> ## Documentation Index
> Fetch the complete documentation index at: https://swapnice.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a connection session

> Start the Plaid-Link-style account linking flow.

Start the Plaid-Link-style account linking flow.

Open `connection_url` for the user and poll the session. See [consent and account linking](/partners/consent).


## OpenAPI

````yaml openapi.yaml POST /v1/connection-sessions
openapi: 3.0.3
info:
  title: Swapnice Partner API
  version: 0.1.0
  description: >
    Swapnice's partner API lets trusted partner applications connect customer
    accounts,

    collect explicit consent, ingest governed events and claims, and
    synchronously read

    consent-filtered profile intelligence with provenance.


    The API is designed for a Cloudflare Workers gateway backed by Durable
    Objects for

    short-lived sessions, per-customer ordering, consent coordination, and
    idempotency,

    plus D1 for longer-lived partner app configuration, consent archives, token
    metadata,

    customer records, and audit history.


    Public schemas use descriptive field names. Compact Firebase-era storage
    keys such as

    `c0`, `p0`, or `upiv` are internal implementation details and must not be
    exposed.
  contact:
    name: Swapnice API Support
    email: api@swapnice.com
  license:
    name: Proprietary
    url: https://swapnice.com/legal/api-terms
servers:
  - url: https://api.swapnice.com
    description: Production API
  - url: https://api.sandbox.swapnice.com
    description: Sandbox API
security:
  - OAuth2: []
tags:
  - name: OAuth
    description: OAuth 2.1 authorization, token, introspection, revocation, and discovery.
  - name: Apps
    description: Partner OAuth application configuration and webhook endpoints.
  - name: Connection Sessions
    description: Short-lived account-linking sessions coordinated by Durable Objects.
  - name: Consent
    description: Consent grants, receipts, effective consent state, and revocation.
  - name: Customers
    description: Partner-scoped customer records and metadata.
  - name: Ontologies
    description: Ontology contracts and filter-field metadata for entries and events.
  - name: Entries
    description: Ontology-backed collectible entries using readable external fields.
  - name: Events
    description: Non-blocking ordered event and claim ingestion.
  - name: Profiles
    description: Consent-aware synchronous reads for claims, intents, and profile facts.
  - name: Webhooks
    description: Partner webhook endpoint registration and delivery status.
paths:
  /v1/connection-sessions:
    post:
      tags:
        - Connection Sessions
      summary: Create a connection session
      description: >
        Creates a short-lived account-linking session. Session status and
        completion are

        coordinated by `ConnectionSessionObject`, keyed by
        `connection_session:{sessionId}`.
      operationId: createConnectionSession
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
        - $ref: '#/components/parameters/RequestId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectionSessionCreateRequest'
            example:
              customer_id: cust_8f2a1c
              requested_purposes:
                - personalization
                - analytics
              redirect_uri: https://partner.example.com/swapnice/callback
      responses:
        '201':
          description: Connection session created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectionSessionCreateResponse'
              example:
                session:
                  id: cs_0b77e2
                  app_id: app_91b0
                  customer_id: cust_8f2a1c
                  status: created
                  requested_purposes:
                    - personalization
                    - analytics
                  expires_at: '2026-08-26T16:06:00.000Z'
                  created_at: '2026-08-26T16:01:00.000Z'
                client_token: cst_example
                connection_url: https://api.sandbox.swapnice.com/connect/cs_0b77e2
        '409':
          $ref: '#/components/responses/Conflict'
      security:
        - OAuth2:
            - connections:write
components:
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: true
      description: >
        Required for mutating requests. Replays with the same key and payload
        hash return

        the original logical result; replays with a different payload hash
        return `409`.
      schema:
        type: string
        minLength: 16
        maxLength: 255
      example: idem_01HZZZ8KQ2J9X2RW7B8Y4D2FPK
    RequestId:
      name: X-Request-Id
      in: header
      required: false
      description: Optional caller-supplied correlation ID echoed in responses and errors.
      schema:
        type: string
  schemas:
    ConnectionSessionCreateRequest:
      type: object
      required:
        - customer_id
        - requested_purposes
        - redirect_uri
      properties:
        customer_id:
          type: string
        requested_purposes:
          type: array
          minItems: 1
          items:
            $ref: '#/components/schemas/ConsentPurpose'
        redirect_uri:
          type: string
          format: uri
        expires_in:
          type: integer
          minimum: 60
          maximum: 3600
          default: 900
        metadata:
          $ref: '#/components/schemas/Metadata'
    ConnectionSessionCreateResponse:
      type: object
      required:
        - session
        - client_token
        - connection_url
      properties:
        session:
          $ref: '#/components/schemas/ConnectionSession'
        client_token:
          type: string
          description: Short-lived token for polling session status from an SDK.
        connection_url:
          type: string
          format: uri
    ConsentPurpose:
      type: string
      enum:
        - account_linking
        - personalization
        - analytics
        - support
        - event_enrichment
        - profile_resolution
        - measurement
    Metadata:
      type: object
      additionalProperties: true
    ConnectionSession:
      type: object
      required:
        - id
        - app_id
        - customer_id
        - status
        - requested_purposes
        - expires_at
        - created_at
      properties:
        id:
          type: string
        app_id:
          type: string
        customer_id:
          type: string
        status:
          type: string
          enum:
            - created
            - authorized
            - completed
            - expired
            - revoked
        requested_purposes:
          type: array
          items:
            $ref: '#/components/schemas/ConsentPurpose'
        consent_receipt_id:
          type: string
          nullable: true
        swapnice_user_id:
          type: string
          nullable: true
        expires_at:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              example: consent_denied
            message:
              type: string
            request_id:
              type: string
            details:
              type: array
              items:
                $ref: '#/components/schemas/ErrorDetail'
    ErrorDetail:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
        message:
          type: string
        field:
          type: string
  responses:
    Conflict:
      description: Idempotency conflict or invalid state transition.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    OAuth2:
      type: oauth2
      description: >-
        OAuth 2.1 authorization code with PKCE. Implicit and password flows are
        unsupported.
      flows:
        authorizationCode:
          authorizationUrl: https://api.swapnice.com/oauth/authorize
          tokenUrl: https://api.swapnice.com/oauth/token
          refreshUrl: https://api.swapnice.com/oauth/token
          scopes:
            offline_access: Issue rotating refresh tokens when allowed.
            apps:read: Read partner app configuration.
            apps:write: Manage partner app configuration.
            connections:read: Read connection sessions.
            connections:write: Create or cancel connection sessions.
            consent:read: Read consent receipts and effective consent.
            consent:write: Create and revoke consent.
            customers:read: Read partner customers.
            customers:write: Create or update partner customers.
            ontologies:read: Read ontologies and field maps.
            ontologies:write: Rebuild ontology filter metadata.
            entries:read: Read ontology-backed entries.
            entries:write: Create or update ontology-backed entries.
            events:read: Read event status.
            events:write: Ingest events and claims.
            profile:read: Read resolved profile facts.
            profiles:read: Read profile resources.
            claims:read: Read claims.
            intents:read: Read intents.
            webhooks:read: Read webhook endpoints.
            webhooks:write: Manage webhook endpoints.
            workflows:read: Read async workflow status.
            tokens:introspect: Introspect tokens.
            tokens:revoke: Revoke tokens.

````