cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/sync-checkpoints" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "resource_types": [
    "bank_transaction",
    "lien"
  ]
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/sync-checkpoints",
    headers=headers, timeout=30, allow_redirects=False,
    json={'resource_types': ['bank_transaction', 'lien']},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/sync-checkpoints", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "resource_types": [
    "bank_transaction",
    "lien"
  ]
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "checkpoint_example",
    "object": "sync_checkpoint",
    "workspace_id": "wsp_example",
    "as_of": "2026-10-23T14:00:00Z",
    "expires_at": "2026-11-01T14:00:00Z",
    "resource_types": [
      "bank_transaction",
      "lien"
    ],
    "resume_cursor": "changes_after_checkpoint_example"
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "complete"
  }
}

Platform

Create synchronization checkpoint

Create a read-only synchronization boundary. This does not synchronize a provider, process a product or spend credits. Read each requested collection with snapshot_id equal to this checkpoint ID, then consume /v1/changes from resume_cursor. Both refer to the same as_of boundary, preventing a bootstrap gap. Snapshots and resume cursors remain valid until their explicit expires_at. Reject unentitled types. Workspace deletion revokes checkpoints. Checkpoint creation remains available while read-only reporting access remains active. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

POST

sync-checkpoints

cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/sync-checkpoints" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "resource_types": [
    "bank_transaction",
    "lien"
  ]
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/sync-checkpoints",
    headers=headers, timeout=30, allow_redirects=False,
    json={'resource_types': ['bank_transaction', 'lien']},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/sync-checkpoints", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "resource_types": [
    "bank_transaction",
    "lien"
  ]
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "checkpoint_example",
    "object": "sync_checkpoint",
    "workspace_id": "wsp_example",
    "as_of": "2026-10-23T14:00:00Z",
    "expires_at": "2026-11-01T14:00:00Z",
    "resource_types": [
      "bank_transaction",
      "lien"
    ],
    "resume_cursor": "changes_after_checkpoint_example"
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "complete"
  }
}

Required scope: platform:read Create a read-only synchronization boundary. This does not synchronize a provider, process a product or spend credits. Read each requested collection with snapshot_id equal to this checkpoint ID, then consume /v1/changes from resume_cursor. Both refer to the same as_of boundary, preventing a bootstrap gap. Snapshots and resume cursors remain valid until their explicit expires_at. Reject unentitled types. Workspace deletion revokes checkpoints. Checkpoint creation remains available while read-only reporting access remains active. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt. Product scope · Processing lifecycle · Errors

Authorizations

Authorization

string

header

required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

Idempotency-Key

string

required

Stable key for one intended request. Reuse on retries.

Body

application/json

resource_types

enum<string>[]

required

Minimum array length: 1

Available options:

connection,

consent,

sync_job,

business,

person,

relationship,

verification,

verification_check,

screening_match,

document,

bank_account,

account_balance,

bank_transaction,

recurring_stream,

income_observation,

merchant_account,

payment,

processor_transaction,

payout,

refund,

dispute,

counterparty,

order,

order_line,

subscription,

ledger_account,

journal,

journal_line,

invoice,

bill,

credit_note,

accounting_payment,

financial_statement,

statement_line,

tax_obligation,

product,

location,

inventory_balance,

inventory_movement,

purchase_order,

shipment,

production_order,

project,

application,

credit_facility,

loan,

installment,

repayment,

collateral,

guarantee,

covenant,

decision,

lien_search,

lien,

filing_event,

attribute,

risk_snapshot,

monitor,

alert,

workflow_run,

requirement,

audit_event,

reconciliation_link

Minimum string length: 1

Response

Authorized response.

data

object

required

Show child attributes

Get started

Endpoints

Essentials

Create synchronization checkpoint

Authorizations

Headers

Body

Response