---
title: "Create an access link"
method: POST
path: "/access-links"
tags: ["Access Links"]
---

# Create an access link

`POST /access-links`

## Request

- Base URL: `https://partner-api.getpliant.com/api`
- URL: `https://partner-api.getpliant.com/api/access-links`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/getpliant/apis/pliant-customer-api/docs/access-links/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a shareable access link for one card. Anyone with the link can
use a limited card widget — card details, add to wallet, and the
cardholder's personal details — without a Pliant account. Treat the
link as sensitive.

Save `accessLink` from the response. You receive it only once. Creating
another link for a card that already has an active link replaces that
previous link; the old URL stops working.

The card must belong to `organizationId`, must not be expired or
terminated, and the card product must allow access links. Locked cards
are allowed. Expiry and how many times the link can be opened are set
by Pliant.

## Request body

- object
  - `organizationId` string, uuid, required: Organization the card belongs to.
  - `grants` object[], required: Exactly one card.
    - `linkType` string, required: Use `CARD_WIDGET`.
    - `resourceId` string, uuid, required: The card id.

## Response `200`

Ok

- object
  - `accessLinkId` string, uuid, required: Identifier of the access link.
  - `accessLink` string, uri, nullable: The shareable URL. Returned only when you create the link. You cannot fetch it again.
  - `issuedBy` string, uuid, required: Who created the link.
  - `organizationId` string, uuid, required
  - `createdAt` string, date-time, required
  - `revokedAt` string, date-time, nullable: Set when the link has been revoked.
  - `grants` object[], required
    - `linkType` string, required
    - `resourceType` string, required
    - `resourceId` string, uuid, required: The card id.
    - `scope` string[]: What the person with the link can do. For `CARD_WIDGET`: `ACCESS_CARD_DETAILS`, `ADD_TO_WALLET`, `VIEW_ORG_FEATURES`, `VIEW_CARD_CATALOG`, `MANAGE_MEMBER_DATA`, `VIEW_REGISTRATION_REQUIREMENTS`.
    - `expiresAt` string, date-time: When the link stops working.
    - `maxUseCount` integer: How many times the link can be opened.
    - `usedCount` integer: How many times the link has been opened.

## Other responses

- `400`: Bad Request. Typical `errorCode` values: - `NOT_FOUND` — the card is missing or is not in this organization - `CARD_NOT_MINTABLE` — the card is expired or terminated - `ACCESS_LINK_NOT_ENABLED` — this card product does not allow access links - `ONLY_ONE_CARD` — the request includes more than one card
- `401` (unresolved $ref)
- `403` (unresolved $ref)
- `409`: Conflict. The request could not be completed due to a conflict with the current state of the resource. You may retry the call.
- `422` (unresolved $ref)
- `429` (unresolved $ref)
- `500` (unresolved $ref)

## Changes

- **2026-11-03** `a4fbf7d068b4`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/getpliant/apis/pliant-customer-api/changes/access-links/post.md)

---

[API](https://skmtc.dev/getpliant/apis/pliant-customer-api.md) - [All operations](https://skmtc.dev/getpliant/apis/pliant-customer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getpliant/apis/pliant-customer-api/revisions/a4fbf7d068b4?raw)