---
title: "Billing Portal Session"
method: POST
path: "/me/billing/portal"
---

# Billing Portal Session

`POST /me/billing/portal`

## Request

- Base URL: `https://api.xhostd.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xhostd.com/me/billing/portal`
- Auth: none declared

Answer the URL that opens the caller's billing management.

A POST, not a GET, for the reason ``POST /me/billing/checkout``
states: the route MINTS a single-use portal session, and a GET is
prefetchable, so a link scanner would burn the session before the
person clicks. The route demands ``billing:write``, which
the console session mint alone grants: the portal opens the invoices,
the payment method and a cancel, so an agent credential answers 403
(TEN-03).

The route mints when the box holds a Paddle client AND the caller's
granting row names a Paddle customer. It answers 503 when either is
missing: an unconfigured box has nothing to mint against, and a row
with an empty customer id came from a payload that carried none,
which is an operator's problem rather than the user's retry
(design/OPS-RUNBOOK.md).

A caller with no granting subscription answers 409: there is no
subscription to manage, which is the checkout route's shape for a
state the console must name rather than retry.

The route caches nothing. A Paddle portal session is single-use, so a
cached link would hand the second clicker a spent URL.

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xhostd/apis/xhostd-public.md) · [All operations](https://skmtc.dev/xhostd/apis/xhostd-public/llms.txt) · [OpenAPI document](https://skmtc.dev/xhostd/apis/xhostd-public/revisions/bf439c4d1789?raw)