---
updatedAt: 2026-09-30T17:50:34.235Z
---

Fetch the complete documentation index at: https://docs.avvio.xyz/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# List payments on a link

`GET https://api.avvio.xyz/business/api/v1/checkout/organizations/{orgId}/links/{linkId}/payments`

Lists the payments made on one link, newest first and cursor-paged. This is the authoritative read: a success
page must confirm here (or from the `checkout_payment.paid` webhook),
never from the redirect alone.

Amounts here are **base units** with `decimals` beside them
(`"15000"` at `decimals: 2` is 150.00), the dashboard's convention. The
webhook body for the same payment uses decimal strings (`"150.00"`).

Refunding is `POST /checkout/organizations/{orgId}/payments/{paymentId}/refund`,
on a key with the `refunds` scope, or from the dashboard by an owner or
admin. Each refund is listed under `refunds` on the payment.

## Parameters

- `orgId` (path, required) — The opaque organization id issued to you, normally CUID-shaped (for example `cmsx…`). It is not an `org_`-prefixed alias. Pass it unchanged in every organization-scoped path.
- `linkId` (path, required)
- `limit` (query) — 1 to 100. Defaults to 20. Above 100 is clamped to 100; zero, negative or not a number falls back to 20 (never a 400).
- `cursor` (query) — The `nextCursor` from the previous page, verbatim.

## Example

```bash
curl -s "$AVVIO_BASE_URL/checkout/organizations/$AVVIO_ORG_ID/links/$linkId/payments" \
  -H "x-api-key: $AVVIO_API_KEY"
```

## Responses

- `200` — A page. `nextCursor` is absent on the last one.
- `400` — `VALIDATION_ERROR` (a field is malformed; `errors` names each), `BAD_REQUEST` (a request we understood but cannot carry out, named in `detail`: editing a published link, deleting one that was live, both `productId` and `items`), `LINK_EXPIRED` (publishing a draft whose `expiresAt` has passed), or, on a write, `IDEMPOTENCY_KEY_REQUIRED` / `IDEMPOTENCY_KEY_INVALID` (the header is missing or malformed).
- `401` — The key was refused. Nothing ran. - `UNAUTHORIZED`: missing, invalid or revoked, or a key on a route that does not accept one. - `KEY_EXPIRED`: the key passed the expiry it was issued with. Issue a new one; an expired key cannot be rotated. - `KEY_IP_NOT_ALLOWED`: the key is pinned to source addresses and this request came from another.
- `403` — A valid key that may not make this call. Nothing ran. - `FORBIDDEN`: the key belongs to a different organization, **or** your business has not completed verification to accept payments (every checkout call but refund is refused until it has; `detail` says which). - `ACCOUNT_BLOCKED`: API access for your organization is suspended.
- `404` — No such link or product in this organization, or the id belongs to another one.
- `429` — Too many requests. The default ceiling is **100 requests per minute per API credential** on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies. Obey `Retry-After`; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same `Idempotency-Key`.

Machine contract: [partner-checkout.openapi.yaml](/partner-checkout.openapi.yaml), operation `listCheckoutPayments`.