---
title: "Cancel a Flinks Connect session abandoned by the customer in the iframe"
method: POST
path: "/api/v1/embedded/flinks-session/{sessionId}/cancel"
tags: ["Embedded"]
---

# Cancel a Flinks Connect session abandoned by the customer in the iframe

`POST /api/v1/embedded/flinks-session/{sessionId}/cancel`

Cancel a Flinks Connect session abandoned by the customer in the iframe

## Request body

- EmbeddedFlinksSessionCancelInput
  - `payment_token` string, required — Payment token authenticating the cancel request against its PaymentRequest.
  - `reason` union, required — Why the customer abandoned the Flinks Connect iframe. Used for audit only — the customer-facing outcome is the same for all reasons.
    - 'user_closed'
    - 'session_expired'
    - 'retry_exhausted'
    - 'denied_consent'
    - 'institution_unavailable'
    - 'token_invalid'

## Response `200`

Success

- EmbeddedFlinksSessionCancelResponse
  - `success` boolean, required — Indicates if the request was successful
  - `data` object, required
    - `status` 'cancelled', required
    - `payment_request_id` string, uuid, required — Internal PaymentRequest id. The frontend uses this to navigate to /api/v1/callback for fail-url redirect.
    - `cancel_token` string, required — Short-lived (≤5 min) signed proof that this cancel originated server-side. The frontend appends it to the subsequent /api/v1/callback?cancel_from_bank_selection=true URL; /callback rejects URLs without a valid matching token. Prevents arbitrary callers from cancelling a pending PR by guessing payment_request_id.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `404` — Not Found
- `409` — Response

---

[API](https://skmtc.net/banqzinc/apis/quidkey-api.md) · [All operations](https://skmtc.net/banqzinc/apis/quidkey-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/banqzinc/quidkey-api/versions/f86d2bdbcb08/schema)