Quote over the API, bind via link. quote_id is a quote from GET .../quotes that can be bound now (bind.available); any other quote is refused with the quote read's own bind.blocked_reason.

• for: broker (the default) returns a one-time sign-in link into the Hedge portal's bind checklist for this quote (or the quote itself when the carrier binds it on its own portal). It signs in the token's user, or producer_email for an API client credential, which must be an active portal user of your brokerage. It works once and expires after 24 hours (sooner if the API key that minted it is revoked). The session it starts lasts up to 12 hours and can bind, quote, reply and service; it cannot change API keys, webhooks, team, payout or mailing settings (sign in to Hedge directly for those). The URL is a credential: give it only to that person and never log it.
• for: insured returns the insured's pay-and-bind link, where the quote's market takes the insured's own payment (Coterie direct bill today; 409 insured_link_unavailable elsewhere). It drafts the bind request as POST .../bind-requests does, so the assumptions Hedge made for the quote must be confirmed first (attest_assumptions, 409 assumptions_unconfirmed otherwise). The first call emails the link to insured_email, copying the producer; later calls return the live link without emailing again (a different insured_email sends a new one). emailed says whether this call emailed the insured (false: the email did not go out, so share the URL yourself; null: an earlier call sent it). expires_at is the end of the last day the insured can pay.

The existing bind-requests endpoints remain for markets that bind without a card.