Complete the card issuer link with the account holder's code
Completes the link with the one-time code the account holder received from POST /start-card-issuer-link. No session id is needed: the pending code is held per account, and only the newest one works.
The account holder, never the agent, receives and enters the code. Send your human to their own inbox (or phone) and have them type the code into your interface. Never try to read the account holder's email or messages yourself, and never ask for their email password or access.
Consent. Completing the link records the account holder's consent with the card issuer. Show them the card issuer's connection disclosure next to the code input, and send consent_accepted: true only once they have accepted it.
Wrong codes. An incorrect code answers 400 invalid_code with attempts_left; the account holder can try again. After 5 incorrect entries, or once the code is 10 minutes old, it is discarded and a new one must be sent.
If the account is already linked this answers 200 with status: linked, so a retry after a lost response is safe. After linking, GET /get-card-issuer-status reads linked.
This route is free.
Request
- Base URL: https://laso.finance
- URL: https://laso.finance/verify-card-issuer-link
- Auth: API key in header Authorization
Headers
Optional client-generated unique key (a UUID works) that makes this write safe to retry. A retry with the same key within 24 hours returns the recorded response of the original request, marked with an Idempotency-Replayed: true header, instead of performing the write again. Reusing a key with a different body or route is rejected with 422 (code: idempotency_key_reused); a retry that arrives while the original is still running gets 409 (code: idempotency_key_in_progress), so wait a moment and retry with the same key. Keys are scoped to the authenticated account.
Request body
Response
Linked.
Changes
No recorded changes to this operation across all 3 revisions of this API.