---
title: "Initiate Thumbtack Connection"
method: POST
path: "/integrations/thumbtack/connection"
tags: ["authenticated", "integrations"]
---

# Initiate Thumbtack Connection

`POST /integrations/thumbtack/connection`

## Request

- Base URL: `https://api-docs.upsmith.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api-docs.upsmith.com/integrations/thumbtack/connection`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Begin the Thumbtack OAuth flow. Returns the URL the browser should redirect to.

Pass ?environment=TEST to use the Thumbtack staging auth server.
Defaults to PRODUCTION.

The earlier proof-cookie binding was removed (J14): the FE Next.js proxy
doesn't forward Set-Cookie, and even if it did, the cookie would land on
the FE host while the OAuth callback hits the BE host. Replay protection
now comes from the single-use Redis nonce on the state token; the
identity-mismatch guard in handle_thumbtack_callback covers reconnect
overwrites.

## Query parameters

- `environment` string

## Headers

- `organization-id` string, nullable
- `x-user-id` string, nullable
- `timezone` string
- `x-actor-email` string, nullable
- `x-request-source` string, nullable
- `x-operation-id` string, nullable
- `x-commit-message` string, nullable
- `x-confirmation-id` string, nullable
- `x-chat-id` string, nullable

## Response `200`

Successful Response

- ThumbtackConnectionInitiateResponse
  - `redirect_url` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/upsmith/apis/upsmith-api.md) - [All operations](https://skmtc.dev/upsmith/apis/upsmith-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upsmith/apis/upsmith-api/revisions/86e2c2bd93af?raw)