Skip to main content
POST
cURL
Create a short-lived Integrations Hub session. Send only launch_url to the borrower. AMLOK captures consent and manages provider authorization and ingestion. All IDs and cursors must belong to the authorized workspace and environment. Required scope: connections:write. Examples use synthetic IDs. Replace them with values returned by your environment.

Authorizations

Authorization
string
header
required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

Idempotency-Key
string
required

Stable for one intended command and its retries, scoped to key workspace/environment and operation. Mismatched body returns 409. Full response replay 24 hours; durable receipt remains.

Minimum string length: 1

Body

application/json

Launch an already published console-configured Hub for this borrower. Enabled integrations and categories come from embedding_version_id and cannot be overridden here. The backend verifies its own borrower association before creating a session; only the short-lived launch URL reaches the browser.

borrower_id
string
required

Opaque identifier, authorized within the API key workspace and environment.

Minimum string length: 1
embedding_version_id
string
required

Opaque identifier, authorized within the API key workspace and environment.

Minimum string length: 1
purpose
enum<string>
required

Purpose for CreateEmbeddingSession. Constraints, requiredness and allowed values are defined by this schema.

Available options:
connect,
reauthorize
return_url
string<uri>
required

Must match an institution-approved return URL. No arbitrary redirects.

Minimum string length: 1

Explicit purposes presented for borrower authorization; must be a subset of the published Hub purposes. Credit assessment alone does not permit monitoring.

Minimum array length: 1
Available options:
credit_assessment,
continuous_monitoring
connection_id
string

Opaque identifier, authorized within the API key workspace and environment.

Minimum string length: 1
origination_id
string

Opaque identifier, authorized within the API key workspace and environment.

Minimum string length: 1
embed_origin
string<uri>

Exact HTTPS parent origin approved for this Hub. Omit for full-page redirects. No path, wildcard or opaque origin.

Minimum string length: 1
monitor_id
string

Monitor whose open requirement this session addresses. Mutually exclusive with origination_id.

Minimum string length: 1
requirement_id
string

Open requirement on origination_id or monitor_id; completion atomically associates the authorized connection with that resource.

Minimum string length: 1

Response

Successful response.

data
object
required

Completion means the connection journey completed, not that source ingestion or underwriting completed. URLs are returned only to authorized callers; never send in events.

meta
object
required