> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentaos.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Create a verification link
> The identity check link for your client. You send it; only your client can complete it. Needs a live key: a test key gets `403 live_key_required`. While a check is open, calling again returns the same check. `url` is `null` when the client is already verified. For another app of your own company it returns `409 identity_from_company`: its identity check is your company's.
Needs a live key (`sk_live_...`): the identity check is real. A test key gets `403 live_key_required`.
You send the link; only your client can complete the identity check. `url` is `null` when they are already verified. Another app of your own company has no identity check of its own: `409 identity_from_company`.
**Webhook:** none. `account.updated` fires when your client completes the identity check and AgentaOS reads the result. See [Which action fires which event](/webhooks/events#which-action-fires-which-event).
## OpenAPI
````yaml POST /gateway/businesses/{id}/verification-link
openapi: 3.1.0
info:
title: AgentaOS Gateway API
version: 1.0.0
description: >-
The AgentaOS REST API: payment links, checkouts, subscriptions, customers,
invoices, and the unified transactions feed. This is the same API the
TypeScript SDK (`@agentaos/pay`) and the `agenta` CLI call underneath.
## Money model
- **Decimal currency units (`number`)**: a plain `amount` field (on a create
body, a Payment Link, a Checkout's `amount_override`, or an Invoice's
`amount`/`fiat_amount`/`tax_amount`) is in currency units. `49.99` means EUR
49.99, never cents.
- **Integer minor units (`number`)**: exactly one field breaks that rule:
`unitAmountMinor` on a Subscription. It is an integer count of the smallest
currency unit (`1999` means EUR 19.99), named with a `Minor` suffix
specifically so it is never confused with a plain `amount`. The `money`
object on Transactions and the `earnings` object on a retrieved Invoice are
also integer minor units, computed server-side.
- **String, on webhooks**: the `amount` inside a webhook payload's `data`
object is a string (e.g. `"49.99"`), since JSON numbers silently drop
trailing zeros and this value must round-trip exactly for accounting.
## Naming convention
Most response fields mirror the underlying database column and are
`snake_case` (`created_at`, `seller_mode`, `buyer_email`, ...). A small
number of computed convenience fields are camelCase with no snake_case
equivalent: `checkoutUrl` on Checkouts and Payment Links, `sellerMode` on
Payment Links specifically, `money` on Transactions, and `earnings` on a
single retrieved Invoice. Two resources (Subscriptions and Customers) are
fully camelCase end to end.
## Pagination
Every list endpoint takes `limit` and `offset` and returns `{ items, total,
hasMore }`. `hasMore` is computed server-side (`offset + items.length <
total`); never derive it client-side.
contact:
name: AgentaOS
url: https://agentaos.ai
license:
name: Proprietary
url: https://agentaos.ai
servers:
- url: https://api.agentaos.ai/api/v1
description: Production
security:
- ApiKeyAuth: []
tags:
- name: Payment Links
description: >-
Reusable, shareable payment products: a fixed amount and description
behind one URL.
- name: Checkouts
description: >-
One attempt to collect one payment, standalone or built from a payment
link. Wire path is `/gateway/sessions`; the SDK and CLI call this resource
"checkout".
- name: Subscriptions
description: >-
Merchant-side read and management surface for recurring plans. Created
automatically when a buyer pays a `type: subscription` payment link.
- name: Customers
description: 'Read-only surface: everyone who has paid you or been sent an invoice.'
- name: Invoices
description: >-
Every checkout issues an invoice. List, retrieve, void, export, and
download PDFs/receipts.
- name: Transactions
description: >-
The unified activity feed: every inbound payment and outbound send, across
every rail, in one list.
- name: Businesses
description: >-
For platforms: the businesses you manage, a client's business or another
app of your own company. To act as one of them on any other endpoint, send
its id in the `AgentaOS-Account` header. Every field on this resource is
camelCase on the wire.
paths:
/gateway/businesses/{id}/verification-link:
post:
tags:
- Businesses
summary: Create a verification link
description: >-
The identity check link for your client. You send it; only your client
can complete it. Needs a live key: a test key gets `403
live_key_required`. While a check is open, calling again returns the
same check. `url` is `null` when the client is already verified. For
another app of your own company it returns `409 identity_from_company`:
its identity check is your company's.
operationId: createBusinessVerificationLink
parameters:
- $ref: '#/components/parameters/BusinessId'
responses:
'201':
description: The link, or `null` when already verified.
content:
application/json:
schema:
$ref: '#/components/schemas/VerificationLink'
example:
url: https://…
status: Not Started
'401':
$ref: '#/components/responses/Unauthorized'
'403':
description: >-
A business you do not manage (`You cannot act as this business.`),
or a test key (`live_key_required`).
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
not_yours:
value:
statusCode: 403
message: You cannot act as this business.
timestamp: '2026-09-28T12:00:00.000Z'
live_key_required:
value:
statusCode: 403
code: live_key_required
message: >-
This needs a live API key: it changes real money, live
settings or a real identity check. This is a test key.
timestamp: '2026-09-28T12:00:00.000Z'
'409':
description: >-
Another app of your own company: its identity check is your
company's.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
statusCode: 409
code: identity_from_company
message: >-
This business is another app of your company. Its identity
check is your company’s.
timestamp: '2026-09-28T12:00:00.000Z'
components:
parameters:
BusinessId:
name: id
in: path
required: true
description: The business UUID.
schema:
type: string
format: uuid
schemas:
VerificationLink:
type: object
properties:
url:
type:
- string
- 'null'
description: >-
The identity check link to send your client, or null when already
verified.
status:
type: string
description: >-
Where the identity check stands. These are the check's own states,
not a business status: `Not Started`, `In Progress`, `Awaiting
User`, `In Review`, `Approved`, `Declined`, `Resubmitted`,
`Expired`, `Kyc Expired` or `Abandoned`. `Approved` means the check
is done.
required:
- url
- status
Error:
type: object
description: >-
Every non-2xx response is JSON in this shape. Every response (success or
error) also carries an `x-request-id` response header; send that header
on your request to have your own id echoed back, otherwise the server
mints one. On errors the same id is repeated in the `requestId` body
field.
properties:
statusCode:
type: integer
description: Same as the HTTP status code.
code:
type: string
description: >-
Present on some refusals: a stable machine-readable reason, e.g.
`live_key_required`.
message:
description: >-
Human-readable. A validation failure (400) returns an array of
per-field messages instead of one string.
anyOf:
- type: string
- type: array
items:
type: string
errors:
type: array
description: >-
Present on 400 validation failures: one entry per invalid field. The
flat human-readable strings stay in `message` for back-compat; this
is the machine-readable, per-field view.
items:
type: object
properties:
field:
type: string
description: >-
Name of the invalid field, dot-notated for nested properties
(e.g. `checkoutFields.0.type`).
message:
type: string
description: Validation messages for that field, joined with `, `.
required:
- field
- message
requestId:
type: string
description: >-
Correlation id, identical to the `x-request-id` response header.
Include it when contacting support. On success it is available on
the header only, not the body.
timestamp:
type: string
format: date-time
required:
- statusCode
- message
- timestamp
responses:
Unauthorized:
description: Missing or invalid `x-api-key`.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
statusCode: 401
message: Invalid API key
timestamp: '2026-08-06T12:00:00.000Z'
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: x-api-key
description: >-
Your secret key, from app.agentaos.ai -> Settings -> Developers -> API
Keys. The key's prefix is both its identity and its environment:
`sk_test_...` (sandbox, free, no verification) or `sk_live_...` (real
money, requires business verification). A missing or invalid key returns
401.
````