Take the redirect back and finish the connection

Exchanges the code for tokens, learns which Ponto organization they are for, and lists the accounts the owner shared. The tokens are sealed server-side and never leave it. A state is spent once, only by the person who started it, and only within two hours, long enough for a first sign-up at Ponto; one that comes back later answers 400 with details.late, and connecting again goes straight to Ponto’s sign-in. A second copy of a redirect that already finished answers 409 naming the connection it made, and one that lands while the first is still exchanging answers 409 with details.finishing. The work after the claim runs to the end even when the caller has gone. A newer grant for the same organization retires the older one, whose accounts move across; one on another team is ended there. A grant that shares nothing is ended at Ponto rather than kept, and the older grants it replaced stop with it. One whose accounts cannot be listed is kept, and answers 400 with details.listed false and details.connectionId, to be picked up with /ponto/connections/{id}/accounts. A shared account whose IBAN the portfolio already holds is linked on the spot, also where an older grant read it under another Ponto id, and the rest wait for /ponto/link; an account of the worked example is never paired. While bank accounts are charged, a match links on its own only for an owner, and only while it stays within the accounts the plan includes or is the account the connection was started from, at the price agreed when it was started; every other match comes back suggested and unlinked, and every shared account left unpaired is noted on the connection. An account an older grant read that this one does not share stops here and is named in notShared. An account whose IBAN another connection on this team already reads, or that another of the caller’s teams holds, is marked and never paired, and someone no longer an owner keeps the grant and links nothing.