---
title: "Resolve a 3DS payment-recovery link"
method: GET
path: "/v1/payments/recovery/{token}"
tags: ["payments"]
---

# Resolve a 3DS payment-recovery link

`GET /v1/payments/recovery/{token}`

## Request

- Base URL: `https://api.getmyhotels.com`
- URL: `https://api.getmyhotels.com/v1/payments/recovery/{token}`
- Auth: none declared

Runs `payment.resolveCheckoutRecovery`. Public by design — the caller is a guest or signed-in customer who followed the `requires_action` email link with no other credential (critical decision #4). Never throws for an unknown, expired, or wrong-state token: every outcome, including one that doesn't resolve to anything, is a distinct `kind` in the 200 body, so a probing caller and a legitimate one get the same shape of answer either way. When `kind` is `resumable`, the response carries a freshly-fetched Stripe client secret — re-fetched from Stripe on every call, never read from a stored column, and never logged — for the SAME PaymentIntent the original checkout created. Rate-limited like the rest of the write-tier payment surface even though this route never charges anything, because it calls out to Stripe on every resolve.

## Path parameters

- `token` string, required

## Response `200`

Success

- unknown

## Other responses

- `400`: Request validation failed or the router rejected the input
- `426`: Reported X-GMH-App-Version is below the supported minimum — the app must update
- `500`: Unexpected server error (opaque; details stay in logs)

---

[API](https://skmtc.dev/getmyhotels/apis/getmyhotels-rest-api.md) · [All operations](https://skmtc.dev/getmyhotels/apis/getmyhotels-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getmyhotels/apis/getmyhotels-rest-api/revisions/cba24a9c13f0?raw)