The journey. The order is created awaiting checkout (status: "AwaitingCheckout") and
qrCodeUrl is the hosted page to encode in your QR: the customer scans it and completes phone
verification, identity, the credit decision, plan choice, contract and the first instalment there.
Nothing is decided at this call. The page is valid for two hours.

Creates a scan-to-pay QR instalment session — same model as POST /pay/session/create,
but returns QR code data the customer scans to complete checkout on their own device.
Requires scope orders:write.

Idempotency: send an Idempotency-Key header (a fresh UUID v4 per order attempt) and reuse it
on retries — a retry replays the original answer (Idempotent-Replay: true) instead of creating a
second order. 409 REQUEST_IN_PROGRESS while the first attempt is still running (retry shortly);
422 IDEMPOTENCY_KEY_REUSED if the same key is sent with a different body.

Errors: 400 VALIDATION_ERROR, 400 MERCHANT_REQUIRED (an admin token that named no
merchant — see /pay/session/create), 401, 403 (missing orders:write),
409 MERCHANT_SUSPENDED, 429 rate limited.

Return URLs (optional): merchantUrl { success, failure, cancel, notification } — where the
hosted checkout sends the customer afterwards. Same rules as /pay/session/create: absolute, at
most 1024 characters, no fragment; https, http only on localhost / 127.0.0.1, or a custom
app scheme; success and failure together, cancel defaulting to failure, notification
reserved. The page appends orderId, orderReferenceId and status to the URL's own query
string. Confirm with GET /merchant/orders/{orderId} before treating the order as paid.