Policy

Get your policy

Returns your organization's caps, approval threshold, features and rate limits.

GET

GET/payments/organizations/{orgId}/policy

curl -s "$AVVIO_BASE_URL/payments/organizations/$AVVIO_ORG_ID/policy" \
  -H "x-api-key: $AVVIO_API_KEY"

const res = await fetch(`${process.env.AVVIO_BASE_URL}/payments/organizations/${process.env.AVVIO_ORG_ID}/policy`, {
  headers: {
    'x-api-key': process.env.AVVIO_API_KEY,
  },
});
console.log(res.status, await res.json());

import os
import requests

res = requests.get(
    f"{os.environ['AVVIO_BASE_URL']}/payments/organizations/{os.environ['AVVIO_ORG_ID']}/policy",
    headers={
        "x-api-key": os.environ["AVVIO_API_KEY"],
    },
)
print(res.status_code, res.json())

200OK

{
  "organizationId": "cmsx0h2k900a1n11ib3qz9v42",
  "mode": "test",
  "features": [
    "developer",
    "mass_payouts"
  ],
  "limits": {
    "maxSinglePayoutUsd": "5000.00",
    "maxDailyPayoutUsd": "25000.00",
    "maxDailyPerEndUserUsd": null
  },
  "approvals": {
    "thresholdUsd": "1000.00",
    "requiredApprovals": 2,
    "appliesTo": [
      "payouts",
      "batches",
      "payout_links"
    ]
  },
  "purposeOfPayment": {
    "requiredForCurrencies": [
      "BRL",
      "CNY",
      "GHS",
      "INR"
    ]
  },
  "fees": {
    "payout": {
      "bps": null,
      "fixedUsd": null,
      "byCurrency": {},
      "note": "Not published before a quote: the fee is priced inside each quote. Read `fee` on the quote or the payout."
    }
  },
  "rateLimits": {
    "default": 100,
    "payouts": 600,
    "batches": 30,
    "reads": 600
  },
  "idempotency": {
    "required": true,
    "replayWindowDays": 7,
    "nearDuplicateWindowMinutes": 15
  },
  "links": {
    "corridors": "/recipients/cmsx0h2k900a1n11ib3qz9v42/corridors",
    "events": "/payments/organizations/cmsx0h2k900a1n11ib3qz9v42/events",
    "balanceTransactions": "/payments/organizations/cmsx0h2k900a1n11ib3qz9v42/balance_transactions"
  }
}

{
  "type": "UNAUTHORIZED",
  "status": 401,
  "detail": "Invalid API key",
  "resolution": "Check the API key was copied whole and has not been revoked.",
  "requestId": "req-9bz",
  "message": "Invalid API key",
  "statusCode": 401
}

{
  "type": "FORBIDDEN",
  "status": 403,
  "detail": "This API key cannot access that organization",
  "resolution": "This key is scoped to a different organization.",
  "requestId": "req-9d0",
  "message": "This API key cannot access that organization",
  "statusCode": 403
}

{
  "type": "RATE_LIMITED",
  "status": 429,
  "detail": "ThrottlerException: Too Many Requests",
  "resolution": "Back off and retry after the Retry-After interval.",
  "requestId": "req-9e1",
  "message": "ThrottlerException: Too Many Requests",
  "statusCode": 429
}

Path parameters

orgIdstringRequired
The opaque organization id issued to you, normally CUID-shaped (for example cmsx…). It is not an org_-prefixed alias. Pass it unchanged in every organization-scoped path.

Behavior

Read this first. Everything a client needs to know about its own organization before it sends money, in one call: the payout caps (null means no cap), the approval threshold and how many approvers a held payout needs, which features are on (mass_payouts for batches, developer for webhook endpoints), the rate-limit buckets per minute, the idempotency windows, the currencies that require a purposeOfPayment, and where to read corridors, events and the ledger.

Every value is what the server enforces with, read from your organization at request time, not a published table. A test key reads the sandbox's caps and approval policy (they are set per environment), features from the live organization the sandbox belongs to, and mode: test. A read-only key may read this.

Responses

200The policy your organization is under right now.

Body · Policy

organizationIdstringRequired
The id you addressed. A test key sends the live organization id; this echoes it.
modestringRequired
test for a test key or a sandbox environment: nothing here reaches a payment network.
Allowed values:testlive
featuresarray of stringRequired
Effective feature names, sorted. mass_payouts enables batches; developer enables webhook endpoints. Both are on unless your organization opted out.
limitsobjectRequired
USD caps enforced on POST /payouts, batch lines and payout links; over one is 422 PAYOUT_LIMIT_EXCEEDED. null is no cap.
Show 3 properties
- maxSinglePayoutUsdstring | nullRequired
- maxDailyPayoutUsdstring | nullRequired
- maxDailyPerEndUserUsdstring | nullRequired
  Counted against endUser.id; when set, a payout without an endUser is refused.
approvalsobjectRequired
When thresholdUsd is set, a send above it answers 202 with an approval that requiredApprovals humans must approve in the dashboard. null means approvals are off.
Show 3 properties
- thresholdUsdstring | nullRequired
- requiredApprovalsinteger | nullRequired
- appliesToarray of stringRequired
  Allowed values:payoutsbatchespayout_links
purposeOfPaymentobjectRequired
Show 1 property
- requiredForCurrenciesarray of stringRequired
  Destination currencies for which purposeOfPayment is required on a payout; values come from GET .../payment-reasons?currency=.
feesobjectRequired
What your routing can state about its fees before a quote exists, read from its configuration. null on a number means "not published before a quote", never zero. The binding figure is always fee on the quote and on the payout; this is what to plan with.
Show 1 property
- payoutobjectRequired
  The payout fee, deducted from the send before conversion.
  Show 4 properties
  - bpsinteger | nullRequired
    Basis points of the send for every corridor not listed in byCurrency.
  - fixedUsdstring | nullRequired
    Fixed component in USD. Null when the network's own fixed charge is only priced on a quote.
  - byCurrencyobjectRequired
    Corridors priced differently from the default, keyed by destination currency. Empty when none are.
  - notestringRequired
    What the numbers cover and where the binding figure is. Prose; do not branch on it.
rateLimitsobjectRequired
Requests per minute per credential. payouts is POST /payouts; reads covers events, orders, balance_transactions and audit-events; batches is batch creation; everything else is default. A source-IP ceiling applies on top.
Show 4 properties
- defaultintegerRequired
- payoutsintegerRequired
- batchesintegerRequired
- readsintegerRequired
idempotencyobjectRequired
Show 3 properties
- requiredbooleanRequired
  An API key must send Idempotency-Key on every route that moves money.
- replayWindowDaysintegerRequired
  How long a key replays its original response.
- nearDuplicateWindowMinutesintegerRequired
  A byte-identical body under a different key inside this window is 409 DUPLICATE_REQUEST_DETECTED.
linksobjectRequired
Relative paths, with your organization id filled in, for the reads an integration needs next.
Show 3 properties
- corridorsstringRequired
- eventsstringRequired
- balanceTransactionsstringRequired

Errors

401
The key was refused. Nothing ran.
- UNAUTHORIZED: missing, invalid or revoked, or a key on a route that does not accept one.
- KEY_EXPIRED: the key passed the expiry it was issued with. Issue a new one; an expired key cannot be rotated.
- KEY_IP_NOT_ALLOWED: the key is pinned to source addresses and this request came from another.
403
A valid key that may not make this call. Nothing ran.
- FORBIDDEN: the key belongs to a different organization.
- ACCOUNT_BLOCKED: API access for your organization is suspended, and every key is refused until we lift it. Contact support.
429
Too many requests. The default ceiling is 100 requests per minute per API credential on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies.

Obey Retry-After; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same Idempotency-Key.

Error body · Error

typestringRequired
Stable machine-readable code.
detailstringRequired
What went wrong, in a sentence. Always a string, so detail.toLowerCase() is safe.
More
This is the field to read on BAD_REQUEST and PROVIDER_REJECTED, where the type alone does not name the condition.
messagestringRequired
The same text as detail, kept for integrations written before detail existed. Read detail.
resolutionstringOptional
What to do about it, when there is a specific answer. It is not on every error (it is absent on BAD_REQUEST, NOT_FOUND, PAYOUT_NOT_CANCELABLE and DESTINATION_ACCOUNT_NOT_FOUND), so treat it as optional and fall back to detail.
statusintegerRequired
HTTP status, repeated in the body.
statusCodeintegerRequired
The same value as status, kept for integrations written before status existed. Read status.
requestIdstringRequired
Quote this to support and we can find the exact request. Also sent as the x-request-id response header, which is the only place it appears on a successful response. Success bodies do not carry it. Send your own x-request-id on the request and we use it, so your trace and ours share one identifier; otherwise we mint one.
errorsarray of stringOptional
Present on VALIDATION_ERROR; names each field that failed.
originalIdempotencyKeystringOptional
On DUPLICATE_REQUEST_DETECTED only. Send the request again with this to receive the original payout instead of making a second one. Without it there is no way to recover except by risking a double payment.
originalPayoutIdstringOptional
On DUPLICATE_REQUEST_DETECTED only. The payout the first request created.
originalBatchIdstringOptional
On a batch DUPLICATE_REQUEST_DETECTED. The run the first request created.
originalRequestIdstringOptional
On a 409 PAYOUT_OUTCOME_UNKNOWN replay. The requestId of the call whose outcome is unknown; quote it to support.
existingRecipientIdstringOptional
On BANK_ACCOUNT_ALREADY_LINKED. The recipient in your organization that already holds this account.
existingMethodIdstringOptional
On BANK_ACCOUNT_ALREADY_LINKED. The payment method on that recipient.

Branch on type, never on the status or the message. Every error type is listed with what to do about it.

Avvio Partner Payouts · Policy · operation getPolicy

Try it: Get your policy

GET https://api.avvio.xyz/business/api/v1/payments/organizations/{orgId}/policy

API key Required

Test keys only. Sent as x-api-key through this site's proxy to the Avvio API, never saved, and cleared when you close this dialog.

orgId pathRequired

Was this page helpful?