Generate external authentication links

Generates one-time links that let an external user (for example, the end client of an agency) authenticate a data source connection with their own credentials and select which accounts to grant — without having access to the workspace. This is the API equivalent of the platform UI action "Request credentials from another user".

One link is generated per email in to_emails; the email identifies the external user. Links are single-use, expire after 14 days, and can be revoked.

Who the link comes from. An API token does not identify a person, so pass requested_by with the email of the user the link is sent on behalf of. That user is shown as the sender on the link page and in the invitation email, and receives the confirmation email once the external user creates the connection. requested_by must be an active user of your agency who is a member of the workspace or an owner of the agency; otherwise the request fails with 400 and no links are created. Without requested_by, the link page and the invitation show your whitelabel title, and no confirmation email is sent.

Important: Requires the agency feature flag for external authentication links (contact Improvado to enable it). The endpoint returns 403 when the flag is disabled.