---
title: "List open payment checkouts for reviewed live gifts"
method: GET
path: "/checkout"
tags: ["Billing", "Human only"]
---

# List open payment checkouts for reviewed live gifts

`GET /checkout`

## Request

- Base URL: `https://gtmswag.com/api/v1`
- URL: `https://gtmswag.com/api/v1/checkout`
- Auth: API key in cookie `gtm_session`

Human only: A signed-in owner or admin does this in the browser at gtmswag.com. API keys and OAuth connections receive 403 HUMAN_APPROVAL_REQUIRED with a `url` to hand to that person. Live workspaces only. Supply exactly one of `sendId` or `campaignId`.

## Query parameters

- `sendId` string
- `campaignId` string

## Response `200`

Success: `{"data": GiftCheckoutList}`.

- GiftCheckoutListResponse: The success body: `{"data": GiftCheckoutList}`.
  - `data` GiftCheckoutList, required: Open payment checkouts for reviewed live gifts.
    - `items` object[], required
      - `id` string, required: Payment checkout ID (pay_).
      - `state` 'creating' | 'open' | 'hold' | 'paid' | 'expired' | 'refunded', required: creating or open while it can be paid; then paid or expired.
      - `url` string, nullable, required: The Stripe payment page a person opens, once created.
      - `expiresAt` integer, required: When the checkout expires, Unix seconds.
      - `totalCents` integer, required
      - `idempotencyKey` string, required
      - `sendIds` string[], required: The gifts it pays for.

## Other responses

- `400`: Bad request: `VALIDATION_ERROR`. Each example says when.
- `401`: Not authenticated: `AUTH_REQUIRED`. no credentials, or an OAuth token on a route that only takes workspace keys; the key is malformed, unknown or revoked.
- `403`: Forbidden: `HUMAN_APPROVAL_REQUIRED`, `TEAM_MANAGER_REQUIRED`, `LIVE_NOT_READY`. Each example says when.
- `429`: Too many requests: `RATE_LIMIT`. more than 240 requests in the current minute for this workspace (REST and MCP share the limit); wait `retryAfterMs`.
- `default`: Any other refusal or failure, such as 403 CSRF (a cross-origin `Origin` header), 403 HTTPS_REQUIRED or 500 INTERNAL_ERROR, with what to do next.

---

[API](https://skmtc.dev/gtmswag/apis/gtm-swag-api.md) · [All operations](https://skmtc.dev/gtmswag/apis/gtm-swag-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gtmswag/apis/gtm-swag-api/revisions/9ff86fa99afe?raw)