curl --request POST --fail-with-body --max-time 30 \
"${AMLOK_API_BASE_URL}/v1/connections/connection_example/authorization" \
--header "Authorization: Bearer ${AMLOK_API_KEY}" \
--header "Accept: application/json" \
--header 'Idempotency-Key: idem_example_1001' \
--header 'Content-Type: application/json' \
--data '{
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}'import os
import requests
base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
'Idempotency-Key': 'idem_example_1001',
'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]
response = requests.request(
"POST", base_url + "/v1/connections/connection_example/authorization",
headers=headers, timeout=30, allow_redirects=False,
json={'consent_id': 'con_example',
'redirect_uri': 'https://client.example.com/connected',
'state': 'synthetic-random-state-at-least-32-characters'},
)
response.raise_for_status()
print(response.json())
const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
"Accept": "application/json",
"Idempotency-Key": "idem_example_1001",
"Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/connections/connection_example/authorization", {
method: "POST", headers,
redirect: "error", signal: AbortSignal.timeout(30000),
body: JSON.stringify({
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());{
"data": {
"id": "connection_example",
"object": "connection",
"subject_id": "biz_example",
"created_at": "2026-10-23T14:00:00Z",
"updated_at": "2026-10-23T14:00:00Z",
"record_version": 1,
"source_refs": [],
"data_status": "partial",
"missing_fields": [],
"schema_version": "1.4.2",
"client_reference": "app-1029",
"provider_id": "BANK-02",
"provider_tenant_id": "item_example",
"status": "active",
"institution_id": "ins_example",
"institution_name": "Example Bank",
"country": "CA",
"products": [
"transactions",
"balance"
],
"scopes": [
"banking:read"
],
"consent_id": "con_01JAMLOK",
"last_successful_sync_at": null,
"next_refresh_at": null,
"history_available_from": "2025-10-22",
"reauth_required_at": null,
"error_code": "reauth_required",
"sync_cursor": "cur_example"
},
"meta": {
"request_id": "req_example",
"schema_version": "1.4.2",
"generated_at": "2026-10-23T14:00:00Z",
"data_status": "complete"
},
"action": {
"type": "redirect",
"url": "https://authorize.example.com/session/synthetic",
"expires_at": "2026-10-23T14:15:00Z"
}
}Renew connection authorization
Create a fresh short-lived authorization action on the existing pending, active or reauth_required connection. Preserve its ID, records and synchronization lineage. The consent must authorize the same subject, provider products and purposes. Validate redirect_uri against portal registration. Bind state to this connection and action; echo it on return. A new action invalidates any older unused action. An identical idempotent retry returns the same action, including its original expiry; use a new key when intentionally replacing an expired action. Reauthorization does not backfill data until a successful sync. Revoked or disconnected connections cannot be reopened; obtain new consent and create a new connection. Account cancellation rejects new processing immediately with 409 invalid_state. Read-only access lasts only until workspace deletion. No separate product charge or financial mutation is introduced. Browser return parameters are connection_id, state and result (completed, cancelled or failed); failed returns a sanitized error_code. Verify the saved state and expected connection, then retrieve the connection server-side. The callback never proves consent or connection activation. No credentials or source data appear in return parameters. The state must be unpredictable, bound to the initiating browser session and accepted only once. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.
curl --request POST --fail-with-body --max-time 30 \
"${AMLOK_API_BASE_URL}/v1/connections/connection_example/authorization" \
--header "Authorization: Bearer ${AMLOK_API_KEY}" \
--header "Accept: application/json" \
--header 'Idempotency-Key: idem_example_1001' \
--header 'Content-Type: application/json' \
--data '{
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}'import os
import requests
base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
'Idempotency-Key': 'idem_example_1001',
'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]
response = requests.request(
"POST", base_url + "/v1/connections/connection_example/authorization",
headers=headers, timeout=30, allow_redirects=False,
json={'consent_id': 'con_example',
'redirect_uri': 'https://client.example.com/connected',
'state': 'synthetic-random-state-at-least-32-characters'},
)
response.raise_for_status()
print(response.json())
const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
"Accept": "application/json",
"Idempotency-Key": "idem_example_1001",
"Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/connections/connection_example/authorization", {
method: "POST", headers,
redirect: "error", signal: AbortSignal.timeout(30000),
body: JSON.stringify({
"consent_id": "con_example",
"redirect_uri": "https://client.example.com/connected",
"state": "synthetic-random-state-at-least-32-characters"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());{
"data": {
"id": "connection_example",
"object": "connection",
"subject_id": "biz_example",
"created_at": "2026-10-23T14:00:00Z",
"updated_at": "2026-10-23T14:00:00Z",
"record_version": 1,
"source_refs": [],
"data_status": "partial",
"missing_fields": [],
"schema_version": "1.4.2",
"client_reference": "app-1029",
"provider_id": "BANK-02",
"provider_tenant_id": "item_example",
"status": "active",
"institution_id": "ins_example",
"institution_name": "Example Bank",
"country": "CA",
"products": [
"transactions",
"balance"
],
"scopes": [
"banking:read"
],
"consent_id": "con_01JAMLOK",
"last_successful_sync_at": null,
"next_refresh_at": null,
"history_available_from": "2025-10-22",
"reauth_required_at": null,
"error_code": "reauth_required",
"sync_cursor": "cur_example"
},
"meta": {
"request_id": "req_example",
"schema_version": "1.4.2",
"generated_at": "2026-10-23T14:00:00Z",
"data_status": "complete"
},
"action": {
"type": "redirect",
"url": "https://authorize.example.com/session/synthetic",
"expires_at": "2026-10-23T14:15:00Z"
}
}connections:write
Create a fresh short-lived authorization action on the existing pending, active or reauth_required connection. Preserve its ID, records and synchronization lineage. The consent must authorize the same subject, provider products and purposes. Validate redirect_uri against portal registration. Bind state to this connection and action; echo it on return. A new action invalidates any older unused action. An identical idempotent retry returns the same action, including its original expiry; use a new key when intentionally replacing an expired action. Reauthorization does not backfill data until a successful sync. Revoked or disconnected connections cannot be reopened; obtain new consent and create a new connection. Account cancellation rejects new processing immediately with 409 invalid_state. Read-only access lasts only until workspace deletion. No separate product charge or financial mutation is introduced. Browser return parameters are connection_id, state and result (completed, cancelled or failed); failed returns a sanitized error_code. Verify the saved state and expected connection, then retrieve the connection server-side. The callback never proves consent or connection activation. No credentials or source data appear in return parameters. The state must be unpredictable, bound to the initiating browser session and accepted only once. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.
Product scope · Processing lifecycle · ErrorsAuthorizations
Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.
Headers
Stable key for this intended action; retain across retries.
Path Parameters
Authorized identifier in this workspace.