> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentaos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a checkout

> Creates a checkout session, standalone or built from a payment link with `linkId`. The create and list responses do **not** include a plain `amount`, only `amount_override` (`null` unless you passed one). Call "Retrieve a checkout" for a computed, ready-to-display `amount`. Accepts an `Idempotency-Key` header (wins over a body `idempotencyKey` if both are sent); a repeat call with the same key returns the same checkout instead of creating a second one.

The REST path is `/gateway/sessions` (the underlying resource is called a "session"); the TypeScript SDK and the CLI both call it a **checkout** (`agentaos.checkouts`, `agenta pay checkout`).

```mermaid theme={null}
stateDiagram-v2
    [*] --> open: POST /gateway/sessions
    open --> completed: Payment confirmed
    open --> expired: expiresIn elapsed
    open --> cancelled: POST .../cancel
    completed --> [*]
    expired --> [*]
    cancelled --> [*]
```

<Warning>
  The create and list responses do **not** include a plain `amount`, only `amount_override` (`null` unless you passed one). For a link-based checkout, the effective price is the link's amount. To get a single, ready-to-display price, call [Retrieve a checkout](/api-reference/checkouts/retrieve), which computes `amount` for you.
</Warning>


## OpenAPI

````yaml POST /gateway/sessions
openapi: 3.1.0
info:
  title: AgentaOS Gateway API
  version: 1.0.0
  description: >-
    The AgentaOS REST API: payment links, checkouts, subscriptions, customers,
    invoices, and the unified transactions feed. This is the same API the
    TypeScript SDK (`@agentaos/pay`) and the `agenta` CLI call underneath.


    ## Money model


    - **Decimal currency units (`number`)**: a plain `amount` field (on a create
    body, a Payment Link, a Checkout's `amount_override`, or an Invoice's
    `amount`/`fiat_amount`/`tax_amount`) is in currency units. `49.99` means EUR
    49.99, never cents.

    - **Integer minor units (`number`)**: exactly one field breaks that rule:
    `unitAmountMinor` on a Subscription. It is an integer count of the smallest
    currency unit (`1999` means EUR 19.99), named with a `Minor` suffix
    specifically so it is never confused with a plain `amount`. The `money`
    object on Transactions and the `earnings` object on a retrieved Invoice are
    also integer minor units, computed server-side.

    - **String, on webhooks**: the `amount` inside a webhook payload's `data`
    object is a string (e.g. `"49.99"`), since JSON numbers silently drop
    trailing zeros and this value must round-trip exactly for accounting.


    ## Naming convention


    Most response fields mirror the underlying database column and are
    `snake_case` (`created_at`, `seller_mode`, `buyer_email`, ...). A small
    number of computed convenience fields are camelCase with no snake_case
    equivalent: `checkoutUrl` on Checkouts and Payment Links, `sellerMode` on
    Payment Links specifically, `money` on Transactions, and `earnings` on a
    single retrieved Invoice. Two resources (Subscriptions and Customers) are
    fully camelCase end to end.


    ## Pagination


    Every list endpoint takes `limit` and `offset` and returns `{ items, total,
    hasMore }`. `hasMore` is computed server-side (`offset + items.length <
    total`); never derive it client-side.
  contact:
    name: AgentaOS
    url: https://agentaos.ai
  license:
    name: Proprietary
    url: https://agentaos.ai
servers:
  - url: https://api.agentaos.ai/api/v1
    description: Production
security:
  - ApiKeyAuth: []
tags:
  - name: Payment Links
    description: >-
      Reusable, shareable payment products: a fixed amount and description
      behind one URL.
  - name: Checkouts
    description: >-
      One attempt to collect one payment, standalone or built from a payment
      link. Wire path is `/gateway/sessions`; the SDK and CLI call this resource
      "checkout".
  - name: Subscriptions
    description: >-
      Merchant-side read and management surface for recurring plans. Created
      automatically when a buyer pays a `type: subscription` payment link.
  - name: Customers
    description: 'Read-only surface: everyone who has paid you or been sent an invoice.'
  - name: Invoices
    description: >-
      Every checkout issues an invoice. List, retrieve, void, export, and
      download PDFs/receipts.
  - name: Transactions
    description: >-
      The unified activity feed: every inbound payment and outbound send, across
      every rail, in one list.
paths:
  /gateway/sessions:
    post:
      tags:
        - Checkouts
      summary: Create a checkout
      description: >-
        Creates a checkout session, standalone or built from a payment link with
        `linkId`. The create and list responses do **not** include a plain
        `amount`, only `amount_override` (`null` unless you passed one). Call
        "Retrieve a checkout" for a computed, ready-to-display `amount`. Accepts
        an `Idempotency-Key` header (wins over a body `idempotencyKey` if both
        are sent); a repeat call with the same key returns the same checkout
        instead of creating a second one.
      operationId: createCheckout
      parameters:
        - name: Idempotency-Key
          in: header
          required: false
          description: >-
            Alternative to the body's `idempotencyKey` field. The header wins if
            both are sent.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckoutCreateRequest'
            example:
              amount: 49.99
              currency: EUR
              description: 'Order #123'
              successUrl: https://myshop.com/success
              cancelUrl: https://myshop.com/cart
              webhookUrl: https://myshop.com/webhooks
              buyerEmail: john@example.com
      responses:
        '201':
          description: Checkout created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Checkout'
              examples:
                default:
                  $ref: '#/components/examples/CheckoutExample'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  schemas:
    CheckoutCreateRequest:
      type: object
      description: >-
        Either `linkId` or `amount` is required (amount is required when
        creating a standalone checkout with no link).
      properties:
        linkId:
          type: string
          format: uuid
          description: >-
            Payment link UUID to create from. Inherits amount, currency,
            description, taxRateId, and the seller mode. Omit for a standalone
            checkout.
        amount:
          type: number
          minimum: 0.01
          maximum: 1000000
          description: Required if no linkId.
        amountOverride:
          type: number
          minimum: 0.01
          maximum: 1000000
          description: With linkId, overrides the link's amount for this checkout only.
        currency:
          type: string
          enum:
            - EUR
            - USD
            - EURC
            - EURe
            - USDC
          description: Ignored (inherited from the link) when linkId is set.
        description:
          type: string
          maxLength: 1000
        taxRateId:
          type: string
          format: uuid
        dueDate:
          type: string
          format: date
          description: >-
            YYYY-MM-DD. Presentation only, stamped onto the invoice issued for
            this checkout.
        buyerEmail:
          type: string
          format: email
          maxLength: 320
        buyerName:
          type: string
          maxLength: 200
        buyerCompany:
          type: string
          maxLength: 200
        buyerCountry:
          type: string
          maxLength: 2
          description: ISO 3166-1 alpha-2, e.g. DE. Drives destination-VAT calculation.
        buyerAddress:
          type: string
          maxLength: 500
        buyerVat:
          type: string
          maxLength: 20
        webhookUrl:
          type: string
          format: uri
          maxLength: 2048
        successUrl:
          type: string
          format: uri
          maxLength: 2048
        cancelUrl:
          type: string
          format: uri
          maxLength: 2048
        expiresIn:
          type: integer
          minimum: 300
          maximum: 86400
          default: 1800
          description: >-
            Seconds until expiry. Sessions eligible for SEPA bank transfer get a
            48-hour window regardless of this value.
        metadata:
          type: object
          description: Up to 8KB serialized.
        supportedNetworks:
          type: array
          items:
            type: string
          description: >-
            CAIP-2 network IDs. Defaults to Base mainnet for crypto-settlement
            checkouts.
        idempotencyKey:
          type: string
          description: >-
            Also settable via the Idempotency-Key request header (the header
            wins if both are sent).
    Checkout:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          format: uuid
          description: Internal checkout UUID.
        payment_link_id:
          type:
            - string
            - 'null'
          format: uuid
        org_id:
          type: string
          format: uuid
        session_id:
          type: string
          description: >-
            Public ID, used in the checkout URL and as the path parameter for
            every other call on this resource.
        idempotency_key:
          type:
            - string
            - 'null'
        amount_override:
          type:
            - number
            - 'null'
          description: Set only if you passed amount or amountOverride at create.
        currency:
          type: string
        metadata:
          type: object
        webhook_url:
          type:
            - string
            - 'null'
        success_url:
          type:
            - string
            - 'null'
        cancel_url:
          type:
            - string
            - 'null'
        tax_rate_id:
          type:
            - string
            - 'null'
          format: uuid
        supported_networks:
          type: array
          items:
            type: string
        expires_at:
          type: string
          format: date-time
        status:
          type: string
          enum:
            - open
            - completed
            - expired
            - cancelled
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        seller_mode:
          type: string
          enum:
            - mor
            - crypto
        environment:
          type: string
          enum:
            - test
            - live
        checkoutUrl:
          type: string
          description: Send your buyer here. Computed, camelCase.
        invoiceId:
          type:
            - string
            - 'null'
          format: uuid
          description: >-
            Set once an invoice has been issued for this session; null until
            then.
        invoiceNumber:
          type:
            - string
            - 'null'
      required:
        - id
        - payment_link_id
        - org_id
        - session_id
        - idempotency_key
        - amount_override
        - currency
        - metadata
        - webhook_url
        - success_url
        - cancel_url
        - tax_rate_id
        - supported_networks
        - expires_at
        - status
        - created_at
        - updated_at
        - seller_mode
        - environment
        - checkoutUrl
    Error:
      type: object
      description: >-
        Every non-2xx response is JSON in this shape. Every response (success or
        error) also carries an `x-request-id` response header; send that header
        on your request to have your own id echoed back, otherwise the server
        mints one. On errors the same id is repeated in the `requestId` body
        field.
      properties:
        statusCode:
          type: integer
          description: Same as the HTTP status code.
        message:
          description: >-
            Human-readable. A validation failure (400) returns an array of
            per-field messages instead of one string.
          anyOf:
            - type: string
            - type: array
              items:
                type: string
        errors:
          type: array
          description: >-
            Present on 400 validation failures: one entry per invalid field. The
            flat human-readable strings stay in `message` for back-compat; this
            is the machine-readable, per-field view.
          items:
            type: object
            properties:
              field:
                type: string
                description: >-
                  Name of the invalid field, dot-notated for nested properties
                  (e.g. `checkoutFields.0.type`).
              message:
                type: string
                description: Validation messages for that field, joined with `, `.
            required:
              - field
              - message
        requestId:
          type: string
          description: >-
            Correlation id, identical to the `x-request-id` response header.
            Include it when contacting support. On success it is available on
            the header only, not the body.
        timestamp:
          type: string
          format: date-time
      required:
        - statusCode
        - message
        - timestamp
  examples:
    CheckoutExample:
      value:
        id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
        payment_link_id: null
        org_id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
        session_id: mZrESFyR7RC9RPsJfZCVkg
        idempotency_key: order-48213
        amount_override: 49.99
        currency: EUR
        metadata:
          payer:
            email: john@example.com
        webhook_url: https://myshop.com/webhooks
        success_url: https://myshop.com/success
        cancel_url: https://myshop.com/cart
        tax_rate_id: null
        supported_networks:
          - eip155:8453
        expires_at: '2026-08-06T12:30:00.000Z'
        status: open
        created_at: '2026-08-06T12:00:00.000Z'
        updated_at: '2026-08-06T12:00:00.000Z'
        seller_mode: mor
        environment: live
        checkoutUrl: https://app.agentaos.ai/checkout/mZrESFyR7RC9RPsJfZCVkg
        invoiceId: b2c3d4e5-f6a7-8b9c-0d1e-2f3a4b5c6d7e
        invoiceNumber: INV-2026-0142
  responses:
    BadRequest:
      description: >-
        A required field is missing, out of range, or the wrong type.
        `ValidationPipe` also rejects any field not in the documented schema.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            statusCode: 400
            message: amount is required when creating a session without a link
            timestamp: '2026-08-06T12:00:00.000Z'
    Unauthorized:
      description: Missing or invalid `x-api-key`.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            statusCode: 401
            message: Invalid API key
            timestamp: '2026-08-06T12:00:00.000Z'
    Forbidden:
      description: The key is valid but the resource belongs to a different organization.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            statusCode: 403
            message: Payment link belongs to another organization
            timestamp: '2026-08-06T12:00:00.000Z'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your secret key, from app.agentaos.ai -> Settings -> Developers -> API
        Keys. The key's prefix is both its identity and its environment:
        `sk_test_...` (sandbox, free, no verification) or `sk_live_...` (real
        money, requires business verification). A missing or invalid key returns
        401.

````