curl --request POST --fail-with-body --max-time 30 \
"${AMLOK_API_BASE_URL}/v1/connections" \
--header "Authorization: Bearer ${AMLOK_API_KEY}" \
--header "Accept: application/json" \
--header 'Idempotency-Key: idem_example_1001' \
--header 'Content-Type: application/json' \
--data '{
"subject_id": "biz_example",
"provider_id": "BANK-02",
"products": [
"transactions"
],
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}'import os
import requests
base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
'Idempotency-Key': 'idem_example_1001',
'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]
response = requests.request(
"POST", base_url + "/v1/connections",
headers=headers, timeout=30, allow_redirects=False,
json={'subject_id': 'biz_example',
'provider_id': 'BANK-02',
'products': ['transactions'],
'consent_id': 'con_example',
'redirect_uri': 'https://client.example.com/connected',
'state': 'synthetic-random-state-at-least-32-characters'},
)
response.raise_for_status()
print(response.json())
const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
"Accept": "application/json",
"Idempotency-Key": "idem_example_1001",
"Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/connections", {
method: "POST", headers,
redirect: "error", signal: AbortSignal.timeout(30000),
body: JSON.stringify({
"subject_id": "biz_example",
"provider_id": "BANK-02",
"products": [
"transactions"
],
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());{
"data": {
"id": "cnn_example",
"object": "connection",
"subject_id": "biz_example",
"created_at": "2026-10-23T14:00:00Z",
"updated_at": "2026-10-23T14:00:00Z",
"record_version": 1,
"source_refs": [],
"data_status": "pending",
"missing_fields": [],
"schema_version": "1.4.2",
"client_reference": "app-1029",
"provider_id": "BANK-02",
"provider_tenant_id": null,
"status": "pending",
"institution_id": null,
"institution_name": null,
"country": "CA",
"products": [
"transactions"
],
"scopes": [
"banking:read"
],
"consent_id": "con_example",
"last_successful_sync_at": null,
"next_refresh_at": null,
"history_available_from": null,
"reauth_required_at": null,
"error_code": null,
"sync_cursor": null
},
"meta": {
"request_id": "req_example",
"schema_version": "1.4.2",
"generated_at": "2026-10-23T14:00:00Z",
"data_status": "pending"
},
"action": {
"type": "authorize_connection",
"url": "https://connect.example.com/session",
"expires_at": "2026-10-23T14:15:00Z"
}
}Create connection
Start an authorized source-connection flow.
Required scope: connections:write. Return a short-lived authorization action; no provider secret in response. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Browser return parameters are connection_id, state and result (completed, cancelled or failed); failed returns a sanitized error_code. Verify the saved state and expected connection, then retrieve the connection server-side. The callback never proves consent or connection activation. No credentials or source data appear in return parameters. The state must be unpredictable, bound to the initiating browser session and accepted only once. Renew an expired link or reauthorization-required connection through POST /v1/connections//authorization. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.
curl --request POST --fail-with-body --max-time 30 \
"${AMLOK_API_BASE_URL}/v1/connections" \
--header "Authorization: Bearer ${AMLOK_API_KEY}" \
--header "Accept: application/json" \
--header 'Idempotency-Key: idem_example_1001' \
--header 'Content-Type: application/json' \
--data '{
"subject_id": "biz_example",
"provider_id": "BANK-02",
"products": [
"transactions"
],
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}'import os
import requests
base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
'Idempotency-Key': 'idem_example_1001',
'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]
response = requests.request(
"POST", base_url + "/v1/connections",
headers=headers, timeout=30, allow_redirects=False,
json={'subject_id': 'biz_example',
'provider_id': 'BANK-02',
'products': ['transactions'],
'consent_id': 'con_example',
'redirect_uri': 'https://client.example.com/connected',
'state': 'synthetic-random-state-at-least-32-characters'},
)
response.raise_for_status()
print(response.json())
const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
"Accept": "application/json",
"Idempotency-Key": "idem_example_1001",
"Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/connections", {
method: "POST", headers,
redirect: "error", signal: AbortSignal.timeout(30000),
body: JSON.stringify({
"subject_id": "biz_example",
"provider_id": "BANK-02",
"products": [
"transactions"
],
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());{
"data": {
"id": "cnn_example",
"object": "connection",
"subject_id": "biz_example",
"created_at": "2026-10-23T14:00:00Z",
"updated_at": "2026-10-23T14:00:00Z",
"record_version": 1,
"source_refs": [],
"data_status": "pending",
"missing_fields": [],
"schema_version": "1.4.2",
"client_reference": "app-1029",
"provider_id": "BANK-02",
"provider_tenant_id": null,
"status": "pending",
"institution_id": null,
"institution_name": null,
"country": "CA",
"products": [
"transactions"
],
"scopes": [
"banking:read"
],
"consent_id": "con_example",
"last_successful_sync_at": null,
"next_refresh_at": null,
"history_available_from": null,
"reauth_required_at": null,
"error_code": null,
"sync_cursor": null
},
"meta": {
"request_id": "req_example",
"schema_version": "1.4.2",
"generated_at": "2026-10-23T14:00:00Z",
"data_status": "pending"
},
"action": {
"type": "authorize_connection",
"url": "https://connect.example.com/session",
"expires_at": "2026-10-23T14:15:00Z"
}
}connections:write
Start an authorized source-connection flow.
Required scope: connections:write. Return a short-lived authorization action; no provider secret in response. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Browser return parameters are connection_id, state and result (completed, cancelled or failed); failed returns a sanitized error_code. Verify the saved state and expected connection, then retrieve the connection server-side. The callback never proves consent or connection activation. No credentials or source data appear in return parameters. The state must be unpredictable, bound to the initiating browser session and accepted only once. Renew an expired link or reauthorization-required connection through POST /v1/connections//authorization. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.
Product scope · Processing lifecycle · ErrorsAuthorizations
Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.
Headers
Optional caller correlation ID; the response includes AMLOK request_id.
Reuse for retries of the same intended command and identical payload. Retention: 24 hours.
Body
Subject whose source will be linked.
1An enabled provider identifier.
1Product IDs from this provider's products[].id in GET /v1/providers. Resource names are not interchangeable with product IDs. Reject unsupported values with 422 validation_error.
1Active authorization.
1Registered allowed return URL.
1^https://32 - 256Response
Start an authorized source-connection flow.