Mint a one-time link for the person being paid

post

https://api.avvio.xyz/business/api/v1/payments/organizations/{orgId}/payout-links

The alternative to collecting bank details yourself. You send the amount
and who it is for on your side; we return a URL. The recipient enters
their own account details, so you never hold them.

Your Idempotency-Key is carried onto the link, so the payout it
eventually creates deduplicates against YOUR retry — not merely against
ours. Minting the same link twice cannot become two payments even though
a stranger spends them minutes apart.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

orgId

string

required

length ≥ 1

The opaque organization id issued to you, normally CUID-shaped (for
example cmsx…). It is not an org_-prefixed alias. Pass it unchanged
in every organization-scoped path.

Body Params

amount

string

required

^\d+(\.\d{1,2})?$

USD debit amount as a decimal string with at most two fractional digits.

destinationCurrency

string

required

^[A-Za-z]{3}$

ISO 4217 payout currency; normalized to uppercase.

endUserId

string

required

length between 1 and 128

Your id for the person being paid.

reference

string

length between 1 and 128

^[A-Za-z0-9 :._-]*$

expiresInMinutes

integer

1 to 10080

Defaults to 60

Whole minutes. Defaults to 60 and is capped at 7 days (10,080 minutes).

Headers

Idempotency-Key

string

required

length between 1 and 255

^[A-Za-z0-9_.:-]+$

A unique value per logical operation, 1-255 chars of A-Z a-z 0-9 _ . : -.

Reuse it to retry. Same key with the same body replays the stored
response; same key with a different body is a 409, because
answering with the first call's result would hand you a receipt for a
payout you did not request. A 4xx releases the key, so you can fix the
body and reuse it.

Reuse it — do not generate one per attempt. A key minted per attempt
defeats replay entirely: every retry looks like a new request, so every
retry pays. We also watch for an identical body arriving under a
different key within 15 minutes and refuse it with
DUPLICATE_REQUEST_DETECTED.

Records are kept for 7 days. That is a retention window, not a
correctness one — there is no path where an expired key is re-executed.

Responses

201The link.

401Missing, invalid, or revoked key — or a key on a route that does not accept one.

403Valid key, wrong organization.

409Either the key was reused with a different body, or an identical request is still in flight. The second is safe to retry after a backoff; the first means you should use a new key.