Create a revocable anonymous-payment link

post

https://api.wingspan.app/v3/payments/invoices/{invoiceId}/payment-links

Creates a 256-bit secret for creating a short-lived InvoicePaymentIntent. Only a SHA-256 hash is persisted; the secret is returned on create and on an exact Idempotency-Key replay. At most one active payment link exists per Invoice. The normal idempotency response cache is disabled for this operation; replaying the same Idempotency-Key reaches Payments' durable create-result recovery path instead of caching bearer material at the API edge.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

invoiceId

string

required

Body Params

metadata

object

Free-form key-value pairs. Max 50 keys; key length at most 40 characters; value length at most 500 characters. Where a list endpoint declares metadata filtering, it uses the QueryQL namespace via filter[metadata.{key}][eq]=value or filter[metadata.{key}][in][]=value. Endpoints that do not declare the dynamic Metadata filter do not support Metadata filtering.

Headers

Idempotency-Key

string

required

length between 1 and 255

^[\x21-\x7e]{1,255}$

REQUIRED idempotency token for money-moving requests (e.g. transfers). The token is used by the API so a retry after a 5xx/timeout replays the original result instead of moving funds twice. Reuse the same key to retry safely; use a NEW key to issue a genuinely new transfer. Use 1-255 printable ASCII characters.

X-Wingspan-Account

string

^(?:[A-Za-z0-9_.]{22}|[a-f0-9]{24})$

Select the Account for an Account-scoped operation. A direct ServiceAccount API key MUST supply this header, and the target must be within the ServiceAccount owner's or Authorization grant's Account boundary. A Person bearer may select an Account on which it has an active Stakeholder, and an Account session may select its bound Account (or a descendant only when the session explicitly includes descendants).

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

201Payment link created.

401Unauthenticated

403Forbidden

404Resource not found

409Conflict

422Validation error

423The target Account is quiesced for V3 writes

429Quota exhausted for the target Account or its Organization (code: RateLimitExceeded). Retry-After carries the back-off in seconds; the response extensions identify the exhausted quota bucket.

503A downstream dependency is temporarily unavailable; retryable. Body carries code: ServiceUnavailable and may include extensions.retryAfter.