# Fixes API

> Engine-verified, platform-specific fixes for failing findings: Stripe Checkout code, Payment Link updates, Shopify blocks, snippet disclosures and the hosted cancellation page.

| Operation | Endpoint |
|---|---|
| [Get the fix for a finding](#retrieveFindingFix) | `GET /v1/findings/{finding}/fix` |
| [List fix plans for a site](#listSiteFixes) | `GET /v1/sites/{site}/fixes` |

## The Fix object

An engine-verified, platform-specific fix.

| Field | Type | Description |
|---|---|---|
| `id` | string | Unique identifier of the fix (fix_…). |
| `object` | enum | String representing the object's type. Always "fix". |
| `livemode` | boolean | true for live-mode objects, false for test mode (ck_test_ keys act on an isolated sandbox). |
| `site` | string | The site. |
| `finding` | string \| null | Finding this fix addresses (null for site-level fix plans). |
| `group` | enum | Area of the fix. One of `signup`, `cancellation`, `other`. |
| `kind` | string \| null | stripe_checkout, stripe_payment_link, shopify, html or hosted_cancellation. |
| `title` | string | Title. |
| `summary` | string | What the fix does. |
| `check_ids` | array of strings | Checks it addresses. |
| `steps` | array of strings | Steps. |
| `artifacts` | array of FixArtifacts | Code / markup to apply. |
| `texts` | object \| null | Verified disclosure texts (snake_case keys). |
| `one_click` | object \| null | One-click option available in the dashboard, when there is one. |
| `verification` | object \| null | How the engine verified the fixed texts pass the checks. |
| `problems` | array of strings | Why parts of the fix could not be generated (e.g. plan terms unknown). |
| `remediation` | Remediation \| null | How to fix the finding (see also the fixes resource and compliance plans). |

## Get the fix for a finding {#retrieveFindingFix}

`GET /v1/findings/{finding}/fix`

The concrete change that makes the finding pass: verified disclosure text and code for the detected platform, or the generic remediation. Apply it, then re-scan (createScan) or re-evaluate.

**Scope** `fixes:read` · **Operation** `retrieveFindingFix`

SDK: `checkbox.fixes.retrieve()` (Node) · `checkbox.fixes.retrieve()` (Python). MCP / agents: operation `retrieveFindingFix`.

#### Parameters

| Parameter | In | Type | Description |
|---|---|---|---|
| `finding` **required** | path | string | Unique identifier of the finding (fnd_…). |
| `plan` | query | string | Billing-platform plan/price id to write the disclosure for. |
| `cancel_url` | query | string | Cancellation URL to state (defaults to the hosted page or billing portal). |
| `target` | query | enum | Where the sign-up happens (default: detected). One of `stripe_checkout`, `stripe_payment_link`, `shopify`, `html`. |

#### Returns

Returns a [Fix](https://checkbox.site/docs/api/fixes#the-fix-object) object.

Errors use the [standard envelope](https://checkbox.site/docs/api/errors) with a stable `code` and, where useful, `next_action`.

```curl
curl https://app.checkbox.site/v1/findings/fnd_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/fix \
  -u "$CHECKBOX_SECRET_KEY:"
```
```node
import Checkbox from '@checkbox-site/cli';

const checkbox = new Checkbox(process.env.CHECKBOX_SECRET_KEY);

const fixe = await checkbox.fixes.retrieve('fnd_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b');
console.log(fixe);
```
```python
import os
from checkbox import Checkbox

checkbox = Checkbox(os.environ["CHECKBOX_SECRET_KEY"])

fixe = checkbox.fixes.retrieve("fnd_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b")
print(fixe)
```

```json title="Response"
{
  "id": "fix_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b",
  "object": "fix",
  "livemode": false,
  "site": "site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b",
  "finding": "fnd_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b",
  "group": "signup",
  "kind": "stripe_checkout",
  "title": "Add the renewal disclosure to Stripe Checkout",
  "summary": "Adds consent and terms text verified against the rules.",
  "check_ids": [
    "signup.disclosure_clear_conspicuous"
  ],
  "steps": [
    "Replace the Checkout Session parameters with the code below"
  ],
  "artifacts": [
    {
      "id": "stripe-checkout-node",
      "title": "Stripe Checkout (Node.js)",
      "kind": "code",
      "language": "javascript",
      "filename": "checkout.js",
      "code": "const session = await stripe.checkout.sessions.create({ … })",
      "diff": null
    }
  ],
  "texts": null,
  "one_click": null,
  "verification": null,
  "problems": [],
  "remediation": {
    "summary": "Show the auto-renewal terms next to the subscribe button.",
    "steps": [
      "Add the disclosure above the button"
    ],
    "platform": "stripe",
    "suggested_copy": "Your subscription renews automatically every month at $9.99 until you cancel.",
    "snippet": {
      "language": "html",
      "code": "<p class=\"renewal-terms\">…</p>"
    }
  }
}
```

## List fix plans for a site {#listSiteFixes}

`GET /v1/sites/{site}/fixes`

Site-level fix plans: the sign-up disclosure fix and the cancellation fix (hosted cancellation page), each with the checks it covers.

**Scope** `fixes:read` · **Operation** `listSiteFixes`

SDK: `checkbox.fixes.list()` (Node) · `checkbox.fixes.list()` (Python). MCP / agents: operation `listSiteFixes`.

#### Parameters

| Parameter | In | Type | Description |
|---|---|---|---|
| `site` **required** | path | string | Unique identifier of the site (site_…). |
| `plan` | query | string | Billing-platform plan/price id to write the disclosure for. |
| `cancel_url` | query | string | Cancellation URL to state (defaults to the hosted page or billing portal). |
| `target` | query | enum | Where the sign-up happens (default: detected). One of `stripe_checkout`, `stripe_payment_link`, `shopify`, `html`. |

#### Returns

Returns a list (`{ object: "list", data, has_more, url }`) of [Fix](https://checkbox.site/docs/api/fixes#the-fix-object) objects.

Errors use the [standard envelope](https://checkbox.site/docs/api/errors) with a stable `code` and, where useful, `next_action`.

```curl
curl https://app.checkbox.site/v1/sites/site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/fixes \
  -u "$CHECKBOX_SECRET_KEY:"
```
```node
import Checkbox from '@checkbox-site/cli';

const checkbox = new Checkbox(process.env.CHECKBOX_SECRET_KEY);

const fixes = await checkbox.fixes.list('site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b');
console.log(fixes.data);
```
```python
import os
from checkbox import Checkbox

checkbox = Checkbox(os.environ["CHECKBOX_SECRET_KEY"])

fixes = checkbox.fixes.list("site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b")
print(fixes["data"])
```

```json title="Response"
{
  "object": "list",
  "data": [
    {
      "id": "fix_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b",
      "object": "fix",
      "livemode": false,
      "site": "site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b",
      "finding": "fnd_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b",
      "group": "signup",
      "kind": "stripe_checkout",
      "title": "Add the renewal disclosure to Stripe Checkout",
      "summary": "Adds consent and terms text verified against the rules.",
      "check_ids": [
        "signup.disclosure_clear_conspicuous"
      ],
      "steps": [
        "Replace the Checkout Session parameters with the code below"
      ],
      "artifacts": [
        {
          "id": "stripe-checkout-node",
          "title": "Stripe Checkout (Node.js)",
          "kind": "code",
          "language": "javascript",
          "filename": "checkout.js",
          "code": "const session = await stripe.checkout.sessions.create({ … })",
          "diff": null
        }
      ],
      "texts": null,
      "one_click": null,
      "verification": null,
      "problems": [],
      "remediation": {
        "summary": "Show the auto-renewal terms next to the subscribe button.",
        "steps": [
          "Add the disclosure above the button"
        ],
        "platform": "stripe",
        "suggested_copy": "Your subscription renews automatically every month at $9.99 until you cancel.",
        "snippet": {
          "language": "html",
          "code": "<p class=\"renewal-terms\">…</p>"
        }
      }
    }
  ],
  "has_more": false,
  "url": "/v1/sites"
}
```