Update a product

Edit a product.

PATCHCopy URL: https://api.avvio.xyz/business/api/v1/checkout/organizations/{orgId}/products/{productId}

PATCH/checkout/organizations/{orgId}/products/{productId}

Open in explorer

curl

IDEMPOTENCY_KEY=$(uuidgen)  # new key per call; reuse it only to retry this exact request
curl -s -X PATCH "$AVVIO_BASE_URL/checkout/organizations/$AVVIO_ORG_ID/products/$productId" \
  -H "x-api-key: $AVVIO_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "content-type: application/json" \
  -d '{
        "archived": true
      }'

Node

const productId = '<productId>';
const idempotencyKey = crypto.randomUUID(); // new key per call; reuse it only to retry this exact request

const res = await fetch(`${process.env.AVVIO_BASE_URL}/checkout/organizations/${process.env.AVVIO_ORG_ID}/products/${productId}`, {
  method: 'PATCH',
  headers: {
    'x-api-key': process.env.AVVIO_API_KEY,
    'Idempotency-Key': idempotencyKey,
    'content-type': 'application/json',
  },
  body: JSON.stringify({
    "archived": true
  }),
});
console.log(res.status, await res.json());

Python

import os
import uuid
import requests

productId = "<productId>"
idempotency_key = str(uuid.uuid4())  # new key per call; reuse it only to retry this exact request

res = requests.patch(
    f"{os.environ['AVVIO_BASE_URL']}/checkout/organizations/{os.environ['AVVIO_ORG_ID']}/products/{productId}",
    headers={
        "x-api-key": os.environ["AVVIO_API_KEY"],
        "Idempotency-Key": idempotency_key,
    },
    json={
        "archived": True
    },
)
print(res.status_code, res.json())

Try it

200OKResponse status200 OK400 Bad Request401 Unauthorized403 Forbidden404 Not Found409 Conflict429 Too Many Requests

{
  "id": "2a7b8c9d-1e2f-4a5b-8c9d-0e1f2a3b4c5d",
  "name": "Consulting (60 min)",
  "description": null,
  "currency": "USD",
  "unitAmount": "150.00",
  "archivedAt": null,
  "linkCount": 0,
  "createdAt": "2026-09-12T09:55:00.000Z"
}

Path parameters

• orgIdstringRequired

  The opaque organization id issued to you, normally CUID-shaped (for example cmsx…). It is not an org_-prefixed alias. Pass it unchanged in every organization-scoped path.

• productIdstringRequired

Headers

• Idempotency-KeystringRequired

  A unique value per logical operation, 1-255 chars of A-Z a-z 0-9 _ . : -.

  More

  Reuse it to retry. Same key with the same body replays the stored response; same key with a different body is a 409, because answering with the first call's result would hand you a receipt for a payout you did not request. A 4xx releases the key, so you can fix the body and reuse it.

  Reuse it; do not generate one per attempt. A key minted per attempt defeats replay entirely: every retry looks like a new request, so every retry pays. We also watch for an identical body arriving under a different key within 15 minutes and refuse it with DUPLICATE_REQUEST_DETECTED.

  Records are kept for 7 days. That is a retention window only: there is no path where an expired key is re-executed.

Body

This endpoint expects a JSON object.

• namestringOptional
• descriptionstring | nullOptional
• imageBase64string | nullOptional
• currencystringOptional
  Allowed values:USDEURGBPAED

  Show 10 more values

  MXNBRLARSINRCNYHKDPHPSGDIDRTHB
• unitAmountstringOptional
• archivedbooleanOptional

  True hides it from the picker and refuses new links from it. Existing links are untouched.

Behavior

Every field optional. archived: true hides it from the picker and refuses new links from it; existing links are untouched either way. Idempotency-Key is required on an API key.

Responses

200The product after the edit.

Body · CheckoutProduct

• idstring<uuid>Required
• namestringRequired
• descriptionstring | nullRequired
• currencystringRequired
• unitAmountstringRequired
• archivedAtstring<date-time> | nullRequired
• linkCountintegerRequired

  Links created from it.

• createdAtstring<date-time>Required

Errors

• 400

  VALIDATION_ERROR (a field is malformed; errors names each), BAD_REQUEST (a request we understood but cannot carry out, named in detail: editing a published link, deleting one that was live, both productId and items), LINK_EXPIRED (publishing a draft whose expiresAt has passed), or, on a write, IDEMPOTENCY_KEY_REQUIRED / IDEMPOTENCY_KEY_INVALID (the header is missing or malformed).

• 401

  The key was refused. Nothing ran.

  • UNAUTHORIZED: missing, invalid or revoked, or a key on a route that does not accept one.
  • KEY_EXPIRED: the key passed the expiry it was issued with. Issue a new one; an expired key cannot be rotated.
  • KEY_IP_NOT_ALLOWED: the key is pinned to source addresses and this request came from another.
• 403

  A valid key that may not make this write. Nothing was changed.

  • FORBIDDEN: the key belongs to a different organization, or your business has not completed verification to accept payments; detail says which.
  • ACCOUNT_BLOCKED: API access for your organization is suspended.
  • LIVE_KEY_ORG_NOT_APPROVED: a live key, before we have approved your business verification. Use a test key until then.
  • INSUFFICIENT_SCOPE: a read-only key.
• 404

  No such link or product in this organization, or the id belongs to another one.

• 409

  Another active product already has that name, or an idempotency conflict (IDEMPOTENCY_KEY_CONFLICT, IDEMPOTENCY_KEY_REQUEST_IN_PROGRESS).

• 429

  Too many requests. The default ceiling is 100 requests per minute per API credential on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies.

  Obey Retry-After; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same Idempotency-Key.

Error body · Error

• typestringRequired

  Stable machine-readable code.

• detailstringRequired

  What went wrong, in a sentence. Always a string, so detail.toLowerCase() is safe.

  More

  This is the field to read on BAD_REQUEST and PROVIDER_REJECTED, where the type alone does not name the condition.

• messagestringRequired

  The same text as detail, kept for integrations written before detail existed. Read detail.

• resolutionstringOptional

  What to do about it, when there is a specific answer. It is not on every error (it is absent on BAD_REQUEST, NOT_FOUND, PAYOUT_NOT_CANCELABLE and DESTINATION_ACCOUNT_NOT_FOUND), so treat it as optional and fall back to detail.

• statusintegerRequired

  HTTP status, repeated in the body.

• statusCodeintegerRequired

  The same value as status, kept for integrations written before status existed. Read status.

• requestIdstringRequired

  Quote this to support and we can find the exact request. Also sent as the x-request-id response header, which is the only place it appears on a successful response. Success bodies do not carry it. Send your own x-request-id on the request and we use it, so your trace and ours share one identifier; otherwise we mint one.

• errorsarray of stringOptional

  Present on VALIDATION_ERROR; names each field that failed.

• originalIdempotencyKeystringOptional

  On DUPLICATE_REQUEST_DETECTED only. Send the request again with this to receive the original payout instead of making a second one. Without it there is no way to recover except by risking a double payment.

• originalPayoutIdstringOptional

  On DUPLICATE_REQUEST_DETECTED only. The payout the first request created.

• originalBatchIdstringOptional

  On a batch DUPLICATE_REQUEST_DETECTED. The run the first request created.

• originalRequestIdstringOptional

  On a 409 PAYOUT_OUTCOME_UNKNOWN replay. The requestId of the call whose outcome is unknown; quote it to support.

• existingRecipientIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The recipient in your organization that already holds this account.

• existingMethodIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The payment method on that recipient.

Branch on type, never on the status or the message. Every error type is listed with what to do about it.

Avvio Checkout · Products · operation updateCheckoutProduct

Try it: Update a product

PATCH https://api.avvio.xyz/business/api/v1/checkout/organizations/{orgId}/products/{productId}

API key Required

Test keys only. Sent as x-api-key through this site's proxy to the Avvio API, never saved, and cleared when you close this dialog.

orgId pathRequired

productId pathRequired

Idempotency-Key headerRequired

Body JSON{ "archived": true }

Send request