@@ -53,16 +53,27 @@ def healthz_status(request):
 
 urlpatterns = []
 
-urlpatterns += [
-    path('api/v1/schema/', SpectacularAPIView.as_view(), name='schema'),
-    path(
-        'api/v1/schema/swagger-ui/',
-        SpectacularSwaggerView.as_view(url_name='schema'),
-    ),
-]
+if settings.DEBUG:
+    urlpatterns += [
+        path('api/v1/schema/', SpectacularAPIView.as_view(), name='schema'),
+        path(
+            'api/v1/schema/swagger-ui/',
+            SpectacularSwaggerView.as_view(url_name='schema'),
+        ),
+        path(
+            'api/v1/schema-public/',
+            SpectacularAPIView.as_view(urlconf=['backend.public']),
+            name='schema-public',
+        ),
+        path(
+            'api/v1/public-view/',
+            SpectacularSwaggerView.as_view(url_name='schema-public'),
+        ),
+    ]
+    api.docs_url = '/docs'
+    compatibility_api.docs_url = '/docs'
+
 urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
-api.docs_url = '/docs'
-compatibility_api.docs_url = '/docs'
 
 urlpatterns += [
     path('api/v1/healthz/', healthz_status),
@@ -73,16 +84,7 @@ urlpatterns += [
     path('api/v1/reports/', include('reports.urls')),
     path('api/v1/chats/', include('tools.chats.urls')),
     path('api/v1/media/', include('tools.media.urls')),
-    path(
-        'api/v1/schema-public/',
-        SpectacularAPIView.as_view(urlconf=['backend.public']),
-        name='schema-public',
-    ),
     path('api/v1/public/', include('tools.public_api.urls')),
-    path(
-        'api/v1/public-view/',
-        SpectacularSwaggerView.as_view(url_name='schema-public'),
-    ),
     path('api/v1/api/', api.urls),
     path('api/v1/', compatibility_api.urls),
 ]
@@ -211,7 +211,10 @@ async def create_payment_link(request, body: NewSubscriptionSchema):
     try:
         if request.auth.account_type not in {'regular', 'business_host'}:
             raise HttpError(401, 'Unauthorized')
-        payment_plan = await PaymentPlan.objects.aget(uid=body.uid)
+        is_corporate = request.auth.account_type == 'business_host'
+        payment_plan = await PaymentPlan.objects.aget(
+            uid=body.uid, price__gt=0, is_corporate=is_corporate, is_visible=True, individual=False
+        )
         payment_url = await PaymentService(request.auth).create_payment_link(payment_plan)
         logger.info(
             'Payment link endpoint completed: email=%s plan_uid=%s',
@@ -99,6 +99,13 @@ class PlansAPITest(BaseAuthorizedAPITest):
         cls.hidden_plan = PaymentPlan.objects.create(
             price=500, tokens_per_plan=50, is_corporate=False, is_visible=False
         )
+        cls.individual_plan = PaymentPlan.objects.create(
+            price=300,
+            tokens_per_plan=30,
+            is_corporate=False,
+            is_visible=True,
+            individual=True,
+        )
 
     def test_unauthorized_status_code(self) -> None:
         response = self.client.get(self.ENDPOINT)
@@ -147,6 +154,14 @@ class PlansAPITest(BaseAuthorizedAPITest):
         plan_uids = [str(plan['uid']) for plan in plans]
         self.assertNotIn(str(self.hidden_plan.uid), plan_uids)
 
+    def test_create_payment_link_rejects_hidden_plan(self) -> None:
+        response = self.post(data={'uid': str(self.hidden_plan.uid)})
+        self.assertEqual(response.status_code, 400)
+
+    def test_create_payment_link_rejects_individual_plan(self) -> None:
+        response = self.post(data={'uid': str(self.individual_plan.uid)})
+        self.assertEqual(response.status_code, 400)
+
     def test_zero_price_plans(self) -> None:
         plans = self.get().json()
         plan_uids = [str(plan['uid']) for plan in plans]