---
title: "Build a deep link"
method: GET
path: "/v1/projects/{project}/distribution/deep-link"
tags: ["Distribution"]
---

# Build a deep link

`GET /v1/projects/{project}/distribution/deep-link`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/projects/{project}/distribution/deep-link`
- Auth: HTTP bearer

Builds a start link against the project's connected installation. The payload depends on which query parameter you pass (at most one; an access code wins over a plan, and a plan over a custom parameter):

| Query parameter | Resulting payload           | Acted on by the bot?                                         |
| --------------- | --------------------------- | ------------------------------------------------------------ |
| `access_code`   | the code verbatim           | Yes: redeemed on open.                                       |
| `plan_id`       | the plan's bare UUID        | Yes: opens that plan's checkout flow.                        |
| `custom`        | the caller-supplied string  | No, see below.                                               |
| *(none)*        | `project_<uuid>`            | No: falls through to the project home, which is the intent.  |

> **Only a bare UUID is acted on.** The bot acts on a start payload only when it is a bare UUID: it is matched against the project's plans first, then tried as an access code. `custom` payloads and the default `project_<uuid>` do not match that shape, so the bot ignores them and opens its home screen. `custom` is therefore a passthrough for **your own** tracking: the platform delivers it and you can read it off the update in a webhook consumer, but Subscriby neither stores it nor attaches it to the member.

```bash
curl "https://api.subscriby.net/v1/projects/$PROJECT_ID/distribution/deep-link?plan_id=$PLAN_ID" \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN"
```

## Path parameters

- `project` string, uuid, required

## Query parameters

- `plan_id` string, uuid, nullable
- `access_code` string, nullable
- `custom` string, nullable

## Response `200`

The bot URL, the start payload and the assembled deep link.

- object
  - `data` object, required: The response's payload.
    - `project_id` string, required: The project.
    - `bot_url` string, nullable, required: The public URL of the project's live installation.
    - `start_payload` string, required: The payload the link carries, as the table above resolves it.
    - `deep_link` string, nullable, required: The assembled start link.

## Other responses

- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred. On this endpoint: `RESOURCE_NOT_FOUND`: when `plan_id` does not belong to this project.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: with `reason: no_bot_attached` when the project has no connected installation to link to. `VALIDATION_FAILED`: on `plan_id` when it is not a UUID, or on `custom` when it is not 1 to 64 characters of letters, digits, underscore or hyphen.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/7b538e472e9a?raw)