---
title: "Poll a mobile-app-approval checkpoint"
method: POST
path: "/v1/auth/checkpoint/poll"
tags: ["Auth"]
---

# Poll a mobile-app-approval checkpoint

`POST /v1/auth/checkpoint/poll`

## Request

- Base URL: `https://api.curviate.com`
- URL: `https://api.curviate.com/v1/auth/checkpoint/poll`
- Auth: HTTP bearer

Polls the pending mobile-app-approval challenge for account_id and advances it; call repeatedly until active. Returns active once approved, pending while waiting, or checkpoint_required if it chains. A code-based checkpoint here returns 422; use checkpoint/solve.

## Request body

- object
  - `account_id` string, required: The account whose mobile-app-approval connect is mid-flight (returned with the 202 checkpoint_required response).

## Response `200`

The current state of the action-based (mobile-app-approval) challenge. object:"account" + status:"active" once approved (the account is now connected); object:"checkpoint" + status:"pending" while still waiting; status:"checkpoint_required" when the collect chained to a new challenge (e.g. approval -> 2FA), switch to submitting the new challenge_type; status:"expired"/"failed" on timeout/failure. object:"account" + recovered:true means the approval reactivated an account you had previously disconnected, which keeps its original id; its status is that account's real observed state, so it may be reconnect_needed rather than active.

- object
  - `object` 'account' | 'checkpoint': Response type discriminator: account on approval, checkpoint while pending/chained/terminal.
  - `status` 'active' | 'reconnect_needed' | 'restricted' | 'disconnected' | 'pending' | 'checkpoint_required' | 'expired' | 'failed'
  - `recovered` boolean: Present and true only when this approval reactivated an account you had previously disconnected, instead of opening a brand-new one. Absent on a normal approval. The account keeps its original id, and its status reflects its real observed state, which may need a reconnect.
  - `account_id` string: Present on status:"active" (the connected account) and status:"checkpoint_required" (the account whose next challenge is pending).
  - `full_name` string, nullable: Present on status:"active".
  - `headline` string, nullable: Present on status:"active".
  - `seat_id` string, nullable: The seat this account occupies (canonical, supersedes the deprecated attached_seat_id). Present on status:"active".
  - `attached_seat_id` string, nullable: Deprecated, use seat_id (same value). Removed at the GA /v1 cutover. Present on status:"active".
  - `external_id` string, nullable: Your own id for this account's end user, as passed on connect. Present on status:"active".
  - `connection_location` object: Where LinkedIn sees this account connecting from. country: the configured country (ISO 3166-1 alpha-2), the one the account is set to use. current_country: the country of the connection in use right now; it differs from country only after a fallback, which can happen only when strict is false. mode: auto (a managed connection in country) or custom (your own proxy). strict: true when the account never connects from another country, null when unknown. Each field is null until known; an account connected through ip or your own proxy may show null until the next background refresh. Change it with PATCH /v1/accounts/{account_id} (country), or by reconnecting with country. Present on object:"account".
    - `country` string, nullable: Configured country (ISO 3166-1 alpha-2).
    - `current_country` string, nullable: Country of the connection in use right now.
    - `mode` 'auto' | 'custom' | 'null', nullable: auto: managed connection. custom: your own proxy.
    - `strict` boolean, nullable: true: never connects from another country.
    - `previous_country` string: Present only when this connect landed on an account you already had and changed its configured country (to another one, to unknown with ip, or to your own proxy). It names the country before.
  - `expires_at` string: ISO-8601 expiry. Present on status:"pending" and status:"checkpoint_required".
  - `challenge_type` 'mobile_app_approval' | 'otp' | 'two_factor_sms' | 'two_factor_app' | 'two_factor_whatsapp' | 'contract_selection' | 'challenge_selection': Machine-readable challenge discriminator. On status:"checkpoint_required" it is the NEW challenge to submit; on status:"expired" it renders the right recovery guidance.
  - `contracts` object[]: Contract picker options, present only on a chained status:"checkpoint_required" with challenge_type:"contract_selection".
    - `id` string
    - `name` string
  - `challenges` object[]: Verification methods to choose from (challenge_selection only). Send one id as challenge to POST /v1/auth/checkpoint/request.
    - `id` 'email' | 'sms' | 'whatsapp'
    - `label` string: Display name, e.g. Text message.
    - `description` string, nullable: The masked destination, when known.
  - `recovery_hint` string: Human-readable, actionable next step when the approval timed out. Present on status:"expired".
  - `safety_warning` SafetyWarning: Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
    - `row` string, nullable, required: The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture.
    - `reset_at` string, nullable, required: The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail).
    - `hint` object, required
      - `parameter` string, required: The settable parameter on PATCH /v1/{account_id}/safety-policy.
      - `message` string, required: What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text.
    - `reason` 'ceiling' | 'activity_window', required: Which rule was crossed. ceiling means the row's configured limit is spent; activity_window means the account is outside the hours it works in, which is a different fact with a different remedy. hint.parameter names the right setting for each.
    - `blocked` boolean, required: Always false here. True on the BUDGET_EXHAUSTED refusal carrying the same payload.

## Other responses

- `404`: No pending checkpoint for this account.
- `409`: ACCOUNT_ALREADY_LINKED. The approved LinkedIn identity is already connected and is not one you can manage here; not retryable. CONNECTION_IN_PROGRESS. Another connection attempt for this identity is open; wait for it to finish or expire.
- `413`: Payload too large, the request body exceeds the size limit.
- `422`: The pending checkpoint is code-based, not mobile_app_approval, use submit instead. CONNECTION_LOCATION_UNAVAILABLE: the approval completed onto an account you already had, and the location you sent could not be applied; the account stays connected, the body carries its actual connection_location, and PATCH /v1/accounts/{account_id} with country moves it.
- `429`: Rate limited, slow down and retry after the hinted delay.
- `500`: Internal error.
- `502`: A temporary error occurred. Please try again.
- `503`: Service unavailable.
- `504`: Gateway timeout.

---

[API](https://skmtc.dev/curviate/apis/curviate-api.md) · [All operations](https://skmtc.dev/curviate/apis/curviate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/curviate/apis/curviate-api/revisions/eab848801d95?raw)