Sign in

v1

latestOpenAPI 3.0.02026-08-062903562.2 MB
MagicLink

Create an async, mint-only batch of scoped magic links (internal).

Create a new magic-link batch (async, mint-only).

Dispatches synchronously so the controller can return the batch_id and acceptance summary immediately (202 Accepted); the actual link-minting is handled by the async orchestrator dispatched inside CreateMagicLinkBatch.

App-token-only: privateEndpoint blocks external apps, and assertAppTokenOnly() additionally rejects internal tokens that carry member context. A batch can span multiple orgs and is triggered service-to-service (the Admin bulk-generate flow) — there is no single member to act on behalf of, and no per-member resource to authorize against. Confirmed with the consuming squad (Admin): calls carry an app token, never a member-scoped token. If member-scoped access is ever added, re-check per-row authorization in MintScopedMagicLinkJob (security-patterns.md, IDOR + authorize-on-mutation rules).

post/scoped-magic-link/batch

Request body

action_scopestring required
idempotency_keystring required

Example request

{
  "action_scope": "recurring_plan_edit",
  "idempotency_key": "admin-batch-2026-07-08-abc123",
  "requests": [
    {
      "organization_id": "29720",
      "recurring_donation_plan_id": "137583"
    }
  ]
}

Response

Batch accepted; minting proceeds asynchronously. Poll the Location header (GET status) for progress.

batch_idstring required
totalinteger required
acceptedinteger required
rejectedobject[] required

Example response

{
  "batch_id": "4471",
  "total": 3,
  "accepted": 2
}