VerifiedInbox

API Reference · Checkout

Create Checkout

Create a Stripe checkout link

POST/v1/applications/{application_id}/checkout
Account requiredScope:billing:writeIdempotency-Key:requiredMCP:create_checkout

Agents can create the link; only a person can pay. Payment is confirmed by webhook. Claims a guest draft first when needed.

cURL example

cURL request
curl -X POST "https://api.verifiedinbox.ai/v1/applications/0192a5e0-1234-7000-8000-000000000001/checkout" \
  -H "Authorization: Bearer vi_live_YOUR_API_KEY" \
  -H "Idempotency-Key: idem-$(date +%s)" \
  -H "Content-Type: application/json" \
  -d '{
    "product": "vmc"
  }'

Parameters

ParameterTypeDescription
application_idpathrequired
string (uuid)Application id.
Idempotency-Keyheaderrequired
stringUnique key per intended action (≤ 255 chars). Same key + same body replays the first response; same key + different body → 409.
VI-Environmentheader
string`live` (default) or `test`. Used for anonymous callers and OAuth access tokens; API keys and web sessions carry their own environment.

Request body

application/json · required
FieldTypeDescription
productoptional
string

Defaults to the chosen/recommended product.

Allowed: vmc, cmc

Example request payload (CheckoutRequest)
{
  "product": "vmc"
}

Response

201 OKCheckout link.
application/json
FieldTypeDescription
checkout_urlrequired
string

Stripe hosted checkout (or the mock checkout in test mode). Only a person can pay.

expires_atrequired
string (date-time) | null—
order_idrequired
string (uuid)—
reusedrequired
boolean—
Example 201 response (CheckoutSession)
{
  "checkout_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
  "expires_at": "2026-10-31T12:00:00Z",
  "order_id": "0192a5e0-1234-7000-8000-000000000001",
  "reused": true
}

Other responses & possible errors

Expand a status code below to see the error code, description, and example error payload.

400 (invalid_request)`invalid_request` — the request is malformed.

`invalid_request` — the request is malformed.

Example 400 error response
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
401 (unauthenticated)`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

Example 401 error response
{
  "error": {
    "code": "unauthenticated",
    "message": "Sign in or provide an API key to continue.",
    "next_action": {
      "kind": "sign_in",
      "title": "Sign in or create an account",
      "url": "/login"
    }
  }
}
403 (insufficient_scope)`forbidden` / `insufficient_scope` — the credential lacks permission.

`forbidden` / `insufficient_scope` — the credential lacks permission.

Example 403 error response
{
  "error": {
    "code": "insufficient_scope",
    "message": "This API key does not have the required scope for this action."
  }
}
404 (not_found)`not_found` — doesn't exist or isn't accessible to you (never 403).

`not_found` — doesn't exist or isn't accessible to you (never 403).

Example 404 error response
{
  "error": {
    "code": "not_found",
    "message": "We couldn't find that resource."
  }
}
409 (version_conflict)`conflict` / `version_conflict` (current state in `details.application`) / Idempotency-Key reuse.

`conflict` / `version_conflict` (current state in `details.application`) / Idempotency-Key reuse.

Example 409 error response
{
  "error": {
    "code": "version_conflict",
    "message": "This application was updated elsewhere. Refresh and try again."
  }
}
422 (unprocessable)`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

Example 422 error response
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
429 (rate_limited)`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

Example 429 error response
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
Was it helpful?