Docs
API 2026-05-27.dahlia Dashboard

API reference

6 operations, with parameters and examples.

A Checkout Session is a hosted payment page for one payment. Create a session with its line items, send the buyer to its url, and read the session or wait for checkout.session.completed. Each session pays through a PaymentIntent, made when the buyer first presses Pay: until then the session's payment_intent is null.

Send every request to https://api.fluveo.com/v1 with your secret key as a Bearer token. This page lists only what Fluveo serves; the OpenAPI file holds the same operations.

An operation or a parameter marked Preview works, but it is not locked yet and may change: what Preview means.

Creates a Checkout Session. Its PaymentIntent is made when the buyer pays; a setup session makes its SetupIntent at once#

POST/v1/checkout/sessionsrak_checkout_session_write

Headers
  • Idempotency-KeystringOptional

    Send a unique key, 1 to 255 characters, on every POST. A retry with the same key and the same body returns the first answer instead of acting twice (with Idempotent-Replayed: true); the same key with another body is refused. Keys are kept 7 days, except on POST /v1/checkout/sessions, POST /v1/checkout/sessions/{session} and POST /v1/webhook_endpoints, where a key holds 24 hours; webhook endpoint keys are also capped at the newest 32 per store and mode. Do not rely on a replay after that window. GET and DELETE ignore it.

  • Fluveo-VersionenumOptional

    Optional. The only version Fluveo serves is 2026-05-27.dahlia; any other value is refused with a 400. Every answer names that version in its own Fluveo-Version header, except the refusals Fluveo gives before it reads the request (no key, an unknown key, an unknown URL, a body that is not a form) and a file's bytes, which name no version and no Request-Id.

    One of: 2026-05-27.dahlia.

Body parameters
  • billing_address_collectionenumOptionalPreview

    auto (the country and, where it applies, the postal code) or required (the whole address). The paid session shows it in customer_details.address. On a Pix or Boleto session the payer form asks the whole address when required.

    One of: auto, required.

  • cancel_urlstringOptionalPreview

    Where the buyer goes if they leave the payment page. A card number in it is stored with each digit written X.

  • client_reference_idstringOptionalPreview

    Your own reference for this session, such as an order id, up to 200 characters.

  • currencystringOptional

    Three-letter ISO code. In setup mode it is required unless payment_method_types is sent; in payment mode it must be the line items' currency.

  • custom_fieldsarray of objectOptionalPreview

    Up to three fields the page asks the buyer to fill before paying: key, label[type]=custom with label[custom], type text, numeric or dropdown (dropdown[options][] with label and value), and optional. A text or numeric field takes minimum_length, maximum_length and default_value. The paid session shows each answer as its value; the page refuses an answer that reads as a card number. A card number in a key, label, option, default_value or custom_text is stored with each digit written X.

    7 child fields
  • customerstringOptional

    An existing customer id to attach to the session. In setup mode the card is saved to this customer.

  • customer_creationenumOptionalPreview

    if_required (the default) or always. With always, paying the session makes a Customer from its email and the cardholder name, and the session, its PaymentIntent and its charge name it. Not with customer.

    One of: always, if_required.

  • customer_emailstringOptional

    The buyer's email, filled in on the payment page.

  • expires_atintegerOptional

    When the session stops taking payment, a Unix timestamp. Default 24 hours after creation.

  • line_itemsarray of objectOptional

    What the buyer pays for, at most 100 lines. Each line takes quantity and either price, the id of one of the store's active one-time Prices, or price_data: currency, unit_amount or unit_amount_decimal, an optional tax_behavior, and product, the id of one of the store's Products, or product_data (name, with optional description, images, metadata, tax_code and unit_label). Fluveo makes an inactive Price and Product of a price_data line, read as POST /v1/prices reads them, so a refusal names the field under line_items[n][price_data]; a product_data that says the same as the first Product of its name takes that Product again. Required in payment mode; refused in setup mode.

    4 child fields
    • adjustable_quantityobjectOptional

      Lets the buyer change this line's quantity on the payment page until they pay: enabled (required; false keeps the quantity fixed and takes no bound), an optional minimum from 0 (default 0) and maximum from 1 to 999999 (default 99), the minimum below the maximum and the line's quantity within them. The line item shows the bounds the session keeps. Fluveo computes the amount on the server, the unit amount times the quantity the buyer picked, and refuses a quantity outside the bounds; the session's amount_total, its line items, its PaymentIntent and its events show the quantity and amount chosen. A minimum of 0 lets the buyer go down to 1, not remove the line.

      3 child fields
    • pricestringOptional

      The id of one of the store's active one-time Prices (price_...), in the store's currency. Send it or price_data, never both.

    • price_dataobjectRequired

      The price of one unit.

      6 child fields
      • currencystringRequired

        The currency, the store's own (usd or brl).

      • productstringOptional
      • product_dataobjectRequired

        The product.

        6 child fields
        • descriptionstringOptional

          The product's description, kept on the line's Product.

        • imagesarray of stringOptional

          Up to 8 image URLs, kept on the line's Product.

        • metadataobjectOptional

          Key-value pairs kept on the line's Product.

        • namestringRequired

          The product name shown to the buyer.

        • tax_codestringOptional

          A tax code (txcd_...), kept on the line's Product.

        • unit_labelstringOptional

          A label for one unit, at most 12 characters, kept on the line's Product.

      • tax_behaviorenumOptional

        inclusive, exclusive or unspecified, kept on the line's Price. Fluveo computes no tax, so the amount is the same.

        One of: exclusive, inclusive, unspecified.

      • unit_amountintegerRequired

        The price of one unit in the smallest unit of the currency.

      • unit_amount_decimalstringOptional

        The price of one unit in the smallest unit of the currency, as a decimal string, instead of unit_amount. It must be a whole number of minor units (2000 or 2000.00); a fraction of one, such as 2000.5, is refused on line_items[n], never rounded.

    • quantityintegerOptional

      How many units.

  • localeenumOptionalPreview

    The language of the hosted page: one of the Checkout locales listed here, written as listed (pt-BR, en-GB, zh-TW), or auto for the buyer's browser language. The session shows it as locale. A language the page has no text for shows English.

    One of: auto, bg, cs, da, de, el, en, en-GB, es, es-419, et, fi, fil, fr, fr-CA, hr, hu, id, it, ja, ko, lt, lv, ms, mt, nb, nl, pl, pt, pt-BR, ro, ru, sk, sl, sv, th, tr, vi, zh, zh-HK, zh-TW.

  • metadataobjectOptional

    Up to 50 key-value pairs of your own, sent as metadata[key]=value: keys of 1 to 40 characters, values up to 500. Keys starting with fluveo_ are reserved. On an update, an empty value removes a key.

  • modeenumRequired

    payment, or setup: a setup session saves the buyer's card with a SetupIntent and charges nothing (no line_items, amount_total null, payment_status no_payment_required).

    One of: payment, setup.

  • payment_intent_dataobjectOptionalPreview

    Settings for the PaymentIntent the session makes when the buyer pays: description, metadata, capture_method, setup_future_usage, receipt_email, shipping, statement_descriptor and statement_descriptor_suffix, each as POST /v1/payment_intents takes it.

    8 child fields
    • capture_methodenumOptional

      automatic or manual capture for the payment. manual holds a card payment only: beside pix or boleto it is refused, and payment_method_options[card][capture_method]=manual holds only the card payment there.

      One of: automatic, automatic_async, manual.

    • descriptionstringOptional

      Description of the PaymentIntent, up to 1000 characters.

    • metadataobjectOptional

      Key-value pairs copied to the PaymentIntent.

    • receipt_emailstringOptional

      The email the payment's receipt goes to.

    • setup_future_usageenumOptional

      on_session or off_session: the payment saves the buyer's card to the session's Customer (customer, or the one customer_creation=always makes), for later payments; off_session for charges without the buyer. Card only.

      One of: on_session, off_session.

    • shippingobjectOptional

      Where the order ships: name and address (line1 required), with phone, carrier and tracking_number.

      5 child fields
    • statement_descriptorstringOptional

      The statement descriptor of a Pix or Boleto payment, up to 22 characters. A card payment refuses it: send statement_descriptor_suffix.

    • Text Fluveo adds after the store's statement descriptor on a card payment, up to 22 characters.

  • payment_method_configurationstringOptionalPreview

    The id of the store's payment method configuration (the one GET /v1/payment_method_configurations lists); not together with payment_method_types.

  • payment_method_dataobjectOptionalPreview

    allow_redisplay: always, limited or unspecified, set on the card the session saves to the Customer (a setup session, or a payment session with payment_intent_data[setup_future_usage] or payment_method_options[card][setup_future_usage]) as that PaymentMethod's allow_redisplay. Without it, a setup session's card gets always. always is refused on a payment session without payment_intent_data[setup_future_usage], even when the card option saves the card. The session object does not show it.

    1 child field
  • Options for one payment method type of the page, keyed by the type: card, pix or boleto. Any other option answers parameter_unknown with the option as param.

    3 child fields
    • boletoobjectOptional

      Boleto options.

      1 child field
      • expires_after_daysintegerOptional

        How many days the Boleto stays payable, 0 to 60. Without it, 3.

    • cardobjectOptional

      Card options.

      3 child fields
      • capture_methodenumOptional

        manual: the card payment is only authorized, and you capture it later. Beside pix or boleto only a card payment waits for the capture; a Pix or a Boleto is captured when it is paid.

        One of: manual.

      • Ask for 3D Secure: automatic (when the bank asks), any (whenever possible) or challenge.

        One of: any, automatic, challenge.

      • setup_future_usageenumOptional

        on_session or off_session: the card the buyer pays with is saved for later payments. The session's PaymentIntent gets it as its card option, which wins over payment_intent_data[setup_future_usage] for card. A setup session refuses it.

        One of: off_session, on_session.

    • pixobjectOptional

      Pix options.

      1 child field
  • payment_method_typesarray of enumOptional

    Payment method types the page offers: card, and pix or boleto on a store that takes them. Without it, a payment session offers every method the store takes that its payment method configuration has on (pix and boleto only when the PaymentIntent is not captured by hand as a whole and does not set setup_future_usage), less any excluded_payment_method_types; a setup session offers card.

    One of: card, pix, boleto.

  • enabled=true makes the page ask a phone number, shown in E.164 as the paid session's customer_details.phone, on card and on Pix and Boleto sessions alike.

    1 child field
  • redirect_on_completionenumOptionalPreview

    Only with ui_mode=embedded_page. always (the default): the paid page sends the buyer to return_url. if_required and never: the buyer stays on the embedded page, since no payment method here needs a redirect to finish.

    One of: always, if_required, never.

  • return_urlstringOptionalPreview

    Only with ui_mode=embedded_page: where the buyer's browser goes once the session is paid, with {CHECKOUT_SESSION_ID} replaced by the session id. Required unless redirect_on_completion=never. A URL with no host is refused. A card number in it is stored with each digit written X.

  • setup_intent_dataobjectOptionalPreview

    Setup mode only: the SetupIntent the session makes takes this description and metadata.

    2 child fields
    • descriptionstringOptional

      Description of the SetupIntent, up to 1000 characters.

    • metadataobjectOptional

      Key-value pairs copied to the SetupIntent.

  • allowed_countries[]: the two-letter countries the page takes a shipping address in. The page asks a name and address; the PaymentIntent, its charge and the paid session's collected_information.shipping_details carry them, on card and on Pix and Boleto sessions alike.

    1 child field
  • success_urlstringOptional

    Where the buyer goes after paying. An http or https URL. A card number in it is stored with each digit written X.

  • ui_modeenumOptionalPreview

    hosted_page (or hosted, the default): the payment page at the session's url. embedded_page: the same page shown inside your own page; the session has no url, and its client_secret starts with the session id, so you mount the page at <checkout base>/c/<session id> in an iframe. Its client_secret is null once the session is no longer open.

    One of: hosted, hosted_page, embedded_page.

Use only the documented body parameters. Send a new Idempotency-Key with each new request, and the same key again only to retry that request.

Returns a checkout.session object.

Request
curl https://api.fluveo.com/v1/checkout/sessions \
  -H "Authorization: Bearer sk_test_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  --data-urlencode "line_items[0][price_data][currency]=usd" \
  --data-urlencode "line_items[0][price_data][product_data][name]=T-shirt" \
  --data-urlencode "line_items[0][price_data][unit_amount]=2000" \
  --data-urlencode "line_items[0][quantity]=1" \
  --data-urlencode "mode=payment" \
  --data-urlencode "success_url=https://example.com/thanks"
const response = await fetch("https://api.fluveo.com/v1/checkout/sessions", {
  method: "POST",
  headers: {
    "Authorization": "Bearer sk_test_...",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: new URLSearchParams([["line_items[0][price_data][currency]","usd"],["line_items[0][price_data][product_data][name]","T-shirt"],["line_items[0][price_data][unit_amount]","2000"],["line_items[0][quantity]","1"],["mode","payment"],["success_url","https://example.com/thanks"]]),
});
console.log(await response.json());
import uuid

import requests

response = requests.post(
    "https://api.fluveo.com/v1/checkout/sessions",
    headers={"Authorization": "Bearer sk_test_...", "Idempotency-Key": str(uuid.uuid4())},
    data=[("line_items[0][price_data][currency]", "usd"), ("line_items[0][price_data][product_data][name]", "T-shirt"), ("line_items[0][price_data][unit_amount]", "2000"), ("line_items[0][quantity]", "1"), ("mode", "payment"), ("success_url", "https://example.com/thanks")],
)
print(response.json())
<?php
$ch = curl_init("https://api.fluveo.com/v1/checkout/sessions");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_test_...",
        "Idempotency-Key: " . bin2hex(random_bytes(16)),
    ],
    CURLOPT_POSTFIELDS => "line_items%5B0%5D%5Bprice_data%5D%5Bcurrency%5D=usd&line_items%5B0%5D%5Bprice_data%5D%5Bproduct_data%5D%5Bname%5D=T-shirt&line_items%5B0%5D%5Bprice_data%5D%5Bunit_amount%5D=2000&line_items%5B0%5D%5Bquantity%5D=1&mode=payment&success_url=https%3A%2F%2Fexample.com%2Fthanks",
]);
echo curl_exec($ch);
Response (abridged example)
{
  "amount_subtotal": 2000,
  "amount_total": 2000,
  "created": 1767225600,
  "currency": "usd",
  "expires_at": 1767312000,
  "id": "cs_test_123",
  "livemode": false,
  "metadata": {},
  "mode": "payment",
  "object": "checkout.session",
  "payment_intent": "pi_123",
  "payment_method_types": [
    "card"
  ],
  "payment_status": "unpaid",
  "status": "open",
  "success_url": "https://example.com/thanks",
  "ui_mode": "hosted_page",
  "url": "https://checkout.example.com/c/cs_test_123"
}

Lists the store's Checkout Sessions#

GET/v1/checkout/sessionsrak_checkout_session_read

Query parameters
  • createdobjectOptionalPreview

    Filter on the creation time, a Unix timestamp: created=<t> for an exact match, or created[gt], created[gte], created[lt], created[lte].

  • customerstringOptional

    Only the sessions of this customer.

  • customer_detailsobjectOptional

    customer_details[email]: only the sessions whose buyer gave this email. An address that is not a valid email is refused with email_invalid.

    1 child field
  • ending_beforestringOptional

    Cursor: the id of the first object of the current page, to get the previous page. Do not send it with starting_after.

  • limitintegerOptional

    How many objects to return, from 1 to 100. Default 10.

  • payment_intentstringOptionalPreview

    Only the session that created this PaymentIntent.

  • starting_afterstringOptional

    Cursor: the id of the last object of the previous page, to get the next page. Do not send it with ending_before.

  • statusenumOptional

    Only sessions in this status.

    One of: open, complete, expired.

Headers
  • Fluveo-VersionenumOptional

    Optional. The only version Fluveo serves is 2026-05-27.dahlia; any other value is refused with a 400. Every answer names that version in its own Fluveo-Version header, except the refusals Fluveo gives before it reads the request (no key, an unknown key, an unknown URL, a body that is not a form) and a file's bytes, which name no version and no Request-Id.

    One of: 2026-05-27.dahlia.

Returns a list of checkout.session objects.

Request
curl -G https://api.fluveo.com/v1/checkout/sessions \
  -H "Authorization: Bearer sk_test_..." \
  --data-urlencode "status=complete"
const response = await fetch("https://api.fluveo.com/v1/checkout/sessions" + "?" + new URLSearchParams([["status","complete"]]), {
  method: "GET",
  headers: {
    "Authorization": "Bearer sk_test_...",
  },
});
console.log(await response.json());
import requests

response = requests.get(
    "https://api.fluveo.com/v1/checkout/sessions",
    headers={"Authorization": "Bearer sk_test_..."},
    params=[("status", "complete")],
)
print(response.json())
<?php
$ch = curl_init("https://api.fluveo.com/v1/checkout/sessions?status=complete");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_test_...",
    ],
]);
echo curl_exec($ch);
Response (abridged example)
{
  "data": [
    {
      "amount_subtotal": 2000,
      "amount_total": 2000,
      "created": 1767225600,
      "currency": "usd",
      "expires_at": 1767312000,
      "id": "cs_test_123",
      "livemode": false,
      "metadata": {},
      "mode": "payment",
      "object": "checkout.session",
      "payment_intent": "pi_123",
      "payment_method_types": [
        "card"
      ],
      "payment_status": "unpaid",
      "status": "open",
      "success_url": "https://example.com/thanks",
      "ui_mode": "hosted_page",
      "url": "https://checkout.example.com/c/cs_test_123"
    }
  ],
  "has_more": false,
  "object": "list",
  "url": "/v1/checkout/sessions"
}

Updates a Checkout Session's metadata, in any state; no other field can change#

POST/v1/checkout/sessions/{session}rak_checkout_session_write

Path parameters
  • sessionstringRequired

    The Checkout Session's id (cs_test_... in test mode).

Headers
  • Idempotency-KeystringOptional

    Send a unique key, 1 to 255 characters, on every POST. A retry with the same key and the same body returns the first answer instead of acting twice (with Idempotent-Replayed: true); the same key with another body is refused. Keys are kept 7 days, except on POST /v1/checkout/sessions, POST /v1/checkout/sessions/{session} and POST /v1/webhook_endpoints, where a key holds 24 hours; webhook endpoint keys are also capped at the newest 32 per store and mode. Do not rely on a replay after that window. GET and DELETE ignore it.

  • Fluveo-VersionenumOptional

    Optional. The only version Fluveo serves is 2026-05-27.dahlia; any other value is refused with a 400. Every answer names that version in its own Fluveo-Version header, except the refusals Fluveo gives before it reads the request (no key, an unknown key, an unknown URL, a body that is not a form) and a file's bytes, which name no version and no Request-Id.

    One of: 2026-05-27.dahlia.

Body parameters
  • metadataobjectOptional

    Up to 50 key-value pairs of your own, sent as metadata[key]=value: keys of 1 to 40 characters, values up to 500. Keys starting with fluveo_ are reserved. On an update, an empty value removes a key.

Use only the documented body parameters. Send a new Idempotency-Key with each new request, and the same key again only to retry that request.

Returns a checkout.session object.

Request
curl https://api.fluveo.com/v1/checkout/sessions/cs_123 \
  -H "Authorization: Bearer sk_test_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  --data-urlencode "metadata[order_id]=1042"
const response = await fetch("https://api.fluveo.com/v1/checkout/sessions/cs_123", {
  method: "POST",
  headers: {
    "Authorization": "Bearer sk_test_...",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: new URLSearchParams([["metadata[order_id]","1042"]]),
});
console.log(await response.json());
import uuid

import requests

response = requests.post(
    "https://api.fluveo.com/v1/checkout/sessions/cs_123",
    headers={"Authorization": "Bearer sk_test_...", "Idempotency-Key": str(uuid.uuid4())},
    data=[("metadata[order_id]", "1042")],
)
print(response.json())
<?php
$ch = curl_init("https://api.fluveo.com/v1/checkout/sessions/cs_123");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_test_...",
        "Idempotency-Key: " . bin2hex(random_bytes(16)),
    ],
    CURLOPT_POSTFIELDS => "metadata%5Border_id%5D=1042",
]);
echo curl_exec($ch);
Response (abridged example)
{
  "amount_subtotal": 2000,
  "amount_total": 2000,
  "created": 1767225600,
  "currency": "usd",
  "expires_at": 1767312000,
  "id": "cs_test_123",
  "livemode": false,
  "metadata": {},
  "mode": "payment",
  "object": "checkout.session",
  "payment_intent": "pi_123",
  "payment_method_types": [
    "card"
  ],
  "payment_status": "unpaid",
  "status": "open",
  "success_url": "https://example.com/thanks",
  "ui_mode": "hosted_page",
  "url": "https://checkout.example.com/c/cs_test_123"
}

Retrieves a Checkout Session#

GET/v1/checkout/sessions/{session}rak_checkout_session_read

Path parameters
  • sessionstringRequired

    The Checkout Session's id (cs_test_... in test mode).

Headers
  • Fluveo-VersionenumOptional

    Optional. The only version Fluveo serves is 2026-05-27.dahlia; any other value is refused with a 400. Every answer names that version in its own Fluveo-Version header, except the refusals Fluveo gives before it reads the request (no key, an unknown key, an unknown URL, a body that is not a form) and a file's bytes, which name no version and no Request-Id.

    One of: 2026-05-27.dahlia.

Returns a checkout.session object.

Request
curl https://api.fluveo.com/v1/checkout/sessions/cs_123 \
  -H "Authorization: Bearer sk_test_..."
const response = await fetch("https://api.fluveo.com/v1/checkout/sessions/cs_123", {
  method: "GET",
  headers: {
    "Authorization": "Bearer sk_test_...",
  },
});
console.log(await response.json());
import requests

response = requests.get(
    "https://api.fluveo.com/v1/checkout/sessions/cs_123",
    headers={"Authorization": "Bearer sk_test_..."},
)
print(response.json())
<?php
$ch = curl_init("https://api.fluveo.com/v1/checkout/sessions/cs_123");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_test_...",
    ],
]);
echo curl_exec($ch);
Response (abridged example)
{
  "amount_subtotal": 2000,
  "amount_total": 2000,
  "created": 1767225600,
  "currency": "usd",
  "expires_at": 1767312000,
  "id": "cs_test_123",
  "livemode": false,
  "metadata": {},
  "mode": "payment",
  "object": "checkout.session",
  "payment_intent": "pi_123",
  "payment_method_types": [
    "card"
  ],
  "payment_status": "unpaid",
  "status": "open",
  "success_url": "https://example.com/thanks",
  "ui_mode": "hosted_page",
  "url": "https://checkout.example.com/c/cs_test_123"
}

Expires an open Checkout Session, so the buyer can no longer pay through it#

POST/v1/checkout/sessions/{session}/expirerak_checkout_session_write

Path parameters
  • sessionstringRequired

    The Checkout Session's id (cs_test_... in test mode).

Headers
  • Idempotency-KeystringOptional

    Send a unique key, 1 to 255 characters, on every POST. A retry with the same key and the same body returns the first answer instead of acting twice (with Idempotent-Replayed: true); the same key with another body is refused. Keys are kept 7 days, except on POST /v1/checkout/sessions, POST /v1/checkout/sessions/{session} and POST /v1/webhook_endpoints, where a key holds 24 hours; webhook endpoint keys are also capped at the newest 32 per store and mode. Do not rely on a replay after that window. GET and DELETE ignore it.

  • Fluveo-VersionenumOptional

    Optional. The only version Fluveo serves is 2026-05-27.dahlia; any other value is refused with a 400. Every answer names that version in its own Fluveo-Version header, except the refusals Fluveo gives before it reads the request (no key, an unknown key, an unknown URL, a body that is not a form) and a file's bytes, which name no version and no Request-Id.

    One of: 2026-05-27.dahlia.

Use only the documented body parameters. Send a new Idempotency-Key with each new request, and the same key again only to retry that request.

Returns a checkout.session object.

Request
curl -X POST https://api.fluveo.com/v1/checkout/sessions/cs_123/expire \
  -H "Authorization: Bearer sk_test_..." \
  -H "Idempotency-Key: $(uuidgen)"
const response = await fetch("https://api.fluveo.com/v1/checkout/sessions/cs_123/expire", {
  method: "POST",
  headers: {
    "Authorization": "Bearer sk_test_...",
    "Idempotency-Key": crypto.randomUUID(),
  },
});
console.log(await response.json());
import uuid

import requests

response = requests.post(
    "https://api.fluveo.com/v1/checkout/sessions/cs_123/expire",
    headers={"Authorization": "Bearer sk_test_...", "Idempotency-Key": str(uuid.uuid4())},
)
print(response.json())
<?php
$ch = curl_init("https://api.fluveo.com/v1/checkout/sessions/cs_123/expire");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_test_...",
        "Idempotency-Key: " . bin2hex(random_bytes(16)),
    ],
    CURLOPT_POSTFIELDS => "",
]);
echo curl_exec($ch);
Response (abridged example)
{
  "amount_subtotal": 2000,
  "amount_total": 2000,
  "created": 1767225600,
  "currency": "usd",
  "expires_at": 1767312000,
  "id": "cs_test_123",
  "livemode": false,
  "metadata": {},
  "mode": "payment",
  "object": "checkout.session",
  "payment_intent": "pi_123",
  "payment_method_types": [
    "card"
  ],
  "payment_status": "unpaid",
  "status": "open",
  "success_url": "https://example.com/thanks",
  "ui_mode": "hosted_page",
  "url": "https://checkout.example.com/c/cs_test_123"
}

Lists a Checkout Session's line items#

GET/v1/checkout/sessions/{session}/line_itemsrak_checkout_session_read

Path parameters
  • sessionstringRequired

    The Checkout Session's id (cs_test_... in test mode).

Query parameters
  • ending_beforestringOptionalPreview

    Cursor: the id of the first object of the current page, to get the previous page. Do not send it with starting_after.

  • limitintegerOptional

    How many objects to return, from 1 to 100. Default 10.

  • starting_afterstringOptional

    Cursor: the id of the last object of the previous page, to get the next page. Do not send it with ending_before.

Headers
  • Fluveo-VersionenumOptional

    Optional. The only version Fluveo serves is 2026-05-27.dahlia; any other value is refused with a 400. Every answer names that version in its own Fluveo-Version header, except the refusals Fluveo gives before it reads the request (no key, an unknown key, an unknown URL, a body that is not a form) and a file's bytes, which name no version and no Request-Id.

    One of: 2026-05-27.dahlia.

Returns a list of item objects.

Request
curl https://api.fluveo.com/v1/checkout/sessions/cs_123/line_items \
  -H "Authorization: Bearer sk_test_..."
const response = await fetch("https://api.fluveo.com/v1/checkout/sessions/cs_123/line_items", {
  method: "GET",
  headers: {
    "Authorization": "Bearer sk_test_...",
  },
});
console.log(await response.json());
import requests

response = requests.get(
    "https://api.fluveo.com/v1/checkout/sessions/cs_123/line_items",
    headers={"Authorization": "Bearer sk_test_..."},
)
print(response.json())
<?php
$ch = curl_init("https://api.fluveo.com/v1/checkout/sessions/cs_123/line_items");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_test_...",
    ],
]);
echo curl_exec($ch);

The checkout.session object#

Ids start with cs_.

Attributes

The item object#

Attributes