> ## Documentation Index > Fetch the complete documentation index at: https://docs.kordio.io/llms.txt > Use this file to discover all available pages before exploring further. # Report that the money moved > Your rail settled the payment. Moves the intent from `pending` to `executed` and keeps the reservation spent. Reporting is not optional. An intent left `pending` holds its budget until the budget closes. ## OpenAPI ````yaml /agents/api-reference/openapi.yaml post /control/v1/agent/payment_intents/{id}/complete openapi: 3.1.0 info: title: Kordio Agent Control API version: 1.0.0 description: > The control layer decides whether an agent may take an action before it takes it, and signs the answer so the executor can verify authority without trusting the agent. Two credentials reach this API and they are deliberately not interchangeable. An **agent key** (`krt_live_...` or `krt_test_...`) is what an agent carries. It reaches `/v1/agent/*` and can ask for authorization, but it can never write policy. An agent able to widen its own limits is not governed by them. An **identity token** is what a person or your backend carries. It reaches `/v1/workspaces/{workspace_slug}/*` and manages agents, policy, approvals and members. It can never authorize an action as an agent. Cosignature verification needs no credential at all. contact: name: Kordio support email: support@kordio.io license: name: Proprietary servers: - url: https://api.kordio.io description: Production security: - AgentKey: [] tags: - name: Actions description: >- The authorization call that goes in front of a spend, and the outcome reports that settle or release its reservation. Agent key. - name: Budgets description: Budget envelopes for one agent run. Agent key. - name: Spend tokens description: >- Single-use, pre-authorized ceilings an agent mints against its own session and presents later on a payment. Agent key. - name: Payment intents description: Authorize a payment. You settle it and report back. Agent key. - name: Cosignatures description: Verify a signed authorization. Unauthenticated. - name: Agents description: Scoped identities for agent workloads. Identity token. - name: Policies description: The rules attached to an agent. Identity token. - name: Policy modules description: Named, reusable rule sets a policy imports by name. Identity token. - name: Policy previews description: Evaluate a draft policy without saving it. Identity token. - name: Approvals description: >- The queue of intents a rule held for a person, and the calls that resolve them. Identity token. - name: Funds description: Committed, held and unprojected spend across a workspace. Identity token. - name: Audit events description: >- The append-only record of everything the control layer did. Identity token. - name: Webhook endpoints description: Control-layer event delivery. Identity token. - name: Workspaces description: Workspace lifecycle and export. Identity token. - name: Members description: Memberships and invitations. Identity token. - name: Billing description: >- Plan, entitlements and prepaid volume. Console-facing; agents never call these. Identity token. externalDocs: description: Control layer guides url: https://docs.kordio.io/agents paths: /control/v1/agent/payment_intents/{id}/complete: post: tags: - Payment intents summary: Report that the money moved description: > Your rail settled the payment. Moves the intent from `pending` to `executed` and keeps the reservation spent. Reporting is not optional. An intent left `pending` holds its budget until the budget closes. operationId: completePaymentIntent parameters: - $ref: '#/components/parameters/PathId' responses: '200': description: The executed intent. content: application/json: schema: $ref: '#/components/schemas/PaymentIntentEnvelope' '401': $ref: '#/components/responses/AgentUnauthorized' '404': $ref: '#/components/responses/NotFoundForAgent' '422': description: >- The intent is not in a state that can be settled. Only `pending` intents settle, so a payment still held for a person is refused here. content: application/json: schema: $ref: '#/components/schemas/Error' security: - AgentKey: [] components: parameters: PathId: name: id in: path required: true schema: type: string format: uuid schemas: PaymentIntentEnvelope: type: object required: - data properties: data: $ref: '#/components/schemas/PaymentIntent' Error: type: object required: - error properties: error: type: object required: - message properties: message: type: string description: For humans. Do not switch on it. code: type: string nullable: true description: >- Stable where present, `null` otherwise. Only a defined set of failures carry a code. enum: - runtime_key_required - invalid_runtime_key - identity_token_required - invalid_identity_token - budget_ceiling - parent_budget_exhausted - already_consumed - idempotency_conflict - insufficient_role - idempotency_key_required - authorization_required - rate_limited - billing_unavailable - invalid_signature - identity_unavailable - identity_not_configured - mfa_required - email_verification_required PaymentIntent: type: object properties: id: type: string format: uuid workspace_id: type: string format: uuid agent_id: type: string format: uuid budget_id: type: string format: uuid spend_token_id: type: string format: uuid nullable: true amount_cents: type: integer currency: type: string counterparty: type: string nullable: true state: type: string enum: - pending - requires_approval - executed - failed - denied failure_reason: type: string nullable: true resolved_by_sub: type: string nullable: true resolved_at: type: string format: date-time nullable: true idempotency_key: type: string trace_id: type: string nullable: true ledger_transaction_id: type: string nullable: true decision_context: type: object additionalProperties: true nullable: true created_at: type: string format: date-time updated_at: type: string format: date-time responses: AgentUnauthorized: description: >- Missing (`runtime_key_required`) or unrecognised (`invalid_runtime_key`) agent key. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: message: Agent key is required code: runtime_key_required NotFoundForAgent: description: >- The record does not belong to this agent. Kordio does not confirm existence across a tenancy boundary, so this is a `404` rather than a `403`. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: AgentKey: type: http scheme: bearer description: >- An agent API key, `krt_live_...` or `krt_test_...`, shown exactly once at creation. Kordio stores only a digest. This credential can ask for authorization and can never write policy. ````