> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# Initiate with a token

POST https://clients.infonite.tech/api/executions/init/v1/tokenized
Content-Type: application/json

Start an execution with a **stored token** instead of credentials: you send the token, the platform recovers the access it stands for, and the engine logs in with it. You never held the password, and this endpoint does not return it.

Everything else behaves like [Initiate with parameters](api:POST/executions/init/v1/parametrized) — same `202`, same `execution_id`, same way of following it and reading its results.

**New to tokenization?** [Credential Tokenization](/guides/credential-tokenization) is the explanation — what a token is, which half each side holds, why neither of us can open the credentials alone, and how long it lives. Read it before you build against this endpoint.

**And this is never the first run.** A token exists only because an earlier [parametrized execution](api:POST/executions/init/v1/parametrized) asked for `base_configurations.tokenized_access`, came back with a `ticket`, and that ticket was exchanged — once — at [Exchange a Ticket](api:PUT/executions/t10n). No token yet? That is where to start. The same per-application capability that allowed that run is what allows this one.

**`customer_interaction_available` matters most on this call.** As covered in [Initiate with parameters](api:POST/executions/init/v1/parametrized), it decides whether the source may contact your customer — and a token is usually a scheduled refresh nobody is watching. Left at `false`, no SMS or push is ever sent: the run ends with `CUSTOMER_INTERVENTION_REQUIRED` instead of waking somebody up.

## The token decides who and where

Three things are **not yours to choose here** — they were fixed when the token was minted, and sending them changes nothing:

Comes from the token, exactly as you sent it on the first run.

Comes from the token. One token, one source, for life.

Recovered from storage. There is no `parameters` field on this request at all.

What you can still choose is `features` — **from the set the token was scoped to**, never beyond it. Asking for fewer is normal; asking for one outside the original scope is refused. If you need a wider scope, run a parametrized execution with the features you want and mint a new token from it: broadening what stored credentials may reach should require the credentials again.

`base_configurations`, `external_execution_id` and `hooks_extra_data` work exactly as they do on the parametrized request — with one field missing from the block: **`tokenized_access` is not part of a tokenized request.** This run is already tokenized, and a token cannot ask for a ticket. Sending it anyway is ignored rather than refused, so an integration that shares one payload builder between both calls keeps working.

## What the answers mean

| Status | Meaning                                                                                                                                                                                                                                                                                                                                                  |
| :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `202`  | Accepted and queued, with the `execution_id` to follow.                                                                                                                                                                                                                                                                                                  |
| `403`  | **Two refusals, told apart by `detail`.** `t10n_not_found` is the vague one on purpose — no such token, or the wrong key — because guessing tokens must teach nobody anything. `app_t10_disabled` (or `app_t10_forbidden`) is the other: your application is not enabled to tokenize, checked before the body is read and nothing to do with this token. |
| `423`  | **The token is locked**, so nothing was launched. `T10N_LOGIN_LOCK` means the source rejected the stored credentials and only your customer can fix it; `T10N_SYSTEM_LOCK` is ours and usually passes.                                                                                                                                                   |
| `400`  | Refused before creating anything — `T10N_REJECTED` for a revoked or broken token, `T10N_EXCEPTION` when the stored credentials could not be read. Both need a new token, not a retry.                                                                                                                                                                    |
| `409`  | An execution is already running on this token. The body names it; follow that one.                                                                                                                                                                                                                                                                       |
| `503`  | The engine is not available. Not your request — retry later, or check the catalogue.                                                                                                                                                                                                                                                                     |

**A locked token means a person has to act, and retrying makes it worse.** Institutions count failed logins, and enough of them locks the account for your customer, not just for you. Read [Token Status](api:GET/executions/t10n/\{token_id}) before a batch, and drop the tokens that are not `T10N_OK` or `T10N_KO` from the run.

**Server to server only.** This call is authorised with your application secret: it belongs in your backend, never in a browser, a mobile app or anything your customer can read. A leaked secret launches executions on your account.

Reference: https://infonite.dev/api-reference/direct-executions/direct-executions-api/starting-executions/direct-executions-v-1-init-tokenized

## Authentication

- `X-APP-SECRET` header (required) — Application Secret

## Servers

- `https://clients.infonite.tech/api` (Legacy Server, default)
- `https://clients.infonite.io/api` (Production Server)

## Request

### Body (application/json)

This endpoint expects an object.

- `token` (object, required) — The pair that stands in for a customer's credentials: an identifier and a key. It is what [Exchange a Ticket](/api-reference/direct-executions/direct-executions-api/tokenization/direct-executions-v-1-token-exchange) handed you — once — in return for the ticket a first execution issued, and what you send back to run that access again without holding the password. **The two halves are not interchangeable.** The id says WHICH stored credentials; the key is what makes them readable, together with a secret that never leaves our runtime. Send both, and keep the key as you keep a password: nothing here will ever show it to you again. The [Credential Tokenization](/guides/credential-tokenization) guide explains the shared-custody model behind that. **The key can travel encrypted**, like any other secret you send us: either value may be `rsa::…` or `hybrid::…`, or the whole object may be one encrypted string. [How to encrypt it](/guides/payload-encryption#sending-values-in-the-other-direction).
  - `token_id` (string, required) — Identifies the stored credentials. Safe to log and to keep beside your customer record — on its own it opens nothing.
  - `token_key` (string, required) — The secret half, and the only copy of it. Store it encrypted, keep it out of your logs, and treat losing it as losing the credentials: nobody — including us — can open them without it.
- `external_execution_id` (string, optional) — Your own reference for this run — a case number, a job id, whatever your system calls it. We store it, echo it back on every state and event, and offer it as `{external_execution_id}` in the URL of the webhooks we deliver. We never interpret it. It has one effect: a second execution with the same reference, for the same customer and still running, is refused with `409`. That is also what lets you run one engine twice at once — give each run a different reference.
- `base_configurations` (object, optional) — How the execution behaves, as opposed to what it retrieves. Every setting has a default, so the block is optional — but `customer_interaction_available` decides the shape of your integration and, with it, **whether your customer's phone rings**. Choose it on every request.
  - `customer_interaction_available` (boolean, optional, default: false) — Whether somebody is there, right now, to answer a challenge from the source. **This is what decides whether the source is allowed to contact your customer.** With `false`, an engine that needs a one-time code does not ask for one: no SMS, no push notification, no e-mail — the execution ends as `ABORTED` / `CUSTOMER_INTERVENTION_REQUIRED` instead. That is the setting a nightly batch wants: nobody is woken at 03:00 for a run nobody is watching. With `true` the execution pauses, an `action_required` event is delivered and you have minutes — the institution's timetable — to send the answer back.
  - `execution_timeout` (integer, optional, default: 1200) — Maximum allowed active processing time in seconds. The execution will automatically abort if it exceeds this duration.
  - `unlock_protected_data` (boolean, optional, default: false) — If true, the engine can unlock data protected by multi-factor authentication (MFA).
- `features` (list of object, optional) — What to retrieve. Every feature is a name — `accounts_read`, `labor_check` — and you may send it as the bare string, or as an object when you want to configure it: `{"code": "accounts_read", "configurations": {…}}`. The features an engine offers, and the settings each one accepts, are in [Show Engine Details](/api-reference/direct-executions/direct-executions-api/engines/direct-executions-v-1-engine-details). Ask for one it does not implement and it is **ignored**: no data, no error, and nothing in the results to say it was skipped — which is why the list is built from the catalogue. **Ask only for what you will use**: each feature is more time inside the source, and a slow one holds the whole execution.
  - `code`: `academic_data` (Academic Data)
    - `configurations` (object, optional)
  - `code`: `accounts_read` (Financial Accounts Read)
    - `configurations` (object, optional)
      - `from_date` (date, optional, default: 30 days ago) — The date from which the sub-product will be read
      - `to_date` (date, optional, default: today) — The date until which the sub-product will be read
      - `limits_behaviour` (enum, optional, default: error) — The behaviour when the date limits are not respected. - `error`: raise an error and abort the execution - `adapt`: adapt the dates to the limits and continue the execution
        - Allowed values: `error`, `adapt`
      - `read_transactions` (boolean, optional, default: false) — If true, the engine will try to read the account transactions
      - `read_holders` (boolean, optional, default: false) — If true, the engine will try to read the account holders
  - `code`: `cards_read` (Financial Cards Read)
    - `configurations` (object, optional)
      - `from_date` (date, optional, default: 30 days ago) — The date from which the sub-product will be read
      - `to_date` (date, optional, default: today) — The date until which the sub-product will be read
      - `limits_behaviour` (enum, optional, default: error) — The behaviour when the date limits are not respected. - `error`: raise an error and abort the execution - `adapt`: adapt the dates to the limits and continue the execution
        - Allowed values: `error`, `adapt`
      - `read_transactions` (boolean, optional, default: false) — If true, the engine will try to read the card transactions
      - `filter_by_type` (list of enum, optional, default: ["financial_card:credit","financial_card:mixed","financial_card:debit","financial_card:prepaid"]) — The types of cards to be read. By default all types are requested
        - Allowed values: `financial_card:debit`, `financial_card:credit`, `financial_card:prepaid`, `financial_card:mixed`
  - `code`: `client_invoices_read` (Client Invoices Read)
    - `configurations` (object, optional)
      - `from_date` (date, optional, default: 30 days ago) — The date from which the sub-product will be read
      - `to_date` (date, optional, default: today) — The date until which the sub-product will be read
      - `limits_behaviour` (enum, optional, default: error) — The behaviour when the date limits are not respected. - `error`: raise an error and abort the execution - `adapt`: adapt the dates to the limits and continue the execution
        - Allowed values: `error`, `adapt`
  - `code`: `credit_registry_data` (Credit Registry Data)
    - `configurations` (object, optional)
      - `preferred_type` (enum, optional) — Preferred credit registry report type to retrieve
        - Allowed values: `credit_registry_data:es_cirbe_detailed`, `credit_registry_data:es_cirbe_aggregated`
  - `code`: `credits_read` (Financial Credits Read)
    - `configurations` (object, optional)
      - `from_date` (date, optional, default: 30 days ago) — The date from which the sub-product will be read
      - `to_date` (date, optional, default: today) — The date until which the sub-product will be read
      - `limits_behaviour` (enum, optional, default: error) — The behaviour when the date limits are not respected. - `error`: raise an error and abort the execution - `adapt`: adapt the dates to the limits and continue the execution
        - Allowed values: `error`, `adapt`
      - `read_transactions` (boolean, optional, default: false) — If true, the engine will try to read the credit transactions
      - `read_holders` (boolean, optional, default: false) — If true, the engine will try to read the credit holders
  - `code`: `customer_information_read` (Customer Information Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `deposits_read` (Financial Deposits Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `direct_debits_read` (Direct Debits Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `driver_data` (Driver Data)
    - `configurations` (object, optional)
      - `read_point_movements` (boolean, optional, default: false)
  - `code`: `funds_read` (Investment Funds Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `investment_accounts_read` (Investment Accounts Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `labor_check` (Labor Check)
    - `configurations` (object, optional)
      - `from_date` (date, optional, default: 12 months ago) — The date from which the contribution history will be retrieved
      - `work_life_report` (boolean, optional, default: true) — Whether to read the work life report.
      - `contribution_base_report` (boolean, optional, default: false) — Whether to read the contribution base report.
  - `code`: `loans_read` (Financial Loans Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `pensions_read` (Pension Plans Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `properties_data` (Properties Data)
    - `configurations` (object, optional)
  - `code`: `public_document_verification` (Public Document Verification)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `public_pensions` (Public Pensions)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `source_contracts_read` (Source Contracts Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `stocks_read` (Investment Stocks Read)
    - `configurations` (object, optional) — This feature does not require any configuration
  - `code`: `supplier_invoices_read` (Supplier Invoices Read)
    - `configurations` (object, optional)
      - `from_date` (date, optional, default: 30 days ago) — The date from which the sub-product will be read
      - `to_date` (date, optional, default: today) — The date until which the sub-product will be read
      - `limits_behaviour` (enum, optional, default: error) — The behaviour when the date limits are not respected. - `error`: raise an error and abort the execution - `adapt`: adapt the dates to the limits and continue the execution
        - Allowed values: `error`, `adapt`
  - `code`: `vehicles_data` (Vehicles Data)
    - `configurations` (object, optional)
      - `simple_vehicle_report` (boolean, optional, default: false)
  - `code`: `yearly_individual_tax` (Yearly Taxes for Individuals)
    - `configurations` (object, optional)
      - `last_n_years` (integer, optional, default: 3) — Last n years to retrieve the tax data.
- `hooks_extra_data` (map from string to string, optional, default: {}) — Your own context, carried into every webhook this execution delivers. Each key and value is appended to the delivery as a **query parameter**, so a handler reads it without opening the body. A value may also be a template variable — `{external_execution_id}`, `{event}`, `{status_reason}`… — replaced with this execution's own data at send time; anything else is sent verbatim. The full list, and the rest of the delivery contract, is in [Webhooks](/direct-executions/webhooks). **Never put secrets here.** Query strings end up in access logs and proxies; your endpoint's authentication belongs in its header.
- `configurations` (map from string to any, optional) — Engine-specific settings, and **almost always empty**. An engine takes what it needs through `parameters` and `features`; this is for the rare source that asks for something structural on top, and that engine declares exactly what in its own spec at [Show Engine Details](/api-reference/direct-executions/direct-executions-api/engines/direct-executions-v-1-engine-details). If you are wondering whether the engine you are integrating needs one: it does not. The handful that do are unmistakable about it.

## Response

### 202

**202 Accepted****Accepted, not finished.** The execution is queued; what the source says comes later, in the state and in the events.

- `app_id` (string, required) — The application this execution was launched with — the one your secret belongs to. Worth keeping when your product uses more than one, a sandbox and a production app being the usual case: every record and every event we send carries it.
- `customer_id` (string, required) — The `customer_id` you supplied when the execution was initialised, returned as you sent it — so an answer can be routed to the right case with no lookup on your side.
- `auth_origin` (enum, required) — How the call that created the execution was authorised: an application secret for a server-to-server call, or a user session when it was launched from a console. An audit field — it says who started the run, not how it went.
  - Allowed values: `app-secret`, `user-token`, `session-token`
- `engine_reference` (string, required) — The engine this execution runs, exactly as the catalogue publishes it. It is echoed on every event and every record, so a stored result says which source it came from with no lookup on your side.
- `status_reason` (enum or enum or enum or enum or enum or enum or enum or enum or enum or enum, required) — The precise cause of the state. Every reason belongs to exactly one `status_code` family and its wording never changes, so it is safe to branch on — read `status_code` when the family is all you need, and see [the lifecycle](/direct-executions/lifecycle#every-reason-by-family) for what each one asks of you. * Reasons for `ONGOING`: * `ACCEPTED`: queued, nothing has started yet. * `WAITING`: picked up, the engine is warming up. * `RUNNING`: logged in and extracting. * `ASYNC_WAIT`: waiting on the source to produce something on its own schedule. * Reasons for `ACTION_REQUIRED`: * `MFA_REQUIRED`: the source asked for a strong-authentication factor. * `INPUT_REQUIRED`: the engine needs another field it could not know in advance. * Reasons for `COMPLETED`: * `COMPLETED`: every requested feature answered. * Reasons for `PARTIAL`: * `PARTIAL`: finished, with some features answered and others not. * Reasons for `FAILED`: * `FAILED`: finished, and nothing could be retrieved. * Reasons for `ABORTED`: * `CLIENT_CANCELLED`: you aborted it. * `USER_CANCELLED`: your customer abandoned it. * `ACTION_TIMEOUT`: nobody answered the challenge in time. * `TIMEOUT`: the run exceeded its `execution_timeout`. * `CUSTOMER_INTERVENTION_REQUIRED`: a person was needed and none was available. * `SYSTEM_CANCELLED`: the platform stopped it. * Reasons for `AUTH_ERROR` — the source refused the login, and retrying the same values will not help: * `INCORRECT_CREDENTIALS`: rejected. Ask your customer for them again. * `INCORRECT_MFA`: the challenge was answered wrongly. * `BLOCKED_USER`: the institution has blocked the access. * `FRIEZED_CREDENTIALS`: the access is temporarily frozen. * `CHANGE_PASSWORD`: the institution requires a password change first. * `MANUAL_INTERVENTION`: the person must do something in the source's own channel. * `INCOMPATIBLE_ACCESS`: this access does not work through this engine's channel. * `DUPLICATED_SESSION`: another session is already open for that user. * Reasons for `UNHANDLED_AUTH_ERROR`: * `UNHANDLED_AUTH_ERROR`: the login failed in a way we could not classify. * Reasons for `CONFIGURATION_ERROR` — the request itself, so retrying it unchanged fails the same way: * `BAD_CONFIGURATIONS`: a feature configuration the engine does not accept. * `INCORRECT_PARAMETERS_FORMAT`: the parameters did not match the engine's form. * `INCORRECT_RESUME_FORMAT`: the resume body did not match the published form. * `ENCRYPTION_ERROR`: an encrypted value could not be opened. * `T10N_FORBIDDEN`: your application may not tokenize. * `T10N_NOT_AVAILABLE`: this engine does not support tokenization. * `T10N_REJECTED`: the token is revoked or broken. * `T10N_EXCEPTION`: the stored credentials could not be read. * `BAD_PROXY_CONFIGURATION`: ours, not yours — contact support. * Reasons for `TEMPORARY_ERROR` — nothing is wrong with your request, retry later: * `OUT_OF_SERVICE`: the source itself is unavailable. * `ENGINE_UNAVAILABLE`: the engine is not serving right now. * `ALREADY_EXECUTING`: another execution is already running for that access. * `ENGINE_BANNED`, `AUTO_CAPTCHA_ERROR`, `PROXY_ERROR`, `NETWORK_ERROR`, `INTERNAL_ERROR`: the run could not be set up. Ours, and transient. `AUTH_OK` belongs to this vocabulary too, but it only ever appears in `authentication_status`: a login that succeeds leaves the execution `ONGOING`.
- `status_code` (enum, required) — The family a state belongs to, and the value to branch on: it is always present, and every `status_reason` belongs to exactly one of these. The precise cause lives in the reason — read it when the family is not specific enough to decide. Allowed values are: - `ONGOING`: The execution is ongoing - `ACTION_REQUIRED`: The execution is waiting for an input - `COMPLETED`: The execution has been completed - `ABORTED`: The execution has been aborted - `CONFIGURATION_ERROR`: The execution has been rejected due to a configuration error - `PARTIAL`: The execution has been completed with errors - `TEMPORARY_ERROR`: The execution cannot be processed due to a temporary error - `AUTH_ERROR`: The execution failed due to an authentication error - `UNHANDLED_AUTH_ERROR`: The execution failed during the login because of an unhandled error - `FAILED`: The execution has failed
  - Allowed values: `ONGOING`, `ACTION_REQUIRED`, `COMPLETED`, `ABORTED`, `CONFIGURATION_ERROR`, `PARTIAL`, `TEMPORARY_ERROR`, `AUTH_ERROR`, `UNHANDLED_AUTH_ERROR`, `FAILED`
- `execution_id` (string, optional) — The handle to this execution, and the one value worth storing from this response: you poll it for the state, you match it against the webhooks we deliver, and every results endpoint is addressed by it. **Present only when the execution was created.** A request refused before that — a collision, an invalid configuration — answers without it.
- `session_id` (string, optional) — The session this execution belongs to. An execution launched on its own is its own session, so today the two values usually match — **treat them as two independent identifiers anyway**: an execution can be one step of a wider journey, and a run you are pointed at is not always the one you asked for. Address results and state by `execution_id`. Like it, this is only present when an execution was created.
- `external_execution_id` (string, optional) — The reference you attached when the execution was started, if you sent one — echoed so your own identifier travels beside ours, on this response and on every event.
- `status_message` (string, optional) — A human-readable note, when there is one to add. It is diagnostic and never a contract: do not parse it and do not show it to your end user as it comes — branch on `status_reason` and write your own copy.
- `session_token` (string, optional) — A short-lived token that authorises **acting on this execution and nothing else**: it cannot read a single extracted record, and it stops working when the execution ends. **Resolving a pause through this API needs none of it** — collect the value and send it to the resume endpoint. The token is for the other option, which is **coming**: handing that moment to a minimal hosted interface instead of building the screens yourself. Not a [flow](/flows/overview) — no journey, no consent step, no branding, just what a pause needs over the execution you already started. Until it ships there is nothing to present this token to, so you can safely ignore it. The prefix says which kind of run issued it: `st_test_` when the run is a rehearsal — a sandbox application, or a sandbox engine under a production one — and `st_live_` otherwise.

## Errors

### 400 Bad Request Error

**400 Bad Request**The execution was perfectly viable — the request is complete, and a malformed one answers `422` instead. What stops it is one detail we can see BEFORE initialising anything: something that makes this run impossible, not merely likely to fail. `status_reason` says which, from the same vocabulary a finished execution uses — so your code can read a refusal exactly as it reads a failure. There is no `execution_id`, because no execution was ever created, and nothing was persisted. On this way in the reasons are the token's: `T10N_REJECTED` for one that was revoked or is broken, `T10N_EXCEPTION` when the stored credentials cannot be opened. Both need a new token, not a retry.

- `app_id` (string, required) — The application this execution was launched with — the one your secret belongs to. Worth keeping when your product uses more than one, a sandbox and a production app being the usual case: every record and every event we send carries it.
- `customer_id` (string, required) — The `customer_id` you supplied when the execution was initialised, returned as you sent it — so an answer can be routed to the right case with no lookup on your side.
- `auth_origin` (enum, required) — How the call that created the execution was authorised: an application secret for a server-to-server call, or a user session when it was launched from a console. An audit field — it says who started the run, not how it went.
  - Allowed values: `app-secret`, `user-token`, `session-token`
- `engine_reference` (string, required) — The engine this execution runs, exactly as the catalogue publishes it. It is echoed on every event and every record, so a stored result says which source it came from with no lookup on your side.
- `status_reason` (enum or enum or enum or enum or enum or enum or enum or enum or enum or enum, required) — The precise cause of the state. Every reason belongs to exactly one `status_code` family and its wording never changes, so it is safe to branch on — read `status_code` when the family is all you need, and see [the lifecycle](/direct-executions/lifecycle#every-reason-by-family) for what each one asks of you. * Reasons for `ONGOING`: * `ACCEPTED`: queued, nothing has started yet. * `WAITING`: picked up, the engine is warming up. * `RUNNING`: logged in and extracting. * `ASYNC_WAIT`: waiting on the source to produce something on its own schedule. * Reasons for `ACTION_REQUIRED`: * `MFA_REQUIRED`: the source asked for a strong-authentication factor. * `INPUT_REQUIRED`: the engine needs another field it could not know in advance. * Reasons for `COMPLETED`: * `COMPLETED`: every requested feature answered. * Reasons for `PARTIAL`: * `PARTIAL`: finished, with some features answered and others not. * Reasons for `FAILED`: * `FAILED`: finished, and nothing could be retrieved. * Reasons for `ABORTED`: * `CLIENT_CANCELLED`: you aborted it. * `USER_CANCELLED`: your customer abandoned it. * `ACTION_TIMEOUT`: nobody answered the challenge in time. * `TIMEOUT`: the run exceeded its `execution_timeout`. * `CUSTOMER_INTERVENTION_REQUIRED`: a person was needed and none was available. * `SYSTEM_CANCELLED`: the platform stopped it. * Reasons for `AUTH_ERROR` — the source refused the login, and retrying the same values will not help: * `INCORRECT_CREDENTIALS`: rejected. Ask your customer for them again. * `INCORRECT_MFA`: the challenge was answered wrongly. * `BLOCKED_USER`: the institution has blocked the access. * `FRIEZED_CREDENTIALS`: the access is temporarily frozen. * `CHANGE_PASSWORD`: the institution requires a password change first. * `MANUAL_INTERVENTION`: the person must do something in the source's own channel. * `INCOMPATIBLE_ACCESS`: this access does not work through this engine's channel. * `DUPLICATED_SESSION`: another session is already open for that user. * Reasons for `UNHANDLED_AUTH_ERROR`: * `UNHANDLED_AUTH_ERROR`: the login failed in a way we could not classify. * Reasons for `CONFIGURATION_ERROR` — the request itself, so retrying it unchanged fails the same way: * `BAD_CONFIGURATIONS`: a feature configuration the engine does not accept. * `INCORRECT_PARAMETERS_FORMAT`: the parameters did not match the engine's form. * `INCORRECT_RESUME_FORMAT`: the resume body did not match the published form. * `ENCRYPTION_ERROR`: an encrypted value could not be opened. * `T10N_FORBIDDEN`: your application may not tokenize. * `T10N_NOT_AVAILABLE`: this engine does not support tokenization. * `T10N_REJECTED`: the token is revoked or broken. * `T10N_EXCEPTION`: the stored credentials could not be read. * `BAD_PROXY_CONFIGURATION`: ours, not yours — contact support. * Reasons for `TEMPORARY_ERROR` — nothing is wrong with your request, retry later: * `OUT_OF_SERVICE`: the source itself is unavailable. * `ENGINE_UNAVAILABLE`: the engine is not serving right now. * `ALREADY_EXECUTING`: another execution is already running for that access. * `ENGINE_BANNED`, `AUTO_CAPTCHA_ERROR`, `PROXY_ERROR`, `NETWORK_ERROR`, `INTERNAL_ERROR`: the run could not be set up. Ours, and transient. `AUTH_OK` belongs to this vocabulary too, but it only ever appears in `authentication_status`: a login that succeeds leaves the execution `ONGOING`.
- `status_code` (enum, required) — The family a state belongs to, and the value to branch on: it is always present, and every `status_reason` belongs to exactly one of these. The precise cause lives in the reason — read it when the family is not specific enough to decide. Allowed values are: - `ONGOING`: The execution is ongoing - `ACTION_REQUIRED`: The execution is waiting for an input - `COMPLETED`: The execution has been completed - `ABORTED`: The execution has been aborted - `CONFIGURATION_ERROR`: The execution has been rejected due to a configuration error - `PARTIAL`: The execution has been completed with errors - `TEMPORARY_ERROR`: The execution cannot be processed due to a temporary error - `AUTH_ERROR`: The execution failed due to an authentication error - `UNHANDLED_AUTH_ERROR`: The execution failed during the login because of an unhandled error - `FAILED`: The execution has failed
  - Allowed values: `ONGOING`, `ACTION_REQUIRED`, `COMPLETED`, `ABORTED`, `CONFIGURATION_ERROR`, `PARTIAL`, `TEMPORARY_ERROR`, `AUTH_ERROR`, `UNHANDLED_AUTH_ERROR`, `FAILED`
- `execution_id` (string, optional) — The handle to this execution, and the one value worth storing from this response: you poll it for the state, you match it against the webhooks we deliver, and every results endpoint is addressed by it. **Present only when the execution was created.** A request refused before that — a collision, an invalid configuration — answers without it.
- `session_id` (string, optional) — The session this execution belongs to. An execution launched on its own is its own session, so today the two values usually match — **treat them as two independent identifiers anyway**: an execution can be one step of a wider journey, and a run you are pointed at is not always the one you asked for. Address results and state by `execution_id`. Like it, this is only present when an execution was created.
- `external_execution_id` (string, optional) — The reference you attached when the execution was started, if you sent one — echoed so your own identifier travels beside ours, on this response and on every event.
- `status_message` (string, optional) — A human-readable note, when there is one to add. It is diagnostic and never a contract: do not parse it and do not show it to your end user as it comes — branch on `status_reason` and write your own copy.
- `session_token` (string, optional) — A short-lived token that authorises **acting on this execution and nothing else**: it cannot read a single extracted record, and it stops working when the execution ends. **Resolving a pause through this API needs none of it** — collect the value and send it to the resume endpoint. The token is for the other option, which is **coming**: handing that moment to a minimal hosted interface instead of building the screens yourself. Not a [flow](/flows/overview) — no journey, no consent step, no branding, just what a pause needs over the execution you already started. Until it ships there is nothing to present this token to, so you can safely ignore it. The prefix says which kind of run issued it: `st_test_` when the run is a rehearsal — a sandbox application, or a sandbox engine under a production one — and `st_live_` otherwise.

### 403 Forbidden Error

**403 Forbidden**Two different refusals, and the `detail` tells them apart. `t10n_not_found` is the deliberately vague one: no such token for your application, or a key that does not match — an attacker guessing tokens must learn nothing from it, so check [Token Status](api:GET/executions/t10n/\{token_id}) when you expected this one to work. `app_t10_disabled` (or `app_t10_forbidden`) is the other: your application is not enabled to tokenize, which is checked before the body is read — nothing to do with this token.

- `detail` (string, required) — Error message

### 404 Not Found Error

**404 Not Found**The engine the token is bound to no longer exists, or has no entity behind it. The token is scoped to one engine for life, so this one cannot be used again: mint a new one from a parametrized execution against an engine that is live.

- `detail` (string, required) — Error message

### 409 Conflict Error

**409 Conflict**Not so much a failure as a pointer: an execution matching this one is already running, and `execution_id` in the body is THAT run — follow it instead of starting another. Nothing was created here.

- `app_id` (string, required) — The application this execution was launched with — the one your secret belongs to. Worth keeping when your product uses more than one, a sandbox and a production app being the usual case: every record and every event we send carries it.
- `customer_id` (string, required) — The `customer_id` you supplied when the execution was initialised, returned as you sent it — so an answer can be routed to the right case with no lookup on your side.
- `auth_origin` (enum, required) — How the call that created the execution was authorised: an application secret for a server-to-server call, or a user session when it was launched from a console. An audit field — it says who started the run, not how it went.
  - Allowed values: `app-secret`, `user-token`, `session-token`
- `engine_reference` (string, required) — The engine this execution runs, exactly as the catalogue publishes it. It is echoed on every event and every record, so a stored result says which source it came from with no lookup on your side.
- `status_reason` (enum or enum or enum or enum or enum or enum or enum or enum or enum or enum, required) — The precise cause of the state. Every reason belongs to exactly one `status_code` family and its wording never changes, so it is safe to branch on — read `status_code` when the family is all you need, and see [the lifecycle](/direct-executions/lifecycle#every-reason-by-family) for what each one asks of you. * Reasons for `ONGOING`: * `ACCEPTED`: queued, nothing has started yet. * `WAITING`: picked up, the engine is warming up. * `RUNNING`: logged in and extracting. * `ASYNC_WAIT`: waiting on the source to produce something on its own schedule. * Reasons for `ACTION_REQUIRED`: * `MFA_REQUIRED`: the source asked for a strong-authentication factor. * `INPUT_REQUIRED`: the engine needs another field it could not know in advance. * Reasons for `COMPLETED`: * `COMPLETED`: every requested feature answered. * Reasons for `PARTIAL`: * `PARTIAL`: finished, with some features answered and others not. * Reasons for `FAILED`: * `FAILED`: finished, and nothing could be retrieved. * Reasons for `ABORTED`: * `CLIENT_CANCELLED`: you aborted it. * `USER_CANCELLED`: your customer abandoned it. * `ACTION_TIMEOUT`: nobody answered the challenge in time. * `TIMEOUT`: the run exceeded its `execution_timeout`. * `CUSTOMER_INTERVENTION_REQUIRED`: a person was needed and none was available. * `SYSTEM_CANCELLED`: the platform stopped it. * Reasons for `AUTH_ERROR` — the source refused the login, and retrying the same values will not help: * `INCORRECT_CREDENTIALS`: rejected. Ask your customer for them again. * `INCORRECT_MFA`: the challenge was answered wrongly. * `BLOCKED_USER`: the institution has blocked the access. * `FRIEZED_CREDENTIALS`: the access is temporarily frozen. * `CHANGE_PASSWORD`: the institution requires a password change first. * `MANUAL_INTERVENTION`: the person must do something in the source's own channel. * `INCOMPATIBLE_ACCESS`: this access does not work through this engine's channel. * `DUPLICATED_SESSION`: another session is already open for that user. * Reasons for `UNHANDLED_AUTH_ERROR`: * `UNHANDLED_AUTH_ERROR`: the login failed in a way we could not classify. * Reasons for `CONFIGURATION_ERROR` — the request itself, so retrying it unchanged fails the same way: * `BAD_CONFIGURATIONS`: a feature configuration the engine does not accept. * `INCORRECT_PARAMETERS_FORMAT`: the parameters did not match the engine's form. * `INCORRECT_RESUME_FORMAT`: the resume body did not match the published form. * `ENCRYPTION_ERROR`: an encrypted value could not be opened. * `T10N_FORBIDDEN`: your application may not tokenize. * `T10N_NOT_AVAILABLE`: this engine does not support tokenization. * `T10N_REJECTED`: the token is revoked or broken. * `T10N_EXCEPTION`: the stored credentials could not be read. * `BAD_PROXY_CONFIGURATION`: ours, not yours — contact support. * Reasons for `TEMPORARY_ERROR` — nothing is wrong with your request, retry later: * `OUT_OF_SERVICE`: the source itself is unavailable. * `ENGINE_UNAVAILABLE`: the engine is not serving right now. * `ALREADY_EXECUTING`: another execution is already running for that access. * `ENGINE_BANNED`, `AUTO_CAPTCHA_ERROR`, `PROXY_ERROR`, `NETWORK_ERROR`, `INTERNAL_ERROR`: the run could not be set up. Ours, and transient. `AUTH_OK` belongs to this vocabulary too, but it only ever appears in `authentication_status`: a login that succeeds leaves the execution `ONGOING`.
- `status_code` (enum, required) — The family a state belongs to, and the value to branch on: it is always present, and every `status_reason` belongs to exactly one of these. The precise cause lives in the reason — read it when the family is not specific enough to decide. Allowed values are: - `ONGOING`: The execution is ongoing - `ACTION_REQUIRED`: The execution is waiting for an input - `COMPLETED`: The execution has been completed - `ABORTED`: The execution has been aborted - `CONFIGURATION_ERROR`: The execution has been rejected due to a configuration error - `PARTIAL`: The execution has been completed with errors - `TEMPORARY_ERROR`: The execution cannot be processed due to a temporary error - `AUTH_ERROR`: The execution failed due to an authentication error - `UNHANDLED_AUTH_ERROR`: The execution failed during the login because of an unhandled error - `FAILED`: The execution has failed
  - Allowed values: `ONGOING`, `ACTION_REQUIRED`, `COMPLETED`, `ABORTED`, `CONFIGURATION_ERROR`, `PARTIAL`, `TEMPORARY_ERROR`, `AUTH_ERROR`, `UNHANDLED_AUTH_ERROR`, `FAILED`
- `execution_id` (string, optional) — The handle to this execution, and the one value worth storing from this response: you poll it for the state, you match it against the webhooks we deliver, and every results endpoint is addressed by it. **Present only when the execution was created.** A request refused before that — a collision, an invalid configuration — answers without it.
- `session_id` (string, optional) — The session this execution belongs to. An execution launched on its own is its own session, so today the two values usually match — **treat them as two independent identifiers anyway**: an execution can be one step of a wider journey, and a run you are pointed at is not always the one you asked for. Address results and state by `execution_id`. Like it, this is only present when an execution was created.
- `external_execution_id` (string, optional) — The reference you attached when the execution was started, if you sent one — echoed so your own identifier travels beside ours, on this response and on every event.
- `status_message` (string, optional) — A human-readable note, when there is one to add. It is diagnostic and never a contract: do not parse it and do not show it to your end user as it comes — branch on `status_reason` and write your own copy.
- `session_token` (string, optional) — A short-lived token that authorises **acting on this execution and nothing else**: it cannot read a single extracted record, and it stops working when the execution ends. **Resolving a pause through this API needs none of it** — collect the value and send it to the resume endpoint. The token is for the other option, which is **coming**: handing that moment to a minimal hosted interface instead of building the screens yourself. Not a [flow](/flows/overview) — no journey, no consent step, no branding, just what a pause needs over the execution you already started. Until it ships there is nothing to present this token to, so you can safely ignore it. The prefix says which kind of run issued it: `st_test_` when the run is a rehearsal — a sandbox application, or a sandbox engine under a production one — and `st_live_` otherwise.

### 422 Unprocessable Entity Error

Validation Error

- `detail` (list of object, optional)
  - `loc` (list of string or integer, required)
  - `msg` (string, required)
  - `type` (string, required)
  - `input` (any, optional)
  - `ctx` (object, optional)

### 423 Locked Error

**423 Locked**The token is locked, so nothing was launched. It is the answer that saves you from a batch hammering an institution with credentials it has already rejected. `status_reason` is `T10N_REJECTED`; which lock it is comes from [Token Status](api:GET/executions/t10n/\{token_id}) — `T10N_LOGIN_LOCK` means the source refused the stored credentials and only your customer can resolve it, `T10N_SYSTEM_LOCK` is ours and usually passes.

- `app_id` (string, required) — The application this execution was launched with — the one your secret belongs to. Worth keeping when your product uses more than one, a sandbox and a production app being the usual case: every record and every event we send carries it.
- `customer_id` (string, required) — The `customer_id` you supplied when the execution was initialised, returned as you sent it — so an answer can be routed to the right case with no lookup on your side.
- `auth_origin` (enum, required) — How the call that created the execution was authorised: an application secret for a server-to-server call, or a user session when it was launched from a console. An audit field — it says who started the run, not how it went.
  - Allowed values: `app-secret`, `user-token`, `session-token`
- `engine_reference` (string, required) — The engine this execution runs, exactly as the catalogue publishes it. It is echoed on every event and every record, so a stored result says which source it came from with no lookup on your side.
- `status_reason` (enum or enum or enum or enum or enum or enum or enum or enum or enum or enum, required) — The precise cause of the state. Every reason belongs to exactly one `status_code` family and its wording never changes, so it is safe to branch on — read `status_code` when the family is all you need, and see [the lifecycle](/direct-executions/lifecycle#every-reason-by-family) for what each one asks of you. * Reasons for `ONGOING`: * `ACCEPTED`: queued, nothing has started yet. * `WAITING`: picked up, the engine is warming up. * `RUNNING`: logged in and extracting. * `ASYNC_WAIT`: waiting on the source to produce something on its own schedule. * Reasons for `ACTION_REQUIRED`: * `MFA_REQUIRED`: the source asked for a strong-authentication factor. * `INPUT_REQUIRED`: the engine needs another field it could not know in advance. * Reasons for `COMPLETED`: * `COMPLETED`: every requested feature answered. * Reasons for `PARTIAL`: * `PARTIAL`: finished, with some features answered and others not. * Reasons for `FAILED`: * `FAILED`: finished, and nothing could be retrieved. * Reasons for `ABORTED`: * `CLIENT_CANCELLED`: you aborted it. * `USER_CANCELLED`: your customer abandoned it. * `ACTION_TIMEOUT`: nobody answered the challenge in time. * `TIMEOUT`: the run exceeded its `execution_timeout`. * `CUSTOMER_INTERVENTION_REQUIRED`: a person was needed and none was available. * `SYSTEM_CANCELLED`: the platform stopped it. * Reasons for `AUTH_ERROR` — the source refused the login, and retrying the same values will not help: * `INCORRECT_CREDENTIALS`: rejected. Ask your customer for them again. * `INCORRECT_MFA`: the challenge was answered wrongly. * `BLOCKED_USER`: the institution has blocked the access. * `FRIEZED_CREDENTIALS`: the access is temporarily frozen. * `CHANGE_PASSWORD`: the institution requires a password change first. * `MANUAL_INTERVENTION`: the person must do something in the source's own channel. * `INCOMPATIBLE_ACCESS`: this access does not work through this engine's channel. * `DUPLICATED_SESSION`: another session is already open for that user. * Reasons for `UNHANDLED_AUTH_ERROR`: * `UNHANDLED_AUTH_ERROR`: the login failed in a way we could not classify. * Reasons for `CONFIGURATION_ERROR` — the request itself, so retrying it unchanged fails the same way: * `BAD_CONFIGURATIONS`: a feature configuration the engine does not accept. * `INCORRECT_PARAMETERS_FORMAT`: the parameters did not match the engine's form. * `INCORRECT_RESUME_FORMAT`: the resume body did not match the published form. * `ENCRYPTION_ERROR`: an encrypted value could not be opened. * `T10N_FORBIDDEN`: your application may not tokenize. * `T10N_NOT_AVAILABLE`: this engine does not support tokenization. * `T10N_REJECTED`: the token is revoked or broken. * `T10N_EXCEPTION`: the stored credentials could not be read. * `BAD_PROXY_CONFIGURATION`: ours, not yours — contact support. * Reasons for `TEMPORARY_ERROR` — nothing is wrong with your request, retry later: * `OUT_OF_SERVICE`: the source itself is unavailable. * `ENGINE_UNAVAILABLE`: the engine is not serving right now. * `ALREADY_EXECUTING`: another execution is already running for that access. * `ENGINE_BANNED`, `AUTO_CAPTCHA_ERROR`, `PROXY_ERROR`, `NETWORK_ERROR`, `INTERNAL_ERROR`: the run could not be set up. Ours, and transient. `AUTH_OK` belongs to this vocabulary too, but it only ever appears in `authentication_status`: a login that succeeds leaves the execution `ONGOING`.
- `status_code` (enum, required) — The family a state belongs to, and the value to branch on: it is always present, and every `status_reason` belongs to exactly one of these. The precise cause lives in the reason — read it when the family is not specific enough to decide. Allowed values are: - `ONGOING`: The execution is ongoing - `ACTION_REQUIRED`: The execution is waiting for an input - `COMPLETED`: The execution has been completed - `ABORTED`: The execution has been aborted - `CONFIGURATION_ERROR`: The execution has been rejected due to a configuration error - `PARTIAL`: The execution has been completed with errors - `TEMPORARY_ERROR`: The execution cannot be processed due to a temporary error - `AUTH_ERROR`: The execution failed due to an authentication error - `UNHANDLED_AUTH_ERROR`: The execution failed during the login because of an unhandled error - `FAILED`: The execution has failed
  - Allowed values: `ONGOING`, `ACTION_REQUIRED`, `COMPLETED`, `ABORTED`, `CONFIGURATION_ERROR`, `PARTIAL`, `TEMPORARY_ERROR`, `AUTH_ERROR`, `UNHANDLED_AUTH_ERROR`, `FAILED`
- `execution_id` (string, optional) — The handle to this execution, and the one value worth storing from this response: you poll it for the state, you match it against the webhooks we deliver, and every results endpoint is addressed by it. **Present only when the execution was created.** A request refused before that — a collision, an invalid configuration — answers without it.
- `session_id` (string, optional) — The session this execution belongs to. An execution launched on its own is its own session, so today the two values usually match — **treat them as two independent identifiers anyway**: an execution can be one step of a wider journey, and a run you are pointed at is not always the one you asked for. Address results and state by `execution_id`. Like it, this is only present when an execution was created.
- `external_execution_id` (string, optional) — The reference you attached when the execution was started, if you sent one — echoed so your own identifier travels beside ours, on this response and on every event.
- `status_message` (string, optional) — A human-readable note, when there is one to add. It is diagnostic and never a contract: do not parse it and do not show it to your end user as it comes — branch on `status_reason` and write your own copy.
- `session_token` (string, optional) — A short-lived token that authorises **acting on this execution and nothing else**: it cannot read a single extracted record, and it stops working when the execution ends. **Resolving a pause through this API needs none of it** — collect the value and send it to the resume endpoint. The token is for the other option, which is **coming**: handing that moment to a minimal hosted interface instead of building the screens yourself. Not a [flow](/flows/overview) — no journey, no consent step, no branding, just what a pause needs over the execution you already started. Until it ships there is nothing to present this token to, so you can safely ignore it. The prefix says which kind of run issued it: `st_test_` when the run is a rehearsal — a sandbox application, or a sandbox engine under a production one — and `st_live_` otherwise.

### 503 Service Unavailable Error

**503 Service Unavailable**The engine cannot run this, and it is not your request: it is in maintenance, has no published release, is not deployed, or is not open to this application. `detail` says which — the cases are the same ones [Initiate with parameters](api:POST/executions/init/v1/parametrized) lists.

- `detail` (string, required) — Error message

## Examples

### Run the same access again

**Request**

```json
{
  "token": {
    "token_id": "aaa48f1586c7ed54a13f559d",
    "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
  },
  "base_configurations": {
    "customer_interaction_available": false
  },
  "features": [
    {
      "code": "customer_information_read"
    },
    {
      "code": "accounts_read",
      "configurations": {
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true,
        "read_holders": true
      }
    },
    {
      "code": "cards_read",
      "configurations": {
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true
      }
    },
    {
      "code": "loans_read"
    }
  ]
}
```

**Response**

```json
{
  "app_id": "4aa3dcbab3287e2385bb5cec",
  "customer_id": "my-customer-1",
  "auth_origin": "app-secret",
  "engine_reference": "DEMOBANKXXXXFIN100ES9999-mobile",
  "status_reason": "ACCEPTED",
  "status_code": "ONGOING",
  "execution_id": "6aa3d8b418d1c5dc9a8e3d36",
  "session_id": "5aa3dca503e37e6809539a58",
  "external_execution_id": "case-A-1029",
  "session_token": "st_live_H6rhkDOx5XoAjtyW.A7kcIRNaDK6TMYijuiTu"
}
```

**SDK Code**

```python Run the same access again
import requests

url = "https://clients.infonite.tech/api/executions/init/v1/tokenized"

payload = {
    "token": {
        "token_id": "aaa48f1586c7ed54a13f559d",
        "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
    },
    "base_configurations": { "customer_interaction_available": False },
    "features": [{ "code": "customer_information_read" }, {
            "code": "accounts_read",
            "configurations": {
                "from_date": "30 days ago",
                "to_date": "today",
                "read_transactions": True,
                "read_holders": True
            }
        }, {
            "code": "cards_read",
            "configurations": {
                "from_date": "30 days ago",
                "to_date": "today",
                "read_transactions": True
            }
        }, { "code": "loans_read" }]
}
headers = {
    "X-APP-SECRET": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript Run the same access again
const url = 'https://clients.infonite.tech/api/executions/init/v1/tokenized';
const options = {
  method: 'POST',
  headers: {'X-APP-SECRET': '<apiKey>', 'Content-Type': 'application/json'},
  body: '{"token":{"token_id":"aaa48f1586c7ed54a13f559d","token_key":"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"},"base_configurations":{"customer_interaction_available":false},"features":[{"code":"customer_information_read"},{"code":"accounts_read","configurations":{"from_date":"30 days ago","to_date":"today","read_transactions":true,"read_holders":true}},{"code":"cards_read","configurations":{"from_date":"30 days ago","to_date":"today","read_transactions":true}},{"code":"loans_read"}]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Run the same access again
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://clients.infonite.tech/api/executions/init/v1/tokenized"

	payload := strings.NewReader("{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"base_configurations\": {\n    \"customer_interaction_available\": false\n  },\n  \"features\": [\n    {\n      \"code\": \"customer_information_read\"\n    },\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true,\n        \"read_holders\": true\n      }\n    },\n    {\n      \"code\": \"cards_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    },\n    {\n      \"code\": \"loans_read\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-APP-SECRET", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Run the same access again
require 'uri'
require 'net/http'

url = URI("https://clients.infonite.tech/api/executions/init/v1/tokenized")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-APP-SECRET"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"base_configurations\": {\n    \"customer_interaction_available\": false\n  },\n  \"features\": [\n    {\n      \"code\": \"customer_information_read\"\n    },\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true,\n        \"read_holders\": true\n      }\n    },\n    {\n      \"code\": \"cards_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    },\n    {\n      \"code\": \"loans_read\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body
```

```java Run the same access again
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://clients.infonite.tech/api/executions/init/v1/tokenized")
  .header("X-APP-SECRET", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"base_configurations\": {\n    \"customer_interaction_available\": false\n  },\n  \"features\": [\n    {\n      \"code\": \"customer_information_read\"\n    },\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true,\n        \"read_holders\": true\n      }\n    },\n    {\n      \"code\": \"cards_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    },\n    {\n      \"code\": \"loans_read\"\n    }\n  ]\n}")
  .asString();
```

```php Run the same access again
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://clients.infonite.tech/api/executions/init/v1/tokenized', [
  'body' => '{
  "token": {
    "token_id": "aaa48f1586c7ed54a13f559d",
    "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
  },
  "base_configurations": {
    "customer_interaction_available": false
  },
  "features": [
    {
      "code": "customer_information_read"
    },
    {
      "code": "accounts_read",
      "configurations": {
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true,
        "read_holders": true
      }
    },
    {
      "code": "cards_read",
      "configurations": {
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true
      }
    },
    {
      "code": "loans_read"
    }
  ]
}',
  'headers' => [
    'Content-Type' => 'application/json',
    'X-APP-SECRET' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp Run the same access again
using RestSharp;

var client = new RestClient("https://clients.infonite.tech/api/executions/init/v1/tokenized");
var request = new RestRequest(Method.POST);
request.AddHeader("X-APP-SECRET", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"base_configurations\": {\n    \"customer_interaction_available\": false\n  },\n  \"features\": [\n    {\n      \"code\": \"customer_information_read\"\n    },\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true,\n        \"read_holders\": true\n      }\n    },\n    {\n      \"code\": \"cards_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    },\n    {\n      \"code\": \"loans_read\"\n    }\n  ]\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Run the same access again
import Foundation

let headers = [
  "X-APP-SECRET": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [
  "token": [
    "token_id": "aaa48f1586c7ed54a13f559d",
    "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
  ],
  "base_configurations": ["customer_interaction_available": false],
  "features": [["code": "customer_information_read"], [
      "code": "accounts_read",
      "configurations": [
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true,
        "read_holders": true
      ]
    ], [
      "code": "cards_read",
      "configurations": [
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true
      ]
    ], ["code": "loans_read"]]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://clients.infonite.tech/api/executions/init/v1/tokenized")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Ask for less than the token allows

**Request**

```json
{
  "token": {
    "token_id": "aaa48f1586c7ed54a13f559d",
    "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
  },
  "external_execution_id": "case-A-1029",
  "base_configurations": {
    "customer_interaction_available": true
  },
  "features": [
    {
      "code": "accounts_read",
      "configurations": {
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true
      }
    }
  ]
}
```

**Response**

```json
{
  "app_id": "4aa3dcbab3287e2385bb5cec",
  "customer_id": "my-customer-1",
  "auth_origin": "app-secret",
  "engine_reference": "DEMOBANKXXXXFIN100ES9999-mobile",
  "status_reason": "ACCEPTED",
  "status_code": "ONGOING",
  "execution_id": "6aa3d8b418d1c5dc9a8e3d36",
  "session_id": "5aa3dca503e37e6809539a58",
  "external_execution_id": "case-A-1029",
  "session_token": "st_live_H6rhkDOx5XoAjtyW.A7kcIRNaDK6TMYijuiTu"
}
```

**SDK Code**

```python Ask for less than the token allows
import requests

url = "https://clients.infonite.tech/api/executions/init/v1/tokenized"

payload = {
    "token": {
        "token_id": "aaa48f1586c7ed54a13f559d",
        "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
    },
    "external_execution_id": "case-A-1029",
    "base_configurations": { "customer_interaction_available": True },
    "features": [
        {
            "code": "accounts_read",
            "configurations": {
                "from_date": "30 days ago",
                "to_date": "today",
                "read_transactions": True
            }
        }
    ]
}
headers = {
    "X-APP-SECRET": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript Ask for less than the token allows
const url = 'https://clients.infonite.tech/api/executions/init/v1/tokenized';
const options = {
  method: 'POST',
  headers: {'X-APP-SECRET': '<apiKey>', 'Content-Type': 'application/json'},
  body: '{"token":{"token_id":"aaa48f1586c7ed54a13f559d","token_key":"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"},"external_execution_id":"case-A-1029","base_configurations":{"customer_interaction_available":true},"features":[{"code":"accounts_read","configurations":{"from_date":"30 days ago","to_date":"today","read_transactions":true}}]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Ask for less than the token allows
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://clients.infonite.tech/api/executions/init/v1/tokenized"

	payload := strings.NewReader("{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"external_execution_id\": \"case-A-1029\",\n  \"base_configurations\": {\n    \"customer_interaction_available\": true\n  },\n  \"features\": [\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-APP-SECRET", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Ask for less than the token allows
require 'uri'
require 'net/http'

url = URI("https://clients.infonite.tech/api/executions/init/v1/tokenized")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-APP-SECRET"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"external_execution_id\": \"case-A-1029\",\n  \"base_configurations\": {\n    \"customer_interaction_available\": true\n  },\n  \"features\": [\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body
```

```java Ask for less than the token allows
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://clients.infonite.tech/api/executions/init/v1/tokenized")
  .header("X-APP-SECRET", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"external_execution_id\": \"case-A-1029\",\n  \"base_configurations\": {\n    \"customer_interaction_available\": true\n  },\n  \"features\": [\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    }\n  ]\n}")
  .asString();
```

```php Ask for less than the token allows
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://clients.infonite.tech/api/executions/init/v1/tokenized', [
  'body' => '{
  "token": {
    "token_id": "aaa48f1586c7ed54a13f559d",
    "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
  },
  "external_execution_id": "case-A-1029",
  "base_configurations": {
    "customer_interaction_available": true
  },
  "features": [
    {
      "code": "accounts_read",
      "configurations": {
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true
      }
    }
  ]
}',
  'headers' => [
    'Content-Type' => 'application/json',
    'X-APP-SECRET' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp Ask for less than the token allows
using RestSharp;

var client = new RestClient("https://clients.infonite.tech/api/executions/init/v1/tokenized");
var request = new RestRequest(Method.POST);
request.AddHeader("X-APP-SECRET", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"token\": {\n    \"token_id\": \"aaa48f1586c7ed54a13f559d\",\n    \"token_key\": \"l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8\"\n  },\n  \"external_execution_id\": \"case-A-1029\",\n  \"base_configurations\": {\n    \"customer_interaction_available\": true\n  },\n  \"features\": [\n    {\n      \"code\": \"accounts_read\",\n      \"configurations\": {\n        \"from_date\": \"30 days ago\",\n        \"to_date\": \"today\",\n        \"read_transactions\": true\n      }\n    }\n  ]\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Ask for less than the token allows
import Foundation

let headers = [
  "X-APP-SECRET": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [
  "token": [
    "token_id": "aaa48f1586c7ed54a13f559d",
    "token_key": "l5uVMTAaHf4oATDUzvahDjMAb7IRPPm2wHFGDSm3vmCseqZaujybW0rayVntpMy8"
  ],
  "external_execution_id": "case-A-1029",
  "base_configurations": ["customer_interaction_available": true],
  "features": [
    [
      "code": "accounts_read",
      "configurations": [
        "from_date": "30 days ago",
        "to_date": "today",
        "read_transactions": true
      ]
    ]
  ]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://clients.infonite.tech/api/executions/init/v1/tokenized")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```