API reference / Connected account
Finish an account's sign-in check
Written and maintained by The ProspectAPIs team
POST/v1/accounts/:account_id/checkpoint
POST /v1/accounts/:account_id/checkpoint is the ProspectAPIs operation checkpointConnectedAccount, in the Connected account group of the REST API. Finish a sign-in that asked for a code or a check: the challenge_id from the earlier answer, the code when one was asked for, and the same identifier and password. Within 15 minutes. Free. Cost: free; finish a sign-in that asked for a code or a check. Send your API key as a Bearer token in the Authorization header.
How this fits with the rest of the connected account API, with worked examples, is in the connected accounts guide.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| account_id required | path | string | The account_id from GET /v1/accounts. |
| Idempotency-Key | header | string | Optional, 1 to 255 printable ASCII characters. A retry with the same key and body within 24 hours gets the first answer back with Idempotent-Replayed: true and is never charged again. The same key with a different body is 422; a retry while the first call is still running is 409. |
Request body
JSON (AccountLoginRequest). Connect by signing in. Unless remember is true, the password is used for this sign-in only. When the account asks for a code or a check, send the same request again with code and the challenge_id from the 409. With totp_secret the two-factor code is typed for you; with remember: true a later sign-out is signed back in automatically.
| Field | Type | Description |
|---|---|---|
| identifier required | string | The account's sign-in email or phone. At most 320 characters. |
| password required | string | The account's password. At most 1024 characters. |
| code | string | The two-factor or emailed code, 4 to 12 letters or digits, on a resumed sign-in. |
| challenge_id | string | The challenge_id from the 409 that asked for a code or a check. Valid for 15 minutes. |
| proxy_url | string (uri) | Optional: your own http, https or socks5 proxy for this account. At most 2048 characters. |
| user_agent | string | Optional: the browser user agent to sign in with. At most 512 characters. |
| totp_secret | string | Optional: the authenticator app's setup key (the base32 text shown under the QR code, 16 to 128 characters). The two-factor code is then typed during the sign-in, with no 409. |
| remember | boolean | Optional opt-in to automatic re-login: keep the sign-in details (and totp_secret) encrypted so a session the platform signs out is signed back in on the account's own dedicated connection. Deleted when you disconnect. A connect without it clears an earlier opt-in. Default false. |
{
"identifier": "jane@example.com",
"password": "your-password"
}Responses
| Status | Meaning |
|---|---|
| 201 | Connected. |
| 400 | Invalid request (challenge_id is required). |
| 401 | The API key is missing or invalid. |
| 404 | No account with that id on this key. |
| 409 | Another code or check is needed. |
| 410 | The challenge expired. |
| 422 | The code or sign-in was not accepted. |
| 429 | Too many attempts. |
| 503 | Temporarily unavailable. |
Every error answers with the same JSON body, an error string and sometimes a code; the errors page lists each status and when it happens. A per-key 429 carries Retry-After; see rate limits.
201 response fields
Connected. The body is a ConnectedAccount.
| Field | Type | Description |
|---|---|---|
| connected required | boolean | true when an account is connected. |
| status | string: active, dead, connecting | active; connecting while a sign-in waits for a code or a check; or dead when the session has signed out and needs connecting again. Absent when nothing is connected. |
| account | object | The connected account as the platform names it. |
| account.handle | string or null | The account's public handle. |
| account.name | string or null | The account's display name. |
| egress | string: dedicated, shared_fallback, customer_proxy, none | How the account reaches the platform. Every connected account acts through its own dedicated IP unless you bring your own proxy: dedicated (an IP leased to this account alone), shared_fallback (a shared IP, used only while every dedicated IP is taken), customer_proxy (your own proxy_url) or none. |
| created_at | string (date-time) or null | |
| updated_at | string (date-time) or null | |
| last_used_at | string (date-time) or null | When an action last ran on it. |
| account_id | string or null | This account's id. Name it with account_id on any route that acts on a connected account; optional while the key has exactly one. |
| Header | Meaning |
|---|---|
| RateLimit-Limit | Requests this API key may make per minute. |
| RateLimit-Remaining | Requests left in the current one-minute window. |
| RateLimit-Reset | Seconds until the current window resets. |
Code samples
Each sample sends the same request. Set PROSPECTAPIS_KEY in your environment first. Values come from the spec's examples; replace them with your own.
curl -X POST https://api.prospectapis.com/v1/accounts/account id/checkpoint \
-H "Authorization: Bearer $PROSPECTAPIS_KEY" \
-H "Content-Type: application/json" \
-d '{ "identifier": "jane@example.com", "password": "your-password" }'const res = await fetch("https://api.prospectapis.com/v1/accounts/account id/checkpoint", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.PROSPECTAPIS_KEY}`, "Content-Type": "application/json" },
body: JSON.stringify({
"identifier": "jane@example.com",
"password": "your-password"
}),
});
if (!res.ok) throw new Error(`${res.status}: ${(await res.json().catch(() => ({}))).error ?? res.statusText}`);
const data = await res.json();
console.log(data);import os, requests
res = requests.post(
"https://api.prospectapis.com/v1/accounts/account id/checkpoint",
headers={"Authorization": f"Bearer {os.environ['PROSPECTAPIS_KEY']}"},
json={
"identifier": "jane@example.com",
"password": "your-password",
},
timeout=30,
)
res.raise_for_status()
data = res.json()
print(data)Billing
The call itself is free, and what it sets up is billed as it runs: finish a sign-in that asked for a code or a check. Metered spend on the same key is reported after each response in X-Credits-Remaining, and GET /v1/account shows the balance at any time.
Related
The connected accounts guide covers this area end to end. Previous operation: Reconnect an account. Next operation: Edit your post. Every operation, grouped by area, is on the API reference index.
Create a free account to get a key, then run the samples above with your own values (this call acts for real, so use real inputs).
Was this page helpful?