cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/connections" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "subject_id": "biz_example",
  "provider_id": "BANK-02",
  "products": [
    "transactions"
  ],
  "consent_id": "con_example",
  "redirect_uri": "https://client.example.com/connected",
  "state": "synthetic-random-state-at-least-32-characters"
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/connections",
    headers=headers, timeout=30, allow_redirects=False,
    json={'subject_id': 'biz_example',
 'provider_id': 'BANK-02',
 'products': ['transactions'],
 'consent_id': 'con_example',
 'redirect_uri': 'https://client.example.com/connected',
 'state': 'synthetic-random-state-at-least-32-characters'},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/connections", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "subject_id": "biz_example",
  "provider_id": "BANK-02",
  "products": [
    "transactions"
  ],
  "consent_id": "con_example",
  "redirect_uri": "https://client.example.com/connected",
  "state": "synthetic-random-state-at-least-32-characters"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "cnn_example",
    "object": "connection",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "pending",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "provider_id": "BANK-02",
    "provider_tenant_id": null,
    "status": "pending",
    "institution_id": null,
    "institution_name": null,
    "country": "CA",
    "products": [
      "transactions"
    ],
    "scopes": [
      "banking:read"
    ],
    "consent_id": "con_example",
    "last_successful_sync_at": null,
    "next_refresh_at": null,
    "history_available_from": null,
    "reauth_required_at": null,
    "error_code": null,
    "sync_cursor": null
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "pending"
  },
  "action": {
    "type": "authorize_connection",
    "url": "https://connect.example.com/session",
    "expires_at": "2026-10-23T14:15:00Z"
  }
}

Platform

Create connection

Start an authorized source-connection flow.

Required scope: connections:write. Return a short-lived authorization action; no provider secret in response. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Browser return parameters are connection_id, state and result (completed, cancelled or failed); failed returns a sanitized error_code. Verify the saved state and expected connection, then retrieve the connection server-side. The callback never proves consent or connection activation. No credentials or source data appear in return parameters. The state must be unpredictable, bound to the initiating browser session and accepted only once. Renew an expired link or reauthorization-required connection through POST /v1/connections//authorization. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

POST

connections

cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/connections" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "subject_id": "biz_example",
  "provider_id": "BANK-02",
  "products": [
    "transactions"
  ],
  "consent_id": "con_example",
  "redirect_uri": "https://client.example.com/connected",
  "state": "synthetic-random-state-at-least-32-characters"
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/connections",
    headers=headers, timeout=30, allow_redirects=False,
    json={'subject_id': 'biz_example',
 'provider_id': 'BANK-02',
 'products': ['transactions'],
 'consent_id': 'con_example',
 'redirect_uri': 'https://client.example.com/connected',
 'state': 'synthetic-random-state-at-least-32-characters'},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/connections", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "subject_id": "biz_example",
  "provider_id": "BANK-02",
  "products": [
    "transactions"
  ],
  "consent_id": "con_example",
  "redirect_uri": "https://client.example.com/connected",
  "state": "synthetic-random-state-at-least-32-characters"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "cnn_example",
    "object": "connection",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "pending",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "provider_id": "BANK-02",
    "provider_tenant_id": null,
    "status": "pending",
    "institution_id": null,
    "institution_name": null,
    "country": "CA",
    "products": [
      "transactions"
    ],
    "scopes": [
      "banking:read"
    ],
    "consent_id": "con_example",
    "last_successful_sync_at": null,
    "next_refresh_at": null,
    "history_available_from": null,
    "reauth_required_at": null,
    "error_code": null,
    "sync_cursor": null
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "pending"
  },
  "action": {
    "type": "authorize_connection",
    "url": "https://connect.example.com/session",
    "expires_at": "2026-10-23T14:15:00Z"
  }
}

Required scope: connections:write Start an authorized source-connection flow. Required scope: connections:write. Return a short-lived authorization action; no provider secret in response. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Browser return parameters are connection_id, state and result (completed, cancelled or failed); failed returns a sanitized error_code. Verify the saved state and expected connection, then retrieve the connection server-side. The callback never proves consent or connection activation. No credentials or source data appear in return parameters. The state must be unpredictable, bound to the initiating browser session and accepted only once. Renew an expired link or reauthorization-required connection through POST /v1/connections//authorization. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt. Product scope · Processing lifecycle · Errors

Authorizations

Authorization

string

header

required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

X-Request-ID

string

Optional caller correlation ID; the response includes AMLOK request_id.

Idempotency-Key

string

required

Reuse for retries of the same intended command and identical payload. Retention: 24 hours.

Body

application/json

subject_id

string

required

Subject whose source will be linked.

Minimum string length: 1

provider_id

string

required

An enabled provider identifier.

Minimum string length: 1

products

string[]

required

Product IDs from this provider's products[].id in GET /v1/providers. Resource names are not interchangeable with product IDs. Reject unsupported values with 422 validation_error.

Minimum array length: 1

Active authorization.

Minimum string length: 1

redirect_uri

string<uri>

required

Registered allowed return URL.

Minimum string length: 1

Pattern: ^https://

state

string

required

Required string length: 32 - 256

Response

Start an authorized source-connection flow.

data

connection · object

required

One authorized link to a provider tenant or financial institution. Population depends on source and tenant entitlement.

Show child attributes

Get started

Endpoints

Essentials

Create connection

Authorizations

Headers

Body

Response