Skip to content
ProspectAPIs

API reference / Connected account

Finish an account's sign-in check

Written and maintained by The ProspectAPIs team

POST/v1/accounts/:account_id/checkpoint

POST /v1/accounts/:account_id/checkpoint is the ProspectAPIs operation checkpointConnectedAccount, in the Connected account group of the REST API. Finish a sign-in that asked for a code or a check: the challenge_id from the earlier answer, the code when one was asked for, and the same identifier and password. Within 15 minutes. Free. Cost: free; finish a sign-in that asked for a code or a check. Send your API key as a Bearer token in the Authorization header.

How this fits with the rest of the connected account API, with worked examples, is in the connected accounts guide.

Parameters

Parameters of POST /v1/accounts/:account_id/checkpoint
NameInTypeDescription
account_id requiredpathstringThe account_id from GET /v1/accounts.
Idempotency-KeyheaderstringOptional, 1 to 255 printable ASCII characters. A retry with the same key and body within 24 hours gets the first answer back with Idempotent-Replayed: true and is never charged again. The same key with a different body is 422; a retry while the first call is still running is 409.

Request body

JSON (AccountLoginRequest). Connect by signing in. Unless remember is true, the password is used for this sign-in only. When the account asks for a code or a check, send the same request again with code and the challenge_id from the 409. With totp_secret the two-factor code is typed for you; with remember: true a later sign-out is signed back in automatically.

Request body of POST /v1/accounts/:account_id/checkpoint
FieldTypeDescription
identifier requiredstringThe account's sign-in email or phone. At most 320 characters.
password requiredstringThe account's password. At most 1024 characters.
codestringThe two-factor or emailed code, 4 to 12 letters or digits, on a resumed sign-in.
challenge_idstringThe challenge_id from the 409 that asked for a code or a check. Valid for 15 minutes.
proxy_urlstring (uri)Optional: your own http, https or socks5 proxy for this account. At most 2048 characters.
user_agentstringOptional: the browser user agent to sign in with. At most 512 characters.
totp_secretstringOptional: the authenticator app's setup key (the base32 text shown under the QR code, 16 to 128 characters). The two-factor code is then typed during the sign-in, with no 409.
rememberbooleanOptional opt-in to automatic re-login: keep the sign-in details (and totp_secret) encrypted so a session the platform signs out is signed back in on the account's own dedicated connection. Deleted when you disconnect. A connect without it clears an earlier opt-in. Default false.
Example body
{
  "identifier": "jane@example.com",
  "password": "your-password"
}

Responses

Response codes of POST /v1/accounts/:account_id/checkpoint
StatusMeaning
201Connected.
400Invalid request (challenge_id is required).
401The API key is missing or invalid.
404No account with that id on this key.
409Another code or check is needed.
410The challenge expired.
422The code or sign-in was not accepted.
429Too many attempts.
503Temporarily unavailable.

Every error answers with the same JSON body, an error string and sometimes a code; the errors page lists each status and when it happens. A per-key 429 carries Retry-After; see rate limits.

201 response fields

Connected. The body is a ConnectedAccount.

Fields of the 201 response
FieldTypeDescription
connected requiredbooleantrue when an account is connected.
statusstring: active, dead, connectingactive; connecting while a sign-in waits for a code or a check; or dead when the session has signed out and needs connecting again. Absent when nothing is connected.
accountobjectThe connected account as the platform names it.
account.handlestring or nullThe account's public handle.
account.namestring or nullThe account's display name.
egressstring: dedicated, shared_fallback, customer_proxy, noneHow the account reaches the platform. Every connected account acts through its own dedicated IP unless you bring your own proxy: dedicated (an IP leased to this account alone), shared_fallback (a shared IP, used only while every dedicated IP is taken), customer_proxy (your own proxy_url) or none.
created_atstring (date-time) or null
updated_atstring (date-time) or null
last_used_atstring (date-time) or nullWhen an action last ran on it.
account_idstring or nullThis account's id. Name it with account_id on any route that acts on a connected account; optional while the key has exactly one.
Response headers
HeaderMeaning
RateLimit-LimitRequests this API key may make per minute.
RateLimit-RemainingRequests left in the current one-minute window.
RateLimit-ResetSeconds until the current window resets.

Code samples

Each sample sends the same request. Set PROSPECTAPIS_KEY in your environment first. Values come from the spec's examples; replace them with your own.

curl
curl -X POST https://api.prospectapis.com/v1/accounts/account id/checkpoint \
  -H "Authorization: Bearer $PROSPECTAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "identifier": "jane@example.com", "password": "your-password" }'
JavaScript (fetch)
const res = await fetch("https://api.prospectapis.com/v1/accounts/account id/checkpoint", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.PROSPECTAPIS_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    "identifier": "jane@example.com",
    "password": "your-password"
  }),
});
if (!res.ok) throw new Error(`${res.status}: ${(await res.json().catch(() => ({}))).error ?? res.statusText}`);
const data = await res.json();
console.log(data);
Python (requests)
import os, requests

res = requests.post(
    "https://api.prospectapis.com/v1/accounts/account id/checkpoint",
    headers={"Authorization": f"Bearer {os.environ['PROSPECTAPIS_KEY']}"},
    json={
        "identifier": "jane@example.com",
        "password": "your-password",
    },
    timeout=30,
)
res.raise_for_status()
data = res.json()
print(data)

Billing

The call itself is free, and what it sets up is billed as it runs: finish a sign-in that asked for a code or a check. Metered spend on the same key is reported after each response in X-Credits-Remaining, and GET /v1/account shows the balance at any time.

The connected accounts guide covers this area end to end. Previous operation: Reconnect an account. Next operation: Edit your post. Every operation, grouped by area, is on the API reference index.

Create a free account to get a key, then run the samples above with your own values (this call acts for real, so use real inputs).

Was this page helpful?