> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Mint aggregator consent token > Use this endpoint to get the consent token that the aggregator's own consent widget (Pluggy Connect or the Belvo widget) needs for this connection. The request has no body: Matcher reads the vendor from the stored connection. For a connection already bound to a vendor item or link, the token starts a re-consent. After the end customer completes the widget, bind the item or link id to the connection with an update that sets `accountRef`. This route does not deduplicate retries. Resending it, even with the same `X-Idempotency` key, mints another token. ## OpenAPI ````yaml /es/openapi/v3-current/matcher.yaml post /v1/discovery/aggregator-connections/{id}/connect-token openapi: 3.1.0 info: title: Matcher APIs description: >- Complete API reference for the Matcher reconciliation engine, providing automated transaction matching between Midaz Ledger and external systems. ## Idempotency POST, PUT, PATCH and DELETE requests accept an optional `X-Idempotency` header (1-128 characters: letters, digits, hyphen, underscore or colon). Without it a request is never de-duplicated. Retrying a completed request with the same key replays the stored response and sets `X-Idempotency-Replayed: true`. A malformed key is refused with 400 `MTCH-0015`, a retry sent while the first attempt is still running with 409 `MTCH-0018`, and a retry whose earlier attempt already ran but whose answer cannot be replayed with 409 `MTCH-0022`; on the latter, check the outcome before sending again. Four routes ignore the key: `POST /v1/discovery/aggregator-connections/{id}/connect-token`, `POST /v1/discovery/webhooks/tokens`, `POST /v1/exceptions/callbacks/credentials` and `POST /v1/exceptions/callbacks/credentials/{credentialId}/rotate`. Each returns a raw credential exactly once, so nothing is stored or replayed. A retry of one of the other three mints a new credential. A retry of the rotate route answers 404, because the old credential is already revoked. Read the first attempt's response instead of resending. version: 6.3.0 license: name: Lerian Studio General License servers: - url: https://matcher.sandbox.lerian.net security: [] paths: /v1/discovery/aggregator-connections/{id}/connect-token: post: tags: - Discovery summary: Mint aggregator consent token description: >- Use this endpoint to get the consent token that the aggregator's own consent widget (Pluggy Connect or the Belvo widget) needs for this connection. The request has no body: Matcher reads the vendor from the stored connection. For a connection already bound to a vendor item or link, the token starts a re-consent. After the end customer completes the widget, bind the item or link id to the connection with an update that sets `accountRef`. This route does not deduplicate retries. Resending it, even with the same `X-Idempotency` key, mints another token. operationId: mintAggregatorConsentToken parameters: - description: Opaque aggregator connection id in: path name: id required: true schema: description: Opaque aggregator connection id type: string responses: '201': content: application/json: schema: $ref: '#/components/schemas/AggregatorConsentTokenResponse' description: Created '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: The requested resource was not found. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: mtch-0005-aggregator-connection-not-found: $ref: >- #/components/examples/mtch-0005-aggregator-connection-not-found '422': description: Matcher could not mint a consent token for this connection. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: mtch-0213-consent-flow-not-available: $ref: '#/components/examples/mtch-0213-consent-flow-not-available' mtch-0212-consent-token-not-issued: $ref: '#/components/examples/mtch-0212-consent-token-not-issued' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' security: - BearerAuth: [] components: schemas: AggregatorConsentTokenResponse: additionalProperties: false properties: accountRef: description: >- Vendor item/link id this token was scoped to (the stored binding); empty on a first consent. Pass it to the vendor widget's update mode alongside the token — do not substitute a locally cached value. examples: - a1b2c3d4-5678-90ab-cdef-1234567890ab type: string configName: description: Config name of the connection the token was minted for examples: - pluggy-main type: string expiresAt: description: UTC instant after which the vendor rejects this consent token examples: - '2026-08-23T12:30:00Z' format: date-time type: string reconsent: description: >- Whether the token re-authorizes the connection's existing vendor item/link (true) or will create a new one (false) examples: - false type: boolean token: description: Consent token for the vendor widget. Pass it to the widget. examples: - eyJhbGciOi... type: string vendor: description: Aggregator vendor the consent token was minted against enum: - pluggy - belvo examples: - pluggy type: string required: - vendor - configName - token - expiresAt - reconsent - accountRef type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). examples: - ERR-0001 type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object RateLimitErrorResponse: description: >- Flat body that the rate limiter returns. `code` is the HTTP status as a number. type: object required: - code - title - message properties: code: type: integer description: HTTP status code. example: 429 title: type: string description: Error type. example: rate_limit_exceeded message: type: string description: Human-readable error message. example: rate limit exceeded responses: Unauthorized: description: The request lacks valid authentication credentials. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: MissingToken: summary: Missing token value: type: https://errors.lerian.studio/v1/AUT-0006 title: Token Missing status: 401 detail: >- A valid token must be provided in the request header. Please include a token and try again. code: AUT-0006 InvalidToken: summary: Invalid token value: type: https://errors.lerian.studio/v1/AUT-0007 title: Invalid Token status: 401 detail: >- The provided token is expired, invalid or malformed. Please provide a valid token and try again. code: AUT-0007 Forbidden: description: You do not have permission to access this resource. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' examples: TenantClaimRequired: summary: Tenant claim missing value: type: https://errors.lerian.studio/v1/MTCH-0004 title: Forbidden status: 403 detail: tenant claim required code: MTCH-0004 PermissionDenied: summary: Permission denied value: type: https://errors.lerian.studio/v1/AUT-1020 title: Permission Denied status: 403 detail: >- the credential is not allowed to perform contexts:read on this request code: AUT-1020 TooManyRequests: description: >- The request exceeded the rate limit. Wait the number of seconds in `Retry-After`, then retry. headers: Retry-After: $ref: '#/components/headers/RetryAfter' X-RateLimit-Limit: $ref: '#/components/headers/XRateLimitLimit' X-RateLimit-Remaining: $ref: '#/components/headers/XRateLimitRemaining' X-RateLimit-Reset: $ref: '#/components/headers/XRateLimitReset' content: application/json: schema: $ref: '#/components/schemas/RateLimitErrorResponse' example: code: 429 title: rate_limit_exceeded message: rate limit exceeded InternalServerError: description: An unexpected error occurred on the server. content: application/problem+json: schema: $ref: '#/components/schemas/Detail' example: type: https://errors.lerian.studio/v1/MTCH-0002 title: Internal Server Error status: 500 detail: internal error code: MTCH-0002 text/plain: schema: type: string example: Internal Server Error examples: mtch-0005-aggregator-connection-not-found: summary: Aggregator connection not found value: type: https://errors.lerian.studio/v1/MTCH-0005 title: Not Found status: 404 detail: >- The aggregator connection could not be found; check the connection id and try again code: MTCH-0005 mtch-0213-consent-flow-not-available: summary: Consent flow not available for this vendor value: type: https://errors.lerian.studio/v1/MTCH-0213 title: Unprocessable Entity status: 422 detail: >- Matcher cannot open a hosted consent flow for this aggregator vendor on this deployment, so no consent token was created and nothing changed. Contact support if you need the consent flow for this vendor. code: MTCH-0213 mtch-0212-consent-token-not-issued: summary: Vendor did not issue a consent token value: type: https://errors.lerian.studio/v1/MTCH-0212 title: Unprocessable Entity status: 422 detail: >- The aggregator vendor did not issue a consent token, so nothing was created and nothing changed. Test the connection's credentials and try again; if they are healthy, retry shortly. code: MTCH-0212 headers: RetryAfter: description: Seconds to wait before you retry. schema: type: integer example: 30 XRateLimitLimit: description: Requests allowed in the current window. schema: type: integer example: 100 XRateLimitRemaining: description: Requests left in the current window. Always `0` on a `429`. schema: type: integer example: 0 XRateLimitReset: description: Unix time, in seconds, when the current window resets. schema: type: integer example: 1767225600 securitySchemes: BearerAuth: bearerFormat: JWT description: 'Bearer token authentication (format: "Bearer {token}")' scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.