> ## Documentation Index > Fetch the complete documentation index at: https://tbd-6fc993ce-hypeship-split-proxy-pricing-row.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Perform an operation advertised by a vault item > Retrieve the item first and invoke only an operation listed in `available_operations`, following its natural-language description. Availability is rechecked at execution time; unavailable operations return 409. Authorization may call an external provider and returns the updated item. Link cards advertise authorize when eligible. AgentCard cards are created with PUT and request approval when their aliases are used at checkout; they do not expose authorize. If spend-request creation is rate limited, returns HTTP 429 with code `spend_request_rate_limited`; stop and back off before retrying. Fill returns a value-free execution result. Validation failures before writing return 400 (invalid request or targets), 403 (access or destination denied), 404 (resource not found), or 409 (item or browser not ready). Once writing starts, known partial failures and indeterminate field outcomes return 200 with status `failed` or `unknown`, not an automatic-retry signal. A transport error may leave the outcome unknown; do not automatically retry. ## OpenAPI ````yaml https://api.onkernel.com/spec.json post /vaults/{id_or_name}/items/{key}/operations openapi: 3.1.0 info: description: Developer tools and cloud infrastructure for AI agents to use web browsers title: Kernel API version: 0.1.0 servers: - description: API Server url: https://api.onkernel.com security: - bearerAuth: [] tags: - description: Create and manage browser sessions. name: Browsers - description: Control mouse, keyboard, and screen on the browser instance. name: Browser Computer Controls - description: Execute Playwright code against the browser instance. name: Browser Playwright - description: Discover and invoke native page tools across the browser instance. name: Browser WebMCP - description: Read, write, and manage files on the browser instance. name: Browser Filesystem - description: Execute and manage processes on the browser instance. name: Browser Processes - description: Record and manage browser session video replays. name: Browser Replays - description: Stream logs from the browser instance. name: Browser Logs - description: >- Stream live telemetry events from a browser session, and manage the destinations sessions export them to. name: Browser Telemetry - description: Create, list, retrieve, and delete browser profiles. name: Profiles - description: Create and manage proxy configurations for routing browser traffic. name: Proxies - description: Create, list, retrieve, and delete browser extensions. name: Extensions - description: Create and manage browser pools for acquiring and releasing browsers. name: Browser Pools - description: Inspect the identity and authorization context for the current request. name: Authentication - description: >- Create and manage auth connections for automated credential capture and login. name: Managed Auth - description: Create and manage credentials for authentication. name: Credentials - description: Configure external credential providers like 1Password. name: Credential Providers - description: List applications and versions. name: Apps - description: Create and manage app deployments and stream deployment events. name: Deployments - description: Invoke actions and stream or query invocation status and events. name: Invocations - description: Read and manage organization-level limits. name: Organization - description: | Create and manage projects for resource isolation within an organization. When projects are disabled for the organization, project operations return `404` with code `projects_disabled`. name: Projects - description: Create and manage API keys for organization and project-scoped access. name: API Keys - description: Read audit log records for the authenticated organization. name: Audit Logs - description: Resolve browser and proxy recommendations for bot-protected sites. name: Config Registry paths: /vaults/{id_or_name}/items/{key}/operations: post: tags: - Vaults summary: Perform an operation advertised by a vault item description: > Retrieve the item first and invoke only an operation listed in `available_operations`, following its natural-language description. Availability is rechecked at execution time; unavailable operations return 409. Authorization may call an external provider and returns the updated item. Link cards advertise authorize when eligible. AgentCard cards are created with PUT and request approval when their aliases are used at checkout; they do not expose authorize. If spend-request creation is rate limited, returns HTTP 429 with code `spend_request_rate_limited`; stop and back off before retrying. Fill returns a value-free execution result. Validation failures before writing return 400 (invalid request or targets), 403 (access or destination denied), 404 (resource not found), or 409 (item or browser not ready). Once writing starts, known partial failures and indeterminate field outcomes return 200 with status `failed` or `unknown`, not an automatic-retry signal. A transport error may leave the outcome unknown; do not automatically retry. operationId: postVaultItemOperation parameters: - in: path name: id_or_name required: true schema: type: string - in: path name: key required: true schema: type: string requestBody: content: application/json: examples: link_authorize: summary: Authorize a Link card that advertises this operation value: type: authorize schema: $ref: '#/components/schemas/VaultItemOperationRequest' required: true responses: '200': content: application/json: examples: link_authorize: $ref: '#/components/examples/ExampleLinkApproval' schema: $ref: '#/components/schemas/VaultItemOperationResponse' description: >- Authorization completed or resumed, or fill execution outcomes returned '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - bearerAuth: [] components: schemas: VaultItemOperationRequest: discriminator: mapping: authorize: $ref: '#/components/schemas/AuthorizeVaultItemOperationRequest' fill: $ref: '#/components/schemas/FillVaultItemOperationRequest' propertyName: type oneOf: - $ref: '#/components/schemas/AuthorizeVaultItemOperationRequest' - $ref: '#/components/schemas/FillVaultItemOperationRequest' VaultItemOperationResponse: description: >- Authorization returns the existing item shape. Fill returns a value-free execution result; it does not persist transient field outcomes on the item. oneOf: - $ref: '#/components/schemas/VaultItem' - $ref: '#/components/schemas/FillVaultItemOperationResult' AuthorizeVaultItemOperationRequest: additionalProperties: false properties: type: enum: - authorize type: string required: - type type: object FillVaultItemOperationRequest: additionalProperties: false description: > Fill selected fields from one ready, unexpired card into a browser linked to its vault. Only supported for card items created from Link wallets. Only invoke when the item advertises `fill`. Browser and vault must belong to the same project. Kernel checks access and allowed destinations before filling; providing a page URL does not authorize a destination. Find exactly one open page matching `page_url`. For each selector, search the main frame and all descendant frames for editable inputs or selects matched directly or contained within matching elements. Each selector must resolve to one unique editable element across all frames; zero or multiple candidates fail. Count each element once, even if multiple matching containers contain it. Validate all bindings before filling. Select elements match an option by its value, not its label. If the page navigates or a target disappears during filling, stop rather than selecting a different page or element. Fill in request order and stop on the first failure. This operation is not atomic: previously filled fields are not rolled back. Never submit the form or click buttons, though input/change events may trigger site behavior. Fill is the preferred browser-checkout path. Aliases remain an alternative for explicitly chosen egress-substitution integrations. Do not automatically retry or fall back to aliases after a failed or indeterminate operation. Secret values are never returned or included in operation logs, traces, audit events, or error details. This does not prevent an agent with unrestricted browser access from reading values from the page or other browser observation surfaces. example: browser_id: browser-session-id fields: - field: number selector: '#card-number' - field: exp_month selector: '#expiry-month' - field: exp_year selector: '#expiry-year' - field: cvc selector: '#security-code' page_url: https://shop.example/checkout type: fill properties: browser_id: description: Browser session ID, not a reusable browser name. minLength: 1 type: string fields: description: >- Field bindings for this step. No two bindings may resolve to the same element. items: $ref: '#/components/schemas/VaultCardFillField' maxItems: 32 minItems: 1 type: array page_url: description: >- Exact current top-level page URL, including path, query, and fragment. Must match exactly one open page in the browser; zero or multiple matches fail. No prefix or glob matching. Must use HTTPS without embedded credentials. format: uri pattern: ^https://[^/?#@*\s]+(?:[/?#][^\s]*)?$ type: string timeout_ms: default: 10000 description: Total operation deadline in milliseconds, not a per-field timeout. maximum: 30000 minimum: 1 type: integer type: enum: - fill type: string required: - type - browser_id - page_url - fields type: object VaultItem: discriminator: mapping: card: $ref: '#/components/schemas/CardVaultItem' wallet: $ref: '#/components/schemas/WalletVaultItem' propertyName: type oneOf: - $ref: '#/components/schemas/WalletVaultItem' - $ref: '#/components/schemas/CardVaultItem' FillVaultItemOperationResult: additionalProperties: false properties: fields: description: >- Exactly one result per request binding, in request order. After the first failed or unknown field, all remaining fields are not_attempted. items: $ref: '#/components/schemas/VaultFillFieldResult' maxItems: 32 minItems: 1 type: array status: description: >- Completed only when all fields were filled. Failed when execution stopped with known outcomes. Unknown when any field's outcome cannot be determined. None of these statuses confirms payment or merchant acceptance. enum: - completed - failed - unknown type: string type: enum: - fill type: string required: - type - status - fields type: object Error: properties: code: description: Application-specific error code (machine-readable) example: bad_request type: string details: description: Additional error details (for multiple errors) items: $ref: '#/components/schemas/ErrorDetail' type: array inner_error: $ref: '#/components/schemas/ErrorDetail' message: description: Human-readable error description for debugging example: 'Missing required field: app_name' type: string required: - code - message type: object VaultCardFillField: oneOf: - $ref: '#/components/schemas/VaultCardStoredFillField' - $ref: '#/components/schemas/VaultCardExpirationFillField' CardVaultItem: additionalProperties: false properties: action: $ref: '#/components/schemas/VaultItemAction' available_expansions: items: $ref: '#/components/schemas/AvailableVaultItemExpansion' type: array available_operations: items: $ref: '#/components/schemas/AvailableVaultItemOperation' type: array created_at: format: date-time type: string expires_at: format: date-time type: string id: type: string key: description: Immutable item key assigned when the item is created. type: string spec: $ref: '#/components/schemas/CardVaultItemSpec' state: $ref: '#/components/schemas/CardVaultItemState' type: enum: - card type: string updated_at: format: date-time type: string required: - id - key - type - spec - state - available_operations - available_expansions - created_at - updated_at type: object WalletVaultItem: additionalProperties: false properties: action: $ref: '#/components/schemas/VaultItemAction' available_expansions: items: $ref: '#/components/schemas/AvailableVaultItemExpansion' type: array available_operations: items: $ref: '#/components/schemas/AvailableVaultItemOperation' type: array created_at: format: date-time type: string expanded: $ref: '#/components/schemas/VaultItemExpanded' expires_at: format: date-time type: string id: type: string key: description: Immutable item key assigned when the item is created. type: string spec: $ref: '#/components/schemas/WalletVaultItemSpec' state: $ref: '#/components/schemas/WalletVaultItemState' type: enum: - wallet type: string updated_at: format: date-time type: string required: - id - key - type - spec - state - available_operations - available_expansions - created_at - updated_at type: object VaultFillFieldResult: additionalProperties: false properties: error_code: description: >- Present only for failed or unknown fields. Never includes secret values, DOM content, or raw browser errors. enum: - target_changed - element_not_found - ambiguous_selector - element_not_editable - option_not_found - timeout - execution_failed type: string index: description: Zero-based index into the request fields array. maximum: 31 minimum: 0 type: integer status: description: >- Filled means the fill action completed, not that the website retained or accepted the value. enum: - filled - failed - not_attempted - unknown type: string required: - index - status type: object ErrorDetail: properties: code: description: Lower-level error code providing more specific detail example: invalid_input type: string message: description: Further detail about the error example: Provided version string is not semver compliant type: string type: object VaultCardStoredFillField: additionalProperties: false properties: field: description: >- Field in the decrypted card, not an alias. Number and CVC preserve leading zeros; month uses two digits and year uses four digits. Billing fields use the provider's stored billing address (name, line1, line2, city, state, postal_code, country) without reformatting. Request only needed billing fields. An absent or empty requested billing field returns 400 field_unavailable before any browser writes; it does not make other card fields unavailable. enum: - number - exp_month - exp_year - cvc - billing_name - billing_line1 - billing_line2 - billing_city - billing_state - billing_postal_code - billing_country type: string selector: description: >- CSS selector for an editable input or select, or a containing element. Must resolve to one unique editable element across all page frames. minLength: 1 type: string required: - field - selector type: object VaultCardExpirationFillField: additionalProperties: false description: >- Combined expiration derived from the stored month and year; not a separate stored secret. example: field: expiration format: MM/YY selector: '#expiry' properties: field: enum: - expiration type: string format: enum: - MM/YY - MM/YYYY type: string selector: description: >- CSS selector for an editable input or select, or a containing element. Must resolve to one unique editable element across all page frames. minLength: 1 type: string required: - field - format - selector type: object VaultItemAction: discriminator: mapping: card_enrollment: $ref: '#/components/schemas/CardEnrollmentAction' collect: $ref: '#/components/schemas/CollectAction' embedded_ceremony: $ref: '#/components/schemas/EmbeddedCeremonyAction' link_oauth: $ref: '#/components/schemas/LinkOAuthAction' mfa: $ref: '#/components/schemas/MfaAction' push_approval: $ref: '#/components/schemas/PushApprovalAction' spend_approval: $ref: '#/components/schemas/SpendApprovalAction' propertyName: name oneOf: - $ref: '#/components/schemas/LinkOAuthAction' - $ref: '#/components/schemas/SpendApprovalAction' - $ref: '#/components/schemas/PushApprovalAction' - $ref: '#/components/schemas/CollectAction' - $ref: '#/components/schemas/MfaAction' - $ref: '#/components/schemas/EmbeddedCeremonyAction' - $ref: '#/components/schemas/CardEnrollmentAction' AvailableVaultItemExpansion: additionalProperties: false description: >- Live data that can currently be requested by passing its type to the item GET expand parameter. properties: description: type: string type: $ref: '#/components/schemas/VaultItemExpansionType' required: - type - description type: object AvailableVaultItemOperation: additionalProperties: false description: >- An operation that is currently valid for this item. Read the description before invoking it through the item operations endpoint. properties: description: type: string type: $ref: '#/components/schemas/VaultItemOperationType' required: - type - description type: object CardVaultItemSpec: discriminator: mapping: agentcard: $ref: '#/components/schemas/AgentCardCardVaultItemSpec' link: $ref: '#/components/schemas/LinkCardVaultItemSpec' propertyName: provider oneOf: - $ref: '#/components/schemas/LinkCardVaultItemSpec' - $ref: '#/components/schemas/AgentCardCardVaultItemSpec' CardVaultItemState: discriminator: mapping: agentcard: $ref: '#/components/schemas/AgentCardCardState' link: $ref: '#/components/schemas/LinkCardState' propertyName: provider oneOf: - $ref: '#/components/schemas/LinkCardState' - $ref: '#/components/schemas/AgentCardCardState' VaultItemExpanded: additionalProperties: false description: >- Live, non-persisted data requested through the item GET expand parameter. properties: payment_methods: items: $ref: '#/components/schemas/VaultPaymentMethod' type: array type: object WalletVaultItemSpec: discriminator: mapping: agentcard: $ref: '#/components/schemas/AgentCardWalletVaultItemSpec' link: $ref: '#/components/schemas/LinkWalletVaultItemSpec' propertyName: provider oneOf: - $ref: '#/components/schemas/LinkWalletVaultItemSpec' - $ref: '#/components/schemas/AgentCardWalletVaultItemSpec' WalletVaultItemState: discriminator: mapping: agentcard: $ref: '#/components/schemas/AgentCardWalletState' link: $ref: '#/components/schemas/LinkWalletState' propertyName: provider oneOf: - $ref: '#/components/schemas/LinkWalletState' - $ref: '#/components/schemas/AgentCardWalletState' CardEnrollmentAction: additionalProperties: false properties: name: enum: - card_enrollment type: string url: format: uri type: string required: - name - url type: object CollectAction: additionalProperties: false properties: name: enum: - collect type: string required: - name type: object EmbeddedCeremonyAction: additionalProperties: false properties: name: enum: - embedded_ceremony type: string required: - name type: object LinkOAuthAction: additionalProperties: false properties: name: enum: - link_oauth type: string url: format: uri type: string required: - name - url type: object MfaAction: additionalProperties: false properties: name: enum: - mfa type: string required: - name type: object PushApprovalAction: additionalProperties: false properties: name: enum: - push_approval type: string required: - name type: object SpendApprovalAction: additionalProperties: false properties: name: enum: - spend_approval type: string url: format: uri type: string required: - name - url type: object VaultItemExpansionType: enum: - payment_methods type: string VaultItemOperationType: enum: - authorize - fill type: string AgentCardCardVaultItemSpec: additionalProperties: false description: >- AgentCard reusable live payment card. Test-mode card creation is not supported. Each checkout creates an approval-gated authorization for spec.merchant / spec.amount. The card stays ready after each authorization. properties: amount: description: Integer amount in minor currency units. format: int64 maximum: 9007199254740991 minimum: 1 type: integer card_id: description: >- AgentCard vaulted card to pay with. Omitted, the cardholder picks on the approval screen. pattern: ^vc_[A-Za-z0-9_]+$ type: string currency: maxLength: 3 minLength: 3 pattern: ^[A-Za-z]{3}$ type: string merchant: description: Merchant name shown on the cardholder's approval screen. maxLength: 120 minLength: 1 type: string provider: enum: - agentcard type: string wallet: description: Wallet item key used to authorize checkouts. type: string required: - provider - wallet - merchant - amount - currency type: object LinkCardVaultItemSpec: additionalProperties: false description: Live payment card. Test-mode card creation is not supported. properties: amount: description: Integer amount in minor currency units. maximum: 500000 minimum: 1 type: integer context: minLength: 100 type: string currency: maxLength: 3 minLength: 3 pattern: ^[A-Za-z]{3}$ type: string expires_at: format: int64 type: integer line_items: items: $ref: '#/components/schemas/LinkLineItem' type: array merchant_name: maxLength: 255 minLength: 1 type: string merchant_url: format: uri type: string metadata: additionalProperties: type: string type: object payment_method_id: description: >- Payment-method ID returned by the referenced wallet's payment-method listing. The provider decides whether the selected funding method can satisfy the card request. minLength: 1 type: string provider: enum: - link type: string totals: items: $ref: '#/components/schemas/LinkTotal' type: array wallet: description: Wallet item key used to mint this card. type: string required: - provider - wallet - payment_method_id - amount - currency - merchant_name - merchant_url - context type: object AgentCardCardState: additionalProperties: false properties: aliases: $ref: '#/components/schemas/VaultCardAliases' authorization: $ref: '#/components/schemas/AgentCardCheckoutAuthorization' masks: $ref: '#/components/schemas/VaultItemMasks' provider: enum: - agentcard type: string status: description: >- recovery_required means the original checkout outcome is unresolved. Automatic reuse is blocked. Known authorization IDs must be reconciled through provider observations or support. When no authorization ID was returned, an explicitly confirmed item deletion may abandon the unresolved attempt so the caller can create a replacement; deletion does not prove that the original attempt failed. It does not mean declined or expired. enum: - requested - ready - pending_approval - degraded - recovery_required type: string status_reason: type: string required: - provider - status type: object LinkCardState: additionalProperties: false properties: aliases: $ref: '#/components/schemas/VaultCardAliases' domains: items: type: string type: array masks: $ref: '#/components/schemas/VaultItemMasks' provider: enum: - link type: string status: description: >- recovery_required means an original provider operation has an unresolved outcome. Do not retry, delete, or replace it. Known references may be observed safely, but unknown creation without an ID and uncertain card-material retrieval require manual reconciliation with the provider or support. There is no reset or caller-asserted reconciliation operation. enum: - requested - pending_authorization - ready - consumed - expired - declined - recovery_required type: string status_reason: type: string required: - provider - status type: object VaultPaymentMethod: additionalProperties: false properties: capabilities: $ref: '#/components/schemas/VaultPaymentMethodCapabilities' display: $ref: '#/components/schemas/VaultPaymentMethodDisplay' id: type: string is_default: type: boolean provider: description: Provider that issued this payment-method ID. type: string type: description: Provider-neutral payment-method type normalized to lowercase. type: string required: - id - provider - type - is_default - display - capabilities type: object AgentCardWalletVaultItemSpec: additionalProperties: false description: >- AgentCard wallet. Omit provider_config to use Kernel-managed credentials, or select a customer-owned configuration. Mode (sandbox vs live) is determined by the selected credential; there is no per-item test flag. Without user_id, creation returns a hosted enrollment action and Kernel polls until the user connects. user_id may only reference a user already enrolled by a wallet in this organization under the same configuration. properties: provider: enum: - agentcard type: string provider_config: $ref: '#/components/schemas/VaultProviderConfigReference' description: >- Select an AgentCard configuration. The wallet's configuration cannot be changed after creation. user_id: pattern: ^usr_[A-Za-z0-9_]+$ type: string required: - provider type: object LinkWalletVaultItemSpec: additionalProperties: false properties: authorization: $ref: '#/components/schemas/LinkOAuthAuthorization' provider: enum: - link type: string required: - provider - authorization type: object AgentCardWalletState: additionalProperties: false properties: provider: enum: - agentcard type: string status: enum: - pending_authorization - connected - degraded type: string status_reason: type: string user_id: description: AgentCard user id linked to this wallet. Present once connected. type: string required: - provider - status type: object LinkWalletState: additionalProperties: false properties: provider: enum: - link type: string status: enum: - pending_authorization - connected - declined - reconnect_required - degraded type: string status_reason: type: string required: - provider - status type: object LinkLineItem: additionalProperties: false properties: description: type: string image_url: type: string name: type: string product_url: type: string quantity: minimum: 1 type: integer sku: type: string totals: items: $ref: '#/components/schemas/LinkTotal' type: array unit_amount: description: Unit amount in minor currency units. type: integer url: type: string required: - name type: object LinkTotal: additionalProperties: false properties: amount: description: Total amount in minor currency units. type: integer display_text: type: string type: type: string required: - type - display_text - amount type: object VaultCardAliases: additionalProperties: false properties: cvc: pattern: ^\d{3}$ type: string exp_month: pattern: ^\d{2}$ type: string exp_year: pattern: ^\d{4}$ type: string number: pattern: ^\d{16}$ type: string readOnly: true required: - number - cvc - exp_month - exp_year type: object AgentCardCheckoutAuthorization: additionalProperties: false description: >- The in-flight or most recent checkout authorization. Present while a checkout is pending approval and after it settles. properties: actual_cents: format: int64 type: integer amount: description: Display amount shown on the approval screen. type: string amount_authority: enum: - display_only - stripe_payment_intent type: string amount_cents: format: int64 type: integer amount_verified: type: boolean approval_url: format: uri type: string browser_id: description: Browser session that submitted the checkout. type: string charged_amount_cents: format: int64 type: integer charged_currency: type: string charged_kind: enum: - captured - authorized - none type: string created_at: format: date-time type: string currency: type: string expected_cents: format: int64 type: integer expires_at: format: date-time type: string id: type: string merchant: type: string psp: type: string psp_error_code: type: string reason: type: string replay_attempted: type: boolean replay_delivered: description: Whether the processor response was delivered to the browser. type: boolean replay_status: description: HTTP status of the replayed processor response. type: integer status: enum: - awaiting_approval - approved - declined - expired type: string required: - id - status - psp - merchant - amount_cents - currency - created_at type: object VaultItemMasks: additionalProperties: type: string properties: brand: type: string last4: maxLength: 4 minLength: 4 type: string type: object VaultPaymentMethodCapabilities: additionalProperties: false description: >- Provider-reported advisory capabilities. A missing capability is unknown, not ineligible; only eligible=false is an explicit negative signal. properties: single_use_card: $ref: '#/components/schemas/VaultPaymentMethodCapability' type: object VaultPaymentMethodDisplay: additionalProperties: false properties: brand: type: string label: type: string last4: type: string type: object VaultProviderConfigReference: additionalProperties: false description: >- Select a provider config by ID or name. Responses return the ID. Renaming a config does not change existing wallet bindings; a wallet cannot switch to a different config after creation. oneOf: - required: - id - required: - name properties: id: minLength: 1 type: string name: pattern: ^[a-zA-Z0-9._-]{1,255}$ type: string type: object LinkOAuthAuthorization: additionalProperties: false properties: client: $ref: '#/components/schemas/LinkOAuthClient' method: enum: - oauth type: string required: - method - client type: object VaultPaymentMethodCapability: additionalProperties: false properties: eligible: type: boolean reasons: items: type: string type: array required: - eligible - reasons type: object LinkOAuthClient: discriminator: mapping: customer_managed: $ref: '#/components/schemas/CustomerManagedOAuthClient' kernel_managed: $ref: '#/components/schemas/KernelManagedOAuthClient' propertyName: type oneOf: - $ref: '#/components/schemas/KernelManagedOAuthClient' - $ref: '#/components/schemas/CustomerManagedOAuthClient' CustomerManagedOAuthClient: additionalProperties: false properties: provider_config: $ref: '#/components/schemas/VaultProviderConfigReference' type: enum: - customer_managed type: string required: - type - provider_config type: object KernelManagedOAuthClient: additionalProperties: false properties: type: enum: - kernel_managed type: string required: - type type: object examples: ExampleLinkApproval: summary: >- Link authorization creates or resumes a spend awaiting cardholder approval value: action: name: spend_approval url: https://example.com/spend-approval available_expansions: [] available_operations: - description: >- Resume this existing spend request without creating another payment. type: authorize created_at: '2026-01-01T12:00:00Z' expires_at: '2026-01-01T13:00:00Z' id: card_link_example key: link-card spec: amount: 2599 context: >- Purchase one notebook for USD 25.99 including shipping and taxes. This is a new order at Example Store, not a retry of an earlier payment. currency: usd merchant_name: Example Store merchant_url: https://store.example.com payment_method_id: pm_example provider: link wallet: link-wallet state: domains: - store.example.com provider: link status: pending_authorization type: card updated_at: '2026-01-01T12:01:00Z' responses: BadRequest: content: application/json: schema: $ref: '#/components/schemas/Error' description: Bad Request – invalid input Unauthorized: content: application/json: schema: $ref: '#/components/schemas/Error' description: Unauthorized – missing or invalid authorization token Forbidden: content: application/json: schema: $ref: '#/components/schemas/Error' description: Forbidden – insufficient permissions or plan NotFound: content: application/json: schema: $ref: '#/components/schemas/Error' description: Resource not found Conflict: content: application/json: schema: $ref: '#/components/schemas/Error' description: Conflict – resource already exists TooManyRequests: content: application/json: schema: $ref: '#/components/schemas/Error' description: Too Many Requests – rate limit exceeded headers: Retry-After: description: Seconds to wait before retrying schema: type: integer InternalError: content: application/json: schema: $ref: '#/components/schemas/Error' description: Internal Server Error securitySchemes: bearerAuth: scheme: bearer type: http ````