List payments on a link

Lists the payments made on one link, newest first and cursor-paged.

GETCopy URL: https://api.avvio.xyz/business/api/v1/checkout/organizations/{orgId}/links/{linkId}/payments

GET/checkout/organizations/{orgId}/links/{linkId}/payments

Open in explorer

curl

curl -s "$AVVIO_BASE_URL/checkout/organizations/$AVVIO_ORG_ID/links/$linkId/payments" \
  -H "x-api-key: $AVVIO_API_KEY"

Node

const linkId = '<linkId>';

const res = await fetch(`${process.env.AVVIO_BASE_URL}/checkout/organizations/${process.env.AVVIO_ORG_ID}/links/${linkId}/payments`, {
  headers: {
    'x-api-key': process.env.AVVIO_API_KEY,
  },
});
console.log(res.status, await res.json());

Python

import os
import requests

linkId = "<linkId>"

res = requests.get(
    f"{os.environ['AVVIO_BASE_URL']}/checkout/organizations/{os.environ['AVVIO_ORG_ID']}/links/{linkId}/payments",
    headers={
        "x-api-key": os.environ["AVVIO_API_KEY"],
    },
)
print(res.status_code, res.json())

Try it

200OKResponse status200 OK400 Bad Request401 Unauthorized403 Forbidden404 Not Found429 Too Many Requests

{
  "items": [
    {
      "id": "cmf9x1b2c0003q8b7h6j8k0lm",
      "kind": "card",
      "acceptor": "sandbox",
      "externalId": "pay_01J8",
      "amountBase": "15000",
      "currency": "USD",
      "decimals": 2,
      "feeBase": "435",
      "netBase": "14565",
      "applicationFeeBase": "150",
      "refundedBase": null,
      "refunds": [],
      "disputeSubstatus": null,
      "status": "paid",
      "failureCode": null,
      "reviewReason": null,
      "clientReferenceId": "order_1042",
      "paidAt": "2026-09-12T10:00:04.000Z",
      "reversedAt": null,
      "settledAt": null,
      "createdAt": "2026-09-12T09:59:58.000Z"
    }
  ],
  "nextCursor": "cmf9x1b2c0004q8b7j7k9l1mn"
}

Path parameters

• orgIdstringRequired

  The opaque organization id issued to you, normally CUID-shaped (for example cmsx…). It is not an org_-prefixed alias. Pass it unchanged in every organization-scoped path.

• linkIdstringRequired

Query parameters

• limitintegerOptionalDefaults to 20

  1 to 100. Defaults to 20. Above 100 is clamped to 100; zero, negative or not a number falls back to 20 (never a 400).

• cursorstringOptional

  The nextCursor from the previous page, verbatim.

Behavior

This is the authoritative read: a success page must confirm here (or from the checkout_payment.paid webhook), never from the redirect alone.

Amounts here are base units with decimals beside them ("15000" at decimals: 2 is 150.00), the dashboard's convention. The webhook body for the same payment uses decimal strings ("150.00").

Refunding is POST /checkout/organizations/{orgId}/payments/{paymentId}/refund, on a key with the refunds scope, or from the dashboard by an owner or admin. Each refund is listed under refunds on the payment.

Responses

200A page. nextCursor is absent on the last one.

Body

• itemsarray of objectRequired
  Show 21 properties

  • idstringRequired
  • kindstringRequired

    How a buyer may pay. card is the hosted card page (card, wallets and PayPal in one).

    Allowed values:cardbankcryptocashapp
  • acceptorstringOptional

    Which side recorded it: sandbox for a simulated payment, manual for one you recorded in the dashboard. A live card payment carries an internal label for the card processor, which can change without notice. Do not branch on it.

  • externalIdstringOptional

    The acceptor's id for it. Opaque.

  • amountBasestringRequired

    Gross, base units.

  • currencystringRequired
  • decimalsintegerRequired
  • feeBasestringRequired

    Processing fee, base units. "0" when none was stated.

  • netBasestring | nullOptional

    What reached your balance, when the acceptor stated it.

  • applicationFeeBasestringOptional

    Our fee, base units.

  • refundedBasestring | nullOptional

    Cumulative refunded, or null when nothing has been.

  • refundsarray of objectRequired

    Every refund on this payment, oldest first, with who asked for it and why. Empty when none.

    Show 11 properties

    • idstringRequired
    • paymentIdstringRequired
    • amountBasestringRequired

      This refund, base units.

    • currencystringRequired
    • decimalsintegerRequired
    • reasonstring | nullRequired

      The four refund reasons most card APIs use.

      Allowed values:requested_by_customerduplicatefraudulentother
    • notestring | nullRequired
    • sourcestringRequired
      Allowed values:dashboardapiacquirer
    • statusstringRequired
      Allowed values:pendingsucceeded
    • actorstring | nullRequired

      A teammate's name, or the API key's name. Null for a refund made at the acquirer.

    • createdAtstring<date-time>Required
  • disputeSubstatusstring | nullOptional

    Set while a dispute is open. No event fires until it resolves.

  • statusstringRequired

    paid is not final: refunded and reversed (a chargeback) can follow, weeks later. pending on a bank payment that has settled means it is held (short of the total, or in the wrong currency) and reviewReason says why; it moves when someone accepts it in the dashboard.

    Allowed values:pendingprocessingpaidfailed

    Show 2 more values

    reversedrefunded
  • failureCodestring | nullOptional
  • reviewReasonstring | nullOptional

    Why a settled bank deposit is held in pending, in words. Null on anything not held.

  • clientReferenceIdstring | nullOptional

    The ?client_reference_id= the buyer's visit carried (card rail only). The link-level one is on the link.

  • paidAtstring<date-time> | nullOptional
  • reversedAtstring<date-time> | nullOptional
  • settledAtstring<date-time> | nullOptional

    Null in this version; the money is in your balance at the processor and we do not see it move from there.

  • createdAtstring<date-time>Required
• nextCursorstringOptional

Errors

• 400

  VALIDATION_ERROR (a field is malformed; errors names each), BAD_REQUEST (a request we understood but cannot carry out, named in detail: editing a published link, deleting one that was live, both productId and items), LINK_EXPIRED (publishing a draft whose expiresAt has passed), or, on a write, IDEMPOTENCY_KEY_REQUIRED / IDEMPOTENCY_KEY_INVALID (the header is missing or malformed).

• 401

  The key was refused. Nothing ran.

  • UNAUTHORIZED: missing, invalid or revoked, or a key on a route that does not accept one.
  • KEY_EXPIRED: the key passed the expiry it was issued with. Issue a new one; an expired key cannot be rotated.
  • KEY_IP_NOT_ALLOWED: the key is pinned to source addresses and this request came from another.
• 403

  A valid key that may not make this call. Nothing ran.

  • FORBIDDEN: the key belongs to a different organization, or your business has not completed verification to accept payments (every checkout call but refund is refused until it has; detail says which).
  • ACCOUNT_BLOCKED: API access for your organization is suspended.
• 404

  No such link or product in this organization, or the id belongs to another one.

• 429

  Too many requests. The default ceiling is 100 requests per minute per API credential on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies.

  Obey Retry-After; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same Idempotency-Key.

Error body · Error

• typestringRequired

  Stable machine-readable code.

• detailstringRequired

  What went wrong, in a sentence. Always a string, so detail.toLowerCase() is safe.

  More

  This is the field to read on BAD_REQUEST and PROVIDER_REJECTED, where the type alone does not name the condition.

• messagestringRequired

  The same text as detail, kept for integrations written before detail existed. Read detail.

• resolutionstringOptional

  What to do about it, when there is a specific answer. It is not on every error (it is absent on BAD_REQUEST, NOT_FOUND, PAYOUT_NOT_CANCELABLE and DESTINATION_ACCOUNT_NOT_FOUND), so treat it as optional and fall back to detail.

• statusintegerRequired

  HTTP status, repeated in the body.

• statusCodeintegerRequired

  The same value as status, kept for integrations written before status existed. Read status.

• requestIdstringRequired

  Quote this to support and we can find the exact request. Also sent as the x-request-id response header, which is the only place it appears on a successful response. Success bodies do not carry it. Send your own x-request-id on the request and we use it, so your trace and ours share one identifier; otherwise we mint one.

• errorsarray of stringOptional

  Present on VALIDATION_ERROR; names each field that failed.

• originalIdempotencyKeystringOptional

  On DUPLICATE_REQUEST_DETECTED only. Send the request again with this to receive the original payout instead of making a second one. Without it there is no way to recover except by risking a double payment.

• originalPayoutIdstringOptional

  On DUPLICATE_REQUEST_DETECTED only. The payout the first request created.

• originalBatchIdstringOptional

  On a batch DUPLICATE_REQUEST_DETECTED. The run the first request created.

• originalRequestIdstringOptional

  On a 409 PAYOUT_OUTCOME_UNKNOWN replay. The requestId of the call whose outcome is unknown; quote it to support.

• existingRecipientIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The recipient in your organization that already holds this account.

• existingMethodIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The payment method on that recipient.

Branch on type, never on the status or the message. Every error type is listed with what to do about it.

Avvio Checkout · Payments & refunds · operation listCheckoutPayments

Try it: List payments on a link

GET https://api.avvio.xyz/business/api/v1/checkout/organizations/{orgId}/links/{linkId}/payments

API key Required

Test keys only. Sent as x-api-key through this site's proxy to the Avvio API, never saved, and cleared when you close this dialog.

orgId pathRequired

linkId pathRequired

limit queryOptional

cursor queryOptional

Send request