Create a Contractor payroll run and finalize it in one call. The body is the same as a Contractor create, except that externalId is required. The run is funded and its payables start paying out, as with POST /payments/payroll-runs/{payrollRunId}/finalize. Returns 201 with the new run.

Replaces V1/V2 POST /payments/pay-approved. To pay every approved payable, send {"type": "Contractor", "currency": "USD", "selection": {"scope": "ApprovedPayables"}, "externalId": "<your id>"}. A run pays payables in one currency, so make one call per currency.

externalId identifies the request. If the account already has a payroll run with this externalId, the call creates, funds and changes nothing, and answers by that run:

• Same type, currency and selection, and the run is Paid, Processing or Failed:
  200 with the run.

• Same request, and the run is a Draft: 409 ResourceConflict with detailCode
payments.PayrollRunExternalIdDraftExists; its detail names the run. The Draft still
  holds its payables, so nobody is paid until you finalize it
  (POST /payments/payroll-runs/{payrollRunId}/finalize) or delete it, then retry.

• Same request, and the run is Cancelled: 409 ResourceConflict with detailCode
payments.PayrollRunExternalIdCancelled. Use a new externalId.

• A different type, currency or selection: 409 ResourceConflict with detailCode
payments.PayrollRunExternalIdConflict.

This is not an upsert: the existing run is never updated. A new externalId starts a new payroll; use one to pay again after a Failed run.

Retrying: after a 5xx, a timeout or no response, send the same body with the same externalId. The funding may already have happened, and the same externalId cannot pay twice. A retry with the same Idempotency-Key within 10 minutes returns 409 IdempotencyKeyConflict with retryAfter (seconds to wait). A retry with a new Idempotency-Key returns 409 ResourceConflict while the first call is still running, and then answers by the run as described above (200 once it was funded or failed).

Outcomes when the call does not return a funded run. In each case no Draft run is left holding payables:

• No payroll funding source, or an account that cannot fund payroll yet: 422, normally
  before any run is created.

• No eligible payable matches the selection: 422 with detailCode
payments.PayrollRunNoEligiblePayablesMatched; no run is created.

• A selected payable stopped being payable after the run was created (paid, changed,
  unapproved, or claimed by another run): the run is funded without it. If none is left,
  the call returns 422 with detailCode payments.PayrollRunNoEligiblePayablesAtFinalize
  and the run is deleted.

• Funding failed: the run is left Failed, its payables are released, and the 422
  carries the run's failure reason as its detailCode. List that run with
  filter[failureCode][anyOf] or filter[externalId][eq].

• Another create-and-finalize call is running for the account: 409 ResourceConflict.

• A payable changed at the moment funding started (a race): 409 ResourceConflict, and
  the run is deleted, so a retry with the same externalId tries again.

• Funding started but its outcome could not be confirmed: the run is left Processing and
  the call returns 409 ResourceConflict with detailCode
payments.PayrollRunOutcomeUnknown; its detail names the run. Do not run the payroll
  again for these payables: get the run, and contact support if it stays Processing.

Requires a session with recent MFA step-up for HighRiskWriteAction. If step-up is missing or expired, this operation returns 403 StepUpMfaRequired; create and verify an MFA challenge at /v3/platform/mfa-challenges with requiredFor: "HighRiskWriteAction", then retry.