Get the payee's wallet balance
The payee's wallet balance — the SAME numbers the hosted payouts portal
shows — so a consuming platform's own wallet (e.g. 8x-core) stays in sync with
the portal by construction rather than re-deriving from its own ledger. Like
/readiness, this is a pull backstop: always correct even if a balance
webhook was missed.
The cent amounts describe where the payee's money is in the payout lifecycle:
withdrawableCents— still-owed disbursements, not yet released into a payout. This is what the payee could withdraw right now.onTheWayCents— genuinely in transit (submitted to a rail, awaiting settlement) — not money that still needs the payee to act.actionNeededCents— money the creator must still claim/withdraw before it can move (e.g. a Grade payout that's been triggered but is unclaimed, or a SideShift leg-1 awaiting the payee) — NOT yet on the way.landedCents— lifetime settled (paid). A cumulative total, not a current balance.heldBelowMinimumCents— money held only because it's under the rail's economical floor (abelow_min_payouthold that self-releases once the balance clears the floor). 0 when nothing is floor-held.minPayoutCents— the floor that held money must clear to release: the floor of the rail it's held on, or (when nothing is held) the payee's currently-resolved active rail. 0 if the rail can't be resolved.provider— the payee's single resolved payout rail (null if none). Lets a consumer tell whetheractionNeededCentsis SideShift leg-1 money already staged in the wallet (withdrawable now via leg 2) or a Grade claim / Stripe auto-send.
currency is the ISO 4217 code for these amounts.
Required scope: payees:read.
Authorization
bearerAuth x8xTimestamp x8xSignature Your client API key. Authorization: Bearer <API key>. The gateway stores
only sha256(key); keys are rotatable and revocable.
In: header
Unix time (seconds) at which the request was signed. Must be within 300s of gateway time.
In: header
Hex HMAC-SHA256(signingSecret, "{timestamp}.{rawBody}") over the exact raw
request body (empty string for GET). Defeats tampering and replay.
In: header
Path Parameters
The gateway payee id.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
// The SDK has no helper for this endpoint yet. Use the cURL tab, or// call it with any HTTP client: the SDK's request signing scheme is// documented under Authorization on this page.{ "withdrawableCents": 0, "onTheWayCents": 0, "actionNeededCents": 0, "landedCents": 0, "heldBelowMinimumCents": 0, "minPayoutCents": 0, "currency": "string", "provider": "string"}Check payout readiness GET
The **pull backstop**: can we pay this person right now, via which rail, and if not, what's blocking? Always correct even if a `payee.updated` webhook was missed. `blockers` is a list of machine-readable reasons (e.g. `kyc_incomplete`, `not_payable`). **Required scope:** `payees:read`.
Email the payee a hosted portal (wallet) link POST
Send the payee a signed, single-use link that lands them **already authenticated** in their gateway portal wallet (`/portal`) — no separate gateway login. The link is delivered **only to the payee's own email address** and is **never returned in the response**: it is a bearer credential that establishes a browser session **and** satisfies the withdraw re-authentication step-up for roughly one hour, and a portal session spans every client that shares the payee's email. Returning it would let a client obtain a working session for an address it merely asserted, so the API hands back only a delivery acknowledgement. The link is single-use (enforced by the gateway's auth provider) — that's also why this is gated by its own scope rather than `onboarding:write`. **Required scope:** `portal:write`.