---
title: "Connect an existing account"
method: POST
path: "/clients/link"
tags: ["accounts"]
---

# Connect an existing account

`POST /clients/link`

## Request

- The document declares no server URL.
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/hevn-inc/apis/hevn-api/docs/clients/link/post.ts> (a function with typed inputs; its response is checked against the schema)

Exchange the short-lived code the account holder approved in the HEVN sign-in window for access to their account. The account holder keeps signing their own transfers: a payout for this client answers with `authorization: client` and no approval, and the holder approves it in the HEVN sign-in window. Linking the same account again returns it.

## Headers

- `Idempotency-Key` string, nullable: Your own key for this write, `^[A-Za-z0-9._:-]{1,128}$`. A retry with the same key replays the first answer; the same key with a different request is refused.
- `X-Hevn-Account` string, nullable: The client account to act for, as a `cl_…` id. Omit it to act as yourself.

## Request body

- ClientLinkRequest
  - `code` string, required: Short-lived code the account holder approved in the HEVN sign-in window.

## Response `200`

Successful Response

- ClientResponse
  - `id` string, required: Stable public identifier for this account.
  - `status` 'provisioning' | 'ready' | 'failed', required
  - `name` string, nullable: Legal or trading name of the account.
  - `email` string, nullable: Email address associated with the account.
  - `phone` string, nullable: Phone number in international E.164 format.
  - `baseSmartWallet` string, nullable: Base smart-wallet address controlled by the account.
  - `kybStatus` 'notStarted' | 'pending' | 'approved' | 'rfi' | 'rejected'
  - `kybApplicationId` string, nullable: Latest immutable business-verification application identifier.
  - `verifiedAt` string, date-time, nullable: When the account was verified: identity verification for a person, KYB for a business.
  - `createdAt` string, date-time, required: UTC timestamp when the account was created.
  - `failure` ClientFailureResponse
    - `code` 'provisioning_failed' | 'request_rejected' | 'request_canceled', required
    - `message` string, required: Human-readable explanation safe to show to the account holder.
    - `retriable` boolean: Whether retrying later without changing the request may succeed.
  - `pollUrl` string, nullable: Relative API URL to poll with this response's id in `X-Hevn-Account`.
  - `transferPolicy` TransferPolicyResponse: Effective account-level money-movement controls. ``isFrozen`` overrides every permission. When the account is not frozen, ``recoveryModeActivated`` restricts it to first-party fiat withdrawals. The remaining flags are then evaluated for the requested operation.
    - `allowFiat` boolean, required: Allow account-initiated fiat payouts, subject to freeze and recovery controls.
    - `allowCrypto` boolean, required: Allow account-initiated on-chain transfers, including transfers to another platform account, subject to freeze and recovery controls.
    - `allowThirdParty` boolean, required: Allow fiat or on-chain payouts to an external contact. Email and escrow payments within the same platform group use narrower controls.
    - `allowEscrowThirdParty` boolean, required: Allow escrow to another platform account. This control is independent from allowThirdParty; same-group escrow also requires allowPartnerGroupPayments.
    - `allowSwap` boolean, required: Allow balance swaps, subject to freeze and recovery controls.
    - `allowPartnerGroupPayments` boolean, required: Allow email and escrow payments between accounts in the same platform group. Email payments also require allowCrypto; escrow also requires allowEscrowThirdParty.
    - `dualApproval` boolean, required: Require a separately approved transfer request before payment co-signing.
    - `isFrozen` boolean, required: Block every new money movement, overriding every allow flag.
    - `recoveryModeActivated` boolean, required: Restrict money movement to first-party fiat payouts whose Contact belongs to this account and whose account-holder name matches the account name.

## Other responses

- `422`: Request validation failed

## Changes

- **2026-11-12** `299a3aa6f521`: 1 warning, 3 info
  - added the new `verification_not_applicable` enum value to the `error/code` response property for the response status `422`
  - added the optional property `verifiedAt` to the response with the `200` status
  - removed the `phone_required` enum value from the `error/code` response property for the response status `422`
  - removed the `rail_requirements_unmet` enum value from the `error/code` response property for the response status `422`
- **2026-10-23** `a02795de2d2b`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hevn-inc/apis/hevn-api/changes/clients/link/post.md)

---

[API](https://skmtc.dev/hevn-inc/apis/hevn-api.md) - [All operations](https://skmtc.dev/hevn-inc/apis/hevn-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hevn-inc/apis/hevn-api/revisions/299a3aa6f521?raw)