---
title: "Billing Add Credits"
method: POST
path: "/api/billing/add-credits"
tags: ["billing", "team"]
---

# Billing Add Credits

`POST /api/billing/add-credits`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/billing/add-credits`
- Auth: none declared

Add prepaid credits to a target user (admin only).

H-15 (Security Audit 2026-05-27, OWNER-ratified 2026-05-28 wave-19):
the prior implementation passed `user["id"]` (the admin's own ID) to
`add_credits`, meaning admins could only credit themselves. This forced
workarounds via direct DB manipulation that bypassed the per-request +
daily caps and left no audit trail. Now requires `target_user_id` in
the request body, validates it exists in `users`, blocks admin
self-credit (anti-self-dealing), and emits structured audit logs
BEFORE + AFTER the credit grant so the trail survives even when the
underlying call raises.

## Response `200`

Successful Response

- BillingActionResponse: Loose response_model for billing routes (Stripe portal, checkout sessions, webhooks). Varies by action.

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)