---
title: "Create Portal Session Endpoint"
method: POST
path: "/v1/checkout/portal"
tags: ["checkout"]
---

# Create Portal Session Endpoint

`POST /v1/checkout/portal`

## Request

- Base URL: `https://app.teetra.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.teetra.com/v1/checkout/portal`
- Auth: none declared

Create a Stripe Customer Portal Session (Path B) for the AUTHENTICATED consumer's OWN customer.

IDOR fix (R3, issue 1): the Stripe ``customer_id`` is never taken from the request — it
is looked up from the verified consumer token's own ``Subscription`` linkage. A caller
can only ever reach the customer their own subscription is linked to.

## Request body

- CustomerPortalRequest: Request payload to create a customer portal session. Deliberately has NO ``customer_id`` field. Accepting one from the caller was the IDOR (see module docstring) — the Stripe customer is resolved solely from the verified consumer access token's own subscription linkage, never from anything the request body supplies.
  - `return_url` string, nullable: Return URL from Customer Portal

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/teetra/apis/warrant.md) · [All operations](https://skmtc.dev/teetra/apis/warrant/llms.txt) · [OpenAPI document](https://skmtc.dev/teetra/apis/warrant/revisions/0e272d563cc4?raw)