Skip to main content
POST
Finalise a card-connect redirect

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Body

application/json

Posted by the Finogate FE landing page after the end-user returns.

code and state are read verbatim from the callback URL the user landed on. The BE verifies the signed state, then:

  • If code is present (verified flow via /login/oauth/authorize) → exchange the code at POST /oauth/token for an access_token + card_id, fetch + persist that card.
  • If code is absent (receive-only flow which does NOT emit an auth code) → look up the user's existing link from the signed state, mint an access_token via the partner-identity flow, list the user's cards, persist any new ones.

state is therefore the load-bearing identifier — it carries the tenant + user + mode + return_url attribution and is HMAC-verified by :func:oauth_state.decode_state. code, when present, is supplied by the processor and is single-use at their end.

state
string
required
Required string length: 1 - 2048
code
string | null
Maximum string length: 512

Response

Successful Response

Standard response wrapper for single-object responses and errors.

Generic over the payload type. A route that declares CommonResponse[SomeModel] gets the real data schema rendered in OpenAPI/Swagger; a bare CommonResponse leaves data untyped.

status_code
integer
required

HTTP status code for the response.

data
any
required

Payload or error details.

query_generated_time
integer
required

UTC timestamp (milliseconds since epoch) when response was generated.