diff --git a/src/Sylius/Bundle/ApiBundle/Resources/config/validation/AddPaymentRequest.xml b/src/Sylius/Bundle/ApiBundle/Resources/config/validation/AddPaymentRequest.xml
index 9486f588a3..2b0b65e36c 100644
--- a/src/Sylius/Bundle/ApiBundle/Resources/config/validation/AddPaymentRequest.xml
+++ b/src/Sylius/Bundle/ApiBundle/Resources/config/validation/AddPaymentRequest.xml
@@ -13,6 +13,11 @@
 
 <constraint-mapping xmlns="http://symfony.com/schema/dic/constraint-mapping" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://symfony.com/schema/dic/constraint-mapping http://symfony.com/schema/dic/services/constraint-mapping-1.0.xsd">
     <class name="Sylius\Bundle\ApiBundle\Command\Payment\AddPaymentRequest">
+        <constraint name="Sylius\Bundle\ApiBundle\Validator\Constraints\OrderPaymentRequestEligibility">
+            <option name="groups">
+                <value>sylius</value>
+            </option>
+        </constraint>
         <constraint name="Sylius\Bundle\ApiBundle\Validator\Constraints\ChosenPaymentRequestActionEligibility">
             <option name="groups">
                 <value>sylius</value>
diff --git a/src/Sylius/Bundle/ApiBundle/Resources/config/validation/UpdatePaymentRequest.xml b/src/Sylius/Bundle/ApiBundle/Resources/config/validation/UpdatePaymentRequest.xml
new file mode 100644
index 0000000000..e57715ca6e
--- /dev/null
+++ b/src/Sylius/Bundle/ApiBundle/Resources/config/validation/UpdatePaymentRequest.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+
+ This file is part of the Sylius package.
+
+ (c) Sylius Sp. z o.o.
+
+ For the full copyright and license information, please view the LICENSE
+ file that was distributed with this source code.
+
+-->
+
+<constraint-mapping xmlns="http://symfony.com/schema/dic/constraint-mapping" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://symfony.com/schema/dic/constraint-mapping http://symfony.com/schema/dic/services/constraint-mapping-1.0.xsd">
+    <class name="Sylius\Bundle\ApiBundle\Command\Payment\UpdatePaymentRequest">
+        <constraint name="Sylius\Bundle\ApiBundle\Validator\Constraints\OrderPaymentRequestEligibility">
+            <option name="groups">
+                <value>sylius</value>
+            </option>
+        </constraint>
+    </class>
+</constraint-mapping>
diff --git a/tests/Api/DataFixtures/ORM/payment_request/order_not_placed.yaml b/tests/Api/DataFixtures/ORM/payment_request/order_not_placed.yaml
new file mode 100644
index 0000000000..edcd1ce2d8
--- /dev/null
+++ b/tests/Api/DataFixtures/ORM/payment_request/order_not_placed.yaml
@@ -0,0 +1,18 @@
+Sylius\Component\Core\Model\Payment:
+    payment_not_placed:
+        method: "@payment_method_cash_on_delivery"
+        order: "@order_not_placed"
+        state: "new"
+        amount: 1000
+        currencyCode: "USD"
+
+Sylius\Component\Core\Model\Order:
+    order_not_placed:
+        channel: "@channel_web"
+        currencyCode: "USD"
+        localeCode: "en_US"
+        state: "cart"
+        paymentState: "cart"
+        shippingState: "cart"
+        checkoutState: "cart"
+        tokenValue: "notPlacedOrderToken"
diff --git a/tests/Api/DataFixtures/ORM/payment_request/payment_request_not_placed.yaml b/tests/Api/DataFixtures/ORM/payment_request/payment_request_not_placed.yaml
new file mode 100644
index 0000000000..fc4f10c285
--- /dev/null
+++ b/tests/Api/DataFixtures/ORM/payment_request/payment_request_not_placed.yaml
@@ -0,0 +1,7 @@
+Sylius\Component\Payment\Model\PaymentRequest:
+    payment_request_not_placed:
+        __construct: [ '@payment_not_placed', '@payment_method_cash_on_delivery' ]
+        state: "new"
+        action: "capture"
+        payload: null
+        responseData: []
diff --git a/tests/Api/Shop/PaymentRequestsTest.php b/tests/Api/Shop/PaymentRequestsTest.php
index 431705b518..c6a42c4cd5 100644
--- a/tests/Api/Shop/PaymentRequestsTest.php
+++ b/tests/Api/Shop/PaymentRequestsTest.php
@@ -191,6 +191,58 @@ final class PaymentRequestsTest extends JsonApiTestCase
         ]);
     }
 
+    #[Test]
+    public function it_does_not_create_a_payment_request_for_an_order_that_is_not_placed(): void
+    {
+        $fixtures = $this->loadFixturesFromFiles([
+            'channel/channel.yaml',
+            'payment_method.yaml',
+            'payment_request/order_not_placed.yaml',
+        ]);
+
+        /** @var PaymentInterface $payment */
+        $payment = $fixtures['payment_not_placed'];
+
+        $this->client->request(
+            method: 'POST',
+            uri: '/api/v2/shop/orders/notPlacedOrderToken/payment-requests',
+            server: $this->headerBuilder()->withJsonLdAccept()->withJsonLdContentType()->build(),
+            content: json_encode([
+                'paymentId' => $payment->getId(),
+                'paymentMethodCode' => 'CASH_ON_DELIVERY',
+            ], \JSON_THROW_ON_ERROR),
+        );
+
+        $this->assertResponseContainsViolations([
+            ['propertyPath' => '', 'message' => 'Payment requests can only be created for placed orders.'],
+        ]);
+    }
+
+    #[Test]
+    public function it_does_not_update_a_payment_request_for_an_order_that_is_not_placed(): void
+    {
+        $fixtures = $this->loadFixturesFromFiles([
+            'channel/channel.yaml',
+            'payment_method.yaml',
+            'payment_request/order_not_placed.yaml',
+            'payment_request/payment_request_not_placed.yaml',
+        ]);
+
+        /** @var PaymentRequestInterface $paymentRequest */
+        $paymentRequest = $fixtures['payment_request_not_placed'];
+
+        $this->client->request(
+            method: 'PUT',
+            uri: sprintf('/api/v2/shop/payment-requests/%s', $paymentRequest->getHash()),
+            server: $this->headerBuilder()->withJsonLdAccept()->withJsonLdContentType()->build(),
+            content: json_encode(['payload' => ['some' => 'payload']], \JSON_THROW_ON_ERROR),
+        );
+
+        $this->assertResponseContainsViolations([
+            ['propertyPath' => '', 'message' => 'Payment requests can only be created for placed orders.'],
+        ]);
+    }
+
     /**
      * @param array<string> $fixturesPaths
      *