> This page is for Financial Rider Flow.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# Get Session Settings

GET https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/{session_id}/settings

Retrieve the settings the session actually runs with.

They are resolved once, when the session is created, from what you sent and — for whatever you left out — your application's defaults. This read answers "what did you decide from what I gave you": the filters or the named bank, the features, how many banks may be connected, the consent screen, the completion behaviour. It never returns the `aes_key` nor the tokenization `ticket`.

> This endpoint needs to be executed with an app secret, so should always be used in server side without exposing the secret to customers.


Reference: https://infonite.dev/flows/financial-rider/api-reference/financial-rider-api/sessions-management/flows-financial-rider-v-1-session-settings

## Authentication

- `X-APP-SECRET` header (required) — Application Secret

## Servers

- `https://widgets.infonite.tech/api/flows` (Legacy, default)
- `https://widgets.infonite.io/api/flows` (Production)

## Request

### Path parameters

- `session_id` (string, required) — The session, as its creation returned it

## Response

### 200

**200 OK**The settings the session runs with

- `sandbox` (boolean, required) — Whether the session runs in sandbox, against demo entities.
- `consent_level` (enum, required) — The consent screen the session shows, as configured for your application.
  - Allowed values: `none`, `basic`
- `max_connections` (integer, required) — How many entities the end user may connect.
- `tokenized_access` (boolean, required) — Whether each connection tokenizes the credentials it authenticates with.
- `engines_layout` (enum, required) — How the selection screen lays out the entities: as you asked for it, else as configured for your application.
  - Allowed values: `list`, `1-row-list`, `2-row-list`, `3-row-list`
- `priority_engines` (list of string, required) — The entities listed first, by engine code and in this order: as you asked for them, else as configured for your application.
- `featured_engines` (FlowSettingsSchemaFeaturedEngines, required) — The entities highlighted on the selection, by engine code: as you asked for them, else as configured for your application.
- `executions_features` (list of FlowSettingsSchemaExecutionsFeaturesItems, required) — What the session reads from each connected entity.
- `hooks_extra_data` (map from string to string, required) — Extra data to be included in the hooks. This data will be returned in the webhook as part of the URL as query parameters. This can be useful to include dynamic data in the webhook. There are some template variables that can be used: * `{app_id}`: Your app ID * `{customer_id}`: The customer ID * `{session_id}`: The Session ID * `{parameters_id}`: The unique credentials ID, this identifier is computed by the engine based on the fixed part of the credentials (e.g. the username) * `{producer}`: The producer of the event * `{event}`: The event that triggered the hook * `{status_code}`: The status of the flow at the moment of the event For example, passing: ```json { "custom_param": "customValue", "current_event": "{event}", "status": "{status_code}", "id": "{session_id}" } ``` Will result in the following URL: `https://your.url.com/your/path?custom_param=customValue&current_event=ended&status=COMPLETED&id=67d7d9b72eb0693e7da47a0e` > **Note:** This data is not encrypted and should not contain sensitive information.
- `completion_mode` (enum, required) — What the widget does when the session ends.
  - Allowed values: `do_nothing`, `redirect`, `redirect_blank`
- `completion_extra_data` (map from string to string, required) — Extra data to be included in the redirect URL. This data will be added to the the url as query parameters. This can be useful to include dynamic data in the webhook. There are some template variables that can be used in the URL: * `{app_id}`: Your app ID * `{customer_id}`: The customer ID * `{session_id}`: The Session ID * `{status_code}`: The final status code of the session For example, passing: ```json { "custom_param": "customValue", "status": "{status_code}", "id": "{session_id}" } ``` Will result in the following URL: `https://your.url.com/your/path?custom_param=customValue&status=COMPLETED&id=67d7d9b72eb0693e7da47a0e` > **Note:** This data is not encrypted and should not contain sensitive information.
- `engine_reference` (string, optional) — The engine you named for the session. Absent when the session offers entities from the filters.
- `markets` (list of enum, optional) — The markets the session offers entities from. Absent when you named the engine.
  - Allowed values: `ES`, `CO`
- `entity_types` (list of enum, optional) — The kinds of financial entity the session offers. Absent when you named the engine.
  - Allowed values: `retail`, `corporate`, `private`, `investment`, `retailer_service`
- `completion_url` (string, optional) — Where the end user is sent when the session ends, when the mode redirects.

## Errors

### 401 Unauthorized Error

**401 Unauthorized**The application secret was not accepted

- `detail` (string, required) — Error message

### 403 Forbidden Error

**403 Forbidden**The application may not act

- `detail` (string, required) — Error message

### 404 Not Found Error

**404 Not Found**Session not found

- `detail` (string, required) — Error message

### 422 Unprocessable Entity Error

**422 Unprocessable Content**The session id in the path is not one

- `detail` (list of ValidationError, required)

### 429 Too Many Requests Error

**429 Too Many Requests**Too many requests. Rate limit exceeded.

- `detail` (string, required) — Error message

## Types

### FlowSettingsSchemaFeaturedEngines

The entities highlighted on the selection, by engine code: as you asked for them, else as configured for your application.

### FlowSettingsSchemaExecutionsFeaturesItems

- `code`: `accounts_read` (Financial Accounts Read)
  - `configurations` (catgrid_forms__engines__features__financial__accounts__FeatureConfigurations, optional)
- `code`: `cards_read` (Financial Cards Read)
  - `configurations` (catgrid_forms__engines__features__financial__cards__FeatureConfigurations, optional)
- `code`: `customer_information_read` (Customer Information Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration
- `code`: `deposits_read` (Financial Deposits Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration
- `code`: `direct_debits_read` (Direct Debits Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration
- `code`: `funds_read` (Investment Funds Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration
- `code`: `investment_accounts_read` (Investment Accounts Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration
- `code`: `loans_read` (Financial Loans Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration
- `code`: `pensions_read` (Pension Plans Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration
- `code`: `stocks_read` (Investment Stocks Read)
  - `configurations` (IFeatureConfigurations, optional) — This feature does not require any configuration

### ValidationError

- `loc` (list of ValidationErrorLocItems, required)
- `msg` (string, required)
- `type` (string, required)
- `input` (any, optional)
- `ctx` (ValidationErrorCtx, optional)

### catgrid_forms__engines__features__financial__accounts__FeatureConfigurations

- `from_date` (date, optional, default: 30 days ago) — The date from which the sub-product will be read
- `to_date` (date, optional, default: today) — The date until which the sub-product will be read
- `limits_behaviour` (enum, optional, default: error) — The behaviour when the date limits are not respected. - `error`: raise an error and abort the execution - `adapt`: adapt the dates to the limits and continue the execution
  - Allowed values: `error`, `adapt`
- `read_transactions` (boolean, optional, default: false) — If true, the engine will try to read the account transactions
- `read_holders` (boolean, optional, default: false) — If true, the engine will try to read the account holders

### catgrid_forms__engines__features__financial__cards__FeatureConfigurations

- `from_date` (date, optional, default: 30 days ago) — The date from which the sub-product will be read
- `to_date` (date, optional, default: today) — The date until which the sub-product will be read
- `limits_behaviour` (enum, optional, default: error) — The behaviour when the date limits are not respected. - `error`: raise an error and abort the execution - `adapt`: adapt the dates to the limits and continue the execution
  - Allowed values: `error`, `adapt`
- `read_transactions` (boolean, optional, default: false) — If true, the engine will try to read the card transactions
- `filter_by_type` (list of enum, optional, default: ["financial_card:credit","financial_card:mixed","financial_card:debit","financial_card:prepaid"]) — The types of cards to be read. By default all types are requested
  - Allowed values: `financial_card:debit`, `financial_card:credit`, `financial_card:prepaid`, `financial_card:mixed`

### IFeatureConfigurations

This feature does not require any configuration

### ValidationErrorLocItems

- string
- integer

### ValidationErrorCtx

## Examples

**Response**

```json
{
  "sandbox": true,
  "consent_level": "basic",
  "max_connections": 1,
  "tokenized_access": false,
  "engines_layout": "2-row-list",
  "priority_engines": [],
  "featured_engines": {},
  "executions_features": [
    {
      "code": "customer_information_read",
      "configurations": {}
    },
    {
      "code": "accounts_read",
      "configurations": {}
    },
    {
      "code": "cards_read",
      "configurations": {}
    },
    {
      "code": "deposits_read",
      "configurations": {}
    },
    {
      "code": "loans_read",
      "configurations": {}
    },
    {
      "code": "investment_accounts_read",
      "configurations": {}
    },
    {
      "code": "stocks_read",
      "configurations": {}
    },
    {
      "code": "funds_read",
      "configurations": {}
    },
    {
      "code": "pensions_read",
      "configurations": {}
    }
  ],
  "hooks_extra_data": {
    "case_id": "CASE-2026-0912-77"
  },
  "completion_mode": "redirect",
  "completion_extra_data": {},
  "markets": [
    "ES"
  ],
  "entity_types": [
    "retail"
  ],
  "completion_url": "https://clientapp.example.com/verification/done"
}
```

**SDK Code**

```python What the session actually runs with
import requests

url = "https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings"

headers = {"X-APP-SECRET": "<apiKey>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript What the session actually runs with
const url = 'https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings';
const options = {method: 'GET', headers: {'X-APP-SECRET': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go What the session actually runs with
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-APP-SECRET", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby What the session actually runs with
require 'uri'
require 'net/http'

url = URI("https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-APP-SECRET"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java What the session actually runs with
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings")
  .header("X-APP-SECRET", "<apiKey>")
  .asString();
```

```php What the session actually runs with
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings', [
  'headers' => [
    'X-APP-SECRET' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp What the session actually runs with
using RestSharp;

var client = new RestClient("https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings");
var request = new RestRequest(Method.GET);
request.AddHeader("X-APP-SECRET", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift What the session actually runs with
import Foundation

let headers = ["X-APP-SECRET": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://widgets.infonite.tech/api/flows/financial-rider/v1/manager/644599da47847b79c03cc94f/settings")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```