That's where decisions around consistency kick in. You need to decide if you absolutely do not want to serve any API call unless you are sure they've been paid

That's where decisions around consistency kick in. You need to decide if you absolutely do not want to serve any API call unless you are sure they've been paid for, in which case you have to create a commit transaction on that account for each call. Or you decide how much you can let a would be rotten customer get away with, and uses queues which leads to eventual consistencies.