The hotel's onboarding link: a page that continues to Stripe

GET

/v1/onboarding-links/{token}

curl --request GET \
  --url https://api.aerandil.com/v1/onboarding-links/example

• Production API

Public — the hotel holds no bearer of ours. The link the operator sends the hotel, and where Stripe’s hosted onboarding sends it when its own link has expired, been opened before, or been spent by a messaging client’s preview. Answers a small self-contained HTML page — the house’s name and one button, “Continue to Stripe”, a form that POSTs to this same address — and spends nothing: a mail scanner or a link preview that fetches the link leaves it as it was. No script, no external asset (Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'), Referrer-Policy: no-referrer. Every refusal — forged, expired, used, replaced, a closed account — is the same 404, which says nothing about whether the account exists, and Stripe is asked nothing. Rate-limited per IP like /oauth/token.

Parameters

Path Parameters

token

required

string

The signed one-use token the operator’s onboarding link minted.

Responses

200

The page with the one button.

Media typetext/html

string

Headers

Cache-Control

string

Always no-store. Object and link state is live data and is never cacheable.

404

onboarding_link_not_found — expired, used, replaced or never ours.

Media typeapplication/json

Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.

object

error

required

object

code

required

Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).

string

instance_id

Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.

string

message

required

Human-readable explanation of the failure.

string

parameters

Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).

Example^generated

{
  "error": {
    "code": "example",
    "instance_id": "example",
    "message": "example",
    "parameters": "example"
  }
}

429

Per-IP rate limit exceeded (the /oauth/token limiter).

501

No card rail, or no public address, on this deployment.

Media typeapplication/json

Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.

object

error

required

object

code

required

Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).

string

instance_id

Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.

string

message

required

Human-readable explanation of the failure.

string

parameters

Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).

Example^generated

{
  "error": {
    "code": "example",
    "instance_id": "example",
    "message": "example",
    "parameters": "example"
  }
}