-4a77-9a0c-000000000003/sbp/confirm",
    "price": {
      "amount": "10.00",
      "currency": "RUB",
      "vat_included": true
    },
    "merchant_order_id": "ORDER-000000001",
    "expires_at": "2026-09-21T12:00:00Z",
    "poll_interval_seconds": 5,
    "sandbox_confirm_url": "https://subs-sandbox.digitalspb.com/Cards/TB/0d0f3c58-9b1e-4a77-9a0c-000000000003/sbp/confirm",
    "binds_account": true,
    "is_first_payment": true,
    "can_change_method": false
  }
}

Response codes

Code	Description
`201`	QR data
`401`	The token did not match
`409`	The operation has already been started with another method

Initial step with the chosen method

Sandbox

Prod

Response codes