---
updatedAt: 2026-10-16T08:11:00.482Z
---

Fetch the complete documentation index at: https://docs.avvio.xyz/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Get a payout link

`GET https://api.avvio.xyz/business/api/v1/payout-links/{token}`

Returns what the recipient's page renders.

**Takes no credential.** The signed token in the URL is the credential,
which is why it is short-lived and single-use.

Returns the amount, the fields that corridor needs, and saved
destinations masked to name, label, and last four digits. It returns no
organization id, no `endUserId`, and never full bank details.
A public route that echoes back what was typed turns a forwarded link
into a disclosure of someone's account number.

Expired, spent, forged and tampered tokens are all a flat `404`. A
stranger probing links learns nothing from the difference.

## Parameters

- `token` (path, required) — Opaque signed bearer token from the link URL. It is JWT-shaped but its claims are not a public contract; do not decode, construct, log, or store it beyond the recipient session.

## Example

```bash
curl -s "$AVVIO_BASE_URL/payout-links/$token"
```

## Responses

- `200` — What to render.
- `404` — Not valid (expired, already spent, or never existed).
- `429` — Too many requests. The default ceiling is **100 requests per minute per API credential** on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies. Obey `Retry-After`; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same `Idempotency-Key`.

Machine contract: [partner-payouts.openapi.yaml](/partner-payouts.openapi.yaml), operation `resolvePayoutLink`.