Finalize a payroll run for payment. What happens depends on the run's type.

Employee: moves a PendingApprovals run to Finalized. Approvals close and the amounts lock; no money moves yet, and the run is paid on its schedule. An account can have only one Employee run Finalized or Processing at a time; finalizing another returns 409 until that run is paid.

Contractor: funds the run and starts paying its payables, moving it from Draft to Paid once funding succeeds. The account needs a payroll funding source (payrollSettings.defaultFundingSource, set with PATCH /payments/payer-settings); the account's defaultPaymentMethod does not fund a payroll run, so without a payroll funding source the call returns 422. Payables that are no longer approved, open, or in the run's currency are removed from the run and not paid. Retrying the call is safe; a run that has already moved past Draft returns 409.

Returns 409 when the run is not in a status that can be finalized.

Requires a session with recent MFA step-up for HighRiskWriteAction. If step-up is missing or expired, this operation returns 403 StepUpMfaRequired; create and verify an MFA challenge at /v3/platform/mfa-challenges with requiredFor: "HighRiskWriteAction", then retry.