> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fintoc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange a link

> Exchanges the `exchange_token` obtained through the widget for the resulting link. This is the only response that includes the link's `link_token`, needed to fetch the link's resources; store the `link_token` securely. The exchange token expires at the link intent's `exchange_token_expires_at`.

**`v1`** · Base URL `https://api.fintoc.com/v1`


## OpenAPI

````yaml reference/fintoc-api.json GET /links/exchange
openapi: 3.1.0
info:
  title: fintoc-api
  version: v2026-02-01
servers:
  - url: https://api.fintoc.com/v1
security: []
paths:
  /links/exchange:
    get:
      tags:
        - Links
      summary: Exchange a link
      description: >-
        Exchanges the `exchange_token` obtained through the widget for the
        resulting link. This is the only response that includes the link's
        `link_token`, needed to fetch the link's resources; store the
        `link_token` securely. The exchange token expires at the link intent's
        `exchange_token_expires_at`.
      operationId: links-exchange
      parameters:
        - name: exchange_token
          in: query
          required: true
          schema:
            type: string
            example: li_a6WUojQ2SjSSeFjH_exc_Q802GD8ZLmMu
          description: >-
            The `exchange_token` of a succeeded link intent, obtained through
            the widget.
      responses:
        '200':
          description: >-
            The link, including its `accounts`. The `link_token` is only
            returned in this response.
          content:
            application/json:
              examples:
                link_exchanged:
                  value:
                    id: link_nMNejK7BT8oGbvO4
                    object: link
                    accounts:
                      - id: acc_nMNejK7BT8oGbvO4
                        object: account
                        balance:
                          available: 500000
                          current: 500000
                          limit: 500000
                        currency: CLP
                        holder_id: '111111111'
                        holder_name: Jon Snow
                        name: Cuenta Corriente
                        next_refresh: '2023-04-06T13:30:00.000Z'
                        number: '9530516286'
                        official_name: Cuenta Corriente Moneda Local
                        refresh_status: starting
                        refreshed_at: null
                        removed_from_link: false
                        type: checking_account
                    active: true
                    created_at: '2022-11-28T15:00:00.000Z'
                    holder_id: '111111111'
                    holder_type: individual
                    institution:
                      id: cl_banco_de_chile
                      country: cl
                      name: Banco de Chile
                    last_time_refreshed: null
                    link_token: link_nMNejK7BT8oGbvO4_token_sjnNsMyXKJEXAMPLETOKENrnNL1tA8
                    mode: live
                    refresh_status: idle
                    status: active
                    username: '111111111'
              schema:
                $ref: '#/components/schemas/link'
        '400':
          description: >-
            Invalid request: the `exchange_token` is missing or empty, or the
            API key mode does not match the link intent mode.
          content:
            application/json:
              examples:
                invalid_api_key_mode:
                  value:
                    error:
                      type: invalid_request_error
                      code: invalid_api_key_mode
                      param: exchange_token
                      message: The API key mode does not match the link intent mode.
                      doc_url: https://docs.fintoc.com/reference/errors
              schema:
                $ref: '#/components/schemas/error_object'
        '401':
          description: Invalid or missing API key.
          content:
            application/json:
              examples:
                invalid_api_key:
                  value:
                    error:
                      type: authentication_error
                      code: invalid_api_key
                      message: 'Invalid API Key: invalid-*oken'
              schema:
                $ref: '#/components/schemas/error_object'
        '403':
          description: >-
            The `exchange_token` is invalid, expired, or belongs to another
            organization.
          content:
            application/json:
              examples:
                expired_exchange_token:
                  value:
                    error:
                      type: invalid_request_error
                      code: expired_exchange_token
                      param: exchange_token
                      message: >-
                        The exchange token has expired. You need to create a new
                        link intent.
                      doc_url: https://docs.fintoc.com/reference/errors
              schema:
                $ref: '#/components/schemas/error_object'
      security:
        - api_key: []
components:
  schemas:
    link:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the link.
          example: link_nMNejK7BT8oGbvO4
        object:
          const: link
          description: Type of the object. Always `link`.
        accounts:
          type:
            - array
            - 'null'
          description: >-
            Bank accounts of the link. Included when retrieving or exchanging a
            single link; `null` when listing or updating links.
          items:
            $ref: '#/components/schemas/account'
        active:
          type: boolean
          description: >-
            Whether the link is active. Fintoc does not refresh inactive links.
            Deactivating a link stops refreshes but does not revoke the
            `link_token`'s access to already-collected data.
          example: true
        created_at:
          type: string
          format: date-time
          description: ISO 8601 timestamp of when the link was created.
          example: '2020-04-22T21:10:19.254Z'
        holder_id:
          type: string
          description: >-
            Tax identifier of the account holder, without dots or hyphens (RUT
            in Chile, RFC in Mexico).
          example: '111111111'
        holder_type:
          $ref: '#/components/schemas/holder_type'
        institution:
          $ref: '#/components/schemas/institution'
        last_time_refreshed:
          type:
            - string
            - 'null'
          format: date-time
          description: >-
            ISO 8601 timestamp of the link's last refresh. `null` if Fintoc has
            never refreshed the link.
          example: '2020-11-18T18:43:54.591Z'
        link_token:
          type:
            - string
            - 'null'
          description: >-
            Token used to authenticate requests for the link's resources. Only
            returned when the link is exchanged; `null` in every other response.
          example: link_nMNejK7BT8oGbvO4_token_sjnNsMyXKJEXAMPLETOKENrnNL1tA8
        mode:
          $ref: '#/components/schemas/mode'
        refresh_status:
          type:
            - string
            - 'null'
          enum:
            - idle
            - refreshing
            - interrupted
            - partially_refreshing
            - null
          description: >-
            Refresh status of the link's accounts. `idle` means no refresh is in
            progress, `refreshing` means every account is refreshing,
            `partially_refreshing` means only some accounts are refreshing, and
            `interrupted` means no account is currently refreshing.
          example: idle
        status:
          type: string
          enum:
            - active
            - inactive
            - login_required
          description: >-
            Status of the link. `login_required` means the institution rejected
            the stored credentials and you must reconnect the link.
          example: active
        subscription_id:
          type: string
          description: >-
            Identifier of the subscription associated to the link. Only present
            when the link is returned from a subscription exchange.
          example: sub_nMNejK7BT8oGbvO4
        username:
          type: string
          description: Username used to log in at the institution, without dots or hyphens.
          example: '111111111'
      required:
        - id
        - object
        - accounts
        - active
        - created_at
        - holder_id
        - holder_type
        - institution
        - last_time_refreshed
        - link_token
        - mode
        - refresh_status
        - status
        - username
    error_object:
      type: object
      properties:
        error:
          type: object
          description: Details of the error that caused the request to fail.
          properties:
            code:
              type: string
              description: >-
                Machine-readable code identifying the specific error, for
                example `invalid_api_key`. Not returned by every error.
              example: invalid_api_key
            doc_url:
              type: string
              description: >-
                URL of a documentation page with more details about the error.
                Not returned by every error.
              example: https://docs.fintoc.com/reference/errors
            message:
              type: string
              description: Human-readable message describing the error.
              example: 'Invalid API Key: invalid-*oken'
            param:
              type:
                - string
                - 'null'
              description: >-
                Name of the request parameter that caused the error. `null` when
                the error cannot be tied to a single parameter, and not returned
                by every error.
              example: amount
            type:
              type: string
              description: >-
                Category of the error, for example `invalid_request_error`,
                `authentication_error`, or `api_error`.
              example: invalid_request_error
          required:
            - type
            - message
    account:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the account.
          example: acc_nMNejK7BT8oGbvO4
        object:
          const: account
          description: Type of the object. Always `account`.
        balance:
          $ref: '#/components/schemas/balance'
        currency:
          type: string
          pattern: ^[A-Z]{3}$
          description: Three-letter ISO 4217 currency code of the account.
          example: CLP
        holder_id:
          type: string
          description: >-
            Tax identifier of the account holder, without dots or hyphens (RUT
            in Chile, RFC in Mexico).
          example: '111111111'
        holder_name:
          type: string
          description: Name of the account holder, as registered at the institution.
          example: Jon Snow
        name:
          type: string
          description: Name of the account.
          example: Cuenta Corriente
        next_refresh:
          type:
            - string
            - 'null'
          format: date-time
          description: >-
            ISO 8601 timestamp of the next scheduled refresh of the account.
            Only present when the link has the `movements` product.
          example: '2023-04-06T13:30:00.000Z'
        number:
          type: string
          description: Number of the account, as registered at the institution.
          example: '9530516286'
        official_name:
          type: string
          description: Commercial name of the account type, as defined by the institution.
          example: Cuenta Corriente Moneda Local
        refresh_status:
          type: string
          enum:
            - refreshing
            - interrupted
            - starting
          description: >-
            Refresh status of the account. `starting` means the account was just
            connected and has not been refreshed yet, `refreshing` means a
            refresh is in progress, and `interrupted` means the account is not
            currently being refreshed. Only present when the link has the
            `movements` product.
          example: refreshing
        refreshed_at:
          type:
            - string
            - 'null'
          format: date-time
          description: >-
            ISO 8601 timestamp of the account's last refresh. `null` if Fintoc
            has never refreshed the account.
          example: '2020-11-18T18:43:54.591Z'
        removed_from_link:
          type: boolean
          description: >-
            Whether the account no longer belongs to the link (for example,
            because the institution stopped returning the account). Only present
            when the link has the `movements` product.
          example: false
        type:
          $ref: '#/components/schemas/account_type'
      required:
        - id
        - object
        - name
        - number
        - official_name
        - holder_id
        - holder_name
        - type
        - currency
        - balance
        - refreshed_at
    holder_type:
      type: string
      enum:
        - individual
        - business
      description: Whether the account holder is an individual or a business.
      example: individual
    institution:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the institution.
          example: cl_banco_de_chile
        country:
          type: string
          description: ISO 3166-1 alpha-2 code of the country of the institution.
          example: cl
        name:
          type: string
          description: Name of the institution.
          example: Banco de Chile
      required:
        - id
        - country
        - name
    mode:
      type: string
      enum:
        - test
        - live
      description: >-
        Mode of the object. `live` objects use real institution data, `test`
        objects use fake data for integration testing.
      example: live
    balance:
      type: object
      description: >-
        Balance of the account, as reported by the institution. All amounts are
        in the smallest unit of the account's currency (CLP has no decimals, so
        amounts are in pesos).
      properties:
        available:
          type: integer
          description: Amount available to spend, including overdraft lines if any.
          example: 500000
        current:
          type: integer
          description: >-
            Amount of money owned by the account holder, without overdraft
            lines.
          example: 500000
        limit:
          type: integer
          description: Maximum amount available to spend, including credit lines.
          example: 500000
      required:
        - available
        - current
        - limit
    account_type:
      type: string
      enum:
        - checking_account
        - savings_account
        - sight_account
        - line_of_credit
        - credit_card
      description: Type of the account. Fintoc exposes RUT accounts as `sight_account`.
      example: checking_account
  securitySchemes:
    api_key:
      type: apiKey
      name: Authorization
      in: header

````