Skip to main content
POST
Mint an in-iframe card-connect session

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Body

application/json

Mint a card-connect embed session for an in-iframe (custom) card form.

An alternative to the redirect-based connect flow: instead of bouncing the user to a hosted page, the platform embeds a Finogate iframe that renders a fully-custom card form. PAN is tokenised in-browser and never reaches the platform's or Finogate's servers.

user_id
string<uuid>
required
parent_origin
string
required

Origin of the page embedding the iframe (e.g. https://app.example.com). Used as the postMessage targetOrigin.

Maximum string length: 255
entity_type
enum<string>
default:personal

Onboarding track for this user: personal (individual, KYC) or business (merchant/company, KYB ~24-48h review). Defaults to personal.

Available options:
personal,
business
ip_address
string | null
Required string length: 3 - 45
date_of_birth
string | null

End-user DOB (YYYY-MM-DD). Required if the user has no KYC.

phone
string | null
Maximum string length: 32
address1
string | null
Maximum string length: 255
city
string | null
Maximum string length: 128
state
string | null
Maximum string length: 64
postal_code
string | null
Maximum string length: 16

Response

Successful Response

Standard response wrapper for single-object responses and errors.

Generic over the payload type. A route that declares CommonResponse[SomeModel] gets the real data schema rendered in OpenAPI/Swagger; a bare CommonResponse leaves data untyped.

status_code
integer
required

HTTP status code for the response.

data
any
required

Payload or error details.

query_generated_time
integer
required

UTC timestamp (milliseconds since epoch) when response was generated.