List products

Lists your catalog, every product, active first.

GETCopy URL: https://api.avvio.xyz/business/api/v1/checkout/organizations/{orgId}/products

GET/checkout/organizations/{orgId}/products

Open in explorer

curl

curl -s "$AVVIO_BASE_URL/checkout/organizations/$AVVIO_ORG_ID/products" \
  -H "x-api-key: $AVVIO_API_KEY"

Node

const res = await fetch(`${process.env.AVVIO_BASE_URL}/checkout/organizations/${process.env.AVVIO_ORG_ID}/products`, {
  headers: {
    'x-api-key': process.env.AVVIO_API_KEY,
  },
});
console.log(res.status, await res.json());

Python

import os
import requests

res = requests.get(
    f"{os.environ['AVVIO_BASE_URL']}/checkout/organizations/{os.environ['AVVIO_ORG_ID']}/products",
    headers={
        "x-api-key": os.environ["AVVIO_API_KEY"],
    },
)
print(res.status_code, res.json())

Try it

200OKResponse status200 OK400 Bad Request401 Unauthorized403 Forbidden429 Too Many Requests

[
  {
    "id": "2a7b8c9d-1e2f-4a5b-8c9d-0e1f2a3b4c5d",
    "name": "Consulting (60 min)",
    "description": null,
    "currency": "USD",
    "unitAmount": "150.00",
    "archivedAt": null,
    "linkCount": 0,
    "createdAt": "2026-09-12T09:55:00.000Z"
  }
]

Path parameters

• orgIdstringRequired

  The opaque organization id issued to you, normally CUID-shaped (for example cmsx…). It is not an org_-prefixed alias. Pass it unchanged in every organization-scoped path.

Behavior

The image is never on the list (fifty products must not weigh 35MB); read one product for it. Read-only keys may call this.

Responses

200The catalog, as a bare array.

Body

• idstring<uuid>Required
• namestringRequired
• descriptionstring | nullRequired
• currencystringRequired
• unitAmountstringRequired
• archivedAtstring<date-time> | nullRequired
• linkCountintegerRequired

  Links created from it.

• createdAtstring<date-time>Required

Errors

• 400

  VALIDATION_ERROR (a field is malformed; errors names each), BAD_REQUEST (a request we understood but cannot carry out, named in detail: editing a published link, deleting one that was live, both productId and items), LINK_EXPIRED (publishing a draft whose expiresAt has passed), or, on a write, IDEMPOTENCY_KEY_REQUIRED / IDEMPOTENCY_KEY_INVALID (the header is missing or malformed).

• 401

  The key was refused. Nothing ran.

  • UNAUTHORIZED: missing, invalid or revoked, or a key on a route that does not accept one.
  • KEY_EXPIRED: the key passed the expiry it was issued with. Issue a new one; an expired key cannot be rotated.
  • KEY_IP_NOT_ALLOWED: the key is pinned to source addresses and this request came from another.
• 403

  A valid key that may not make this call. Nothing ran.

  • FORBIDDEN: the key belongs to a different organization, or your business has not completed verification to accept payments (every checkout call but refund is refused until it has; detail says which).
  • ACCOUNT_BLOCKED: API access for your organization is suspended.
• 429

  Too many requests. The default ceiling is 100 requests per minute per API credential on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies.

  Obey Retry-After; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same Idempotency-Key.

Error body · Error

• typestringRequired

  Stable machine-readable code.

• detailstringRequired

  What went wrong, in a sentence. Always a string, so detail.toLowerCase() is safe.

  More

  This is the field to read on BAD_REQUEST and PROVIDER_REJECTED, where the type alone does not name the condition.

• messagestringRequired

  The same text as detail, kept for integrations written before detail existed. Read detail.

• resolutionstringOptional

  What to do about it, when there is a specific answer. It is not on every error (it is absent on BAD_REQUEST, NOT_FOUND, PAYOUT_NOT_CANCELABLE and DESTINATION_ACCOUNT_NOT_FOUND), so treat it as optional and fall back to detail.

• statusintegerRequired

  HTTP status, repeated in the body.

• statusCodeintegerRequired

  The same value as status, kept for integrations written before status existed. Read status.

• requestIdstringRequired

  Quote this to support and we can find the exact request. Also sent as the x-request-id response header, which is the only place it appears on a successful response. Success bodies do not carry it. Send your own x-request-id on the request and we use it, so your trace and ours share one identifier; otherwise we mint one.

• errorsarray of stringOptional

  Present on VALIDATION_ERROR; names each field that failed.

• originalIdempotencyKeystringOptional

  On DUPLICATE_REQUEST_DETECTED only. Send the request again with this to receive the original payout instead of making a second one. Without it there is no way to recover except by risking a double payment.

• originalPayoutIdstringOptional

  On DUPLICATE_REQUEST_DETECTED only. The payout the first request created.

• originalBatchIdstringOptional

  On a batch DUPLICATE_REQUEST_DETECTED. The run the first request created.

• originalRequestIdstringOptional

  On a 409 PAYOUT_OUTCOME_UNKNOWN replay. The requestId of the call whose outcome is unknown; quote it to support.

• existingRecipientIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The recipient in your organization that already holds this account.

• existingMethodIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The payment method on that recipient.

Branch on type, never on the status or the message. Every error type is listed with what to do about it.

Avvio Checkout · Products · operation listCheckoutProducts

Try it: List products

GET https://api.avvio.xyz/business/api/v1/checkout/organizations/{orgId}/products

API key Required

Test keys only. Sent as x-api-key through this site's proxy to the Avvio API, never saved, and cleared when you close this dialog.

orgId pathRequired

Send request