|

API

Create a client vaulting token

post/users/{fp_id}/client_token
External ID
Create a short-lived token safe to pass to your client for operations to vault or decrypt data for this user. See the client-side vaulting guide for how to use it.

Request

Path parameters

fp_id·

string

Body

decrypt_reason·

optional string

If the token is allowed to decrypt, provide a default decryption reason
fields·

optional array of strings

List of data identifiers to which this token will have access. For example, id.first_name, id.ssn4, custom.bank_account. Should not be specified when using the vault_card scope.

Allowed values:

id.first_nameid.middle_nameid.last_nameid.dobid.ssn4id.ssn9id.address_line1id.address_line2id.cityid.stateid.zipid.countryid.emailid.phone_numberid.us_legal_statusid.visa_kindid.visa_expiration_dateid.nationalityid.citizenshipsid.drivers_license_numberid.drivers_license_stateid.itinid.us_tax_id
custom.*
investor_profile.employment_statusinvestor_profile.occupationinvestor_profile.employerinvestor_profile.annual_incomeinvestor_profile.net_worthinvestor_profile.investment_goalsinvestor_profile.risk_toleranceinvestor_profile.declarationsinvestor_profile.brokerage_firm_employerinvestor_profile.senior_executive_symbolsinvestor_profile.family_member_namesinvestor_profile.political_organizationinvestor_profile.funding_sources
document.id_card.front.imagedocument.id_card.front.mime_typedocument.id_card.back.image
scope·

string

Specify the permissions of this token.

  • vault allows writing to the specified fields.
  • decrypt allows decrypting the specified fields.
  • vault_and_decrypt allows both.
  • decrypt_download allows decrypting a single piece of data as a file.
  • vault_card is a shorthand to generate a token to vault a card with a random alias.

Allowed values:

vault
decrypt
vault_and_decrypt
decrypt_download
vault_card
ttl·

optional integer

Time to live until this token expires, provided in seconds. Defaults to 30 minutes. Must be at least 60 seconds, at most 1 day

Response

expires_at·

string

The time at which the token expires
fields·

optional array of strings

The fields that this token has permissions to operate on, according to the requested scope.

Allowed values:

id.first_nameid.middle_nameid.last_nameid.dobid.ssn4id.ssn9id.address_line1id.address_line2id.cityid.stateid.zipid.countryid.emailid.phone_numberid.us_legal_statusid.visa_kindid.visa_expiration_dateid.nationalityid.citizenshipsid.drivers_license_numberid.drivers_license_stateid.itinid.us_tax_id
custom.*
investor_profile.employment_statusinvestor_profile.occupationinvestor_profile.employerinvestor_profile.annual_incomeinvestor_profile.net_worthinvestor_profile.investment_goalsinvestor_profile.risk_toleranceinvestor_profile.declarationsinvestor_profile.brokerage_firm_employerinvestor_profile.senior_executive_symbolsinvestor_profile.family_member_namesinvestor_profile.political_organizationinvestor_profile.funding_sources
document.id_card.front.imagedocument.id_card.front.mime_typedocument.id_card.back.image
token·

string

The short-lived token that gives temporary access to perform operations for this user
POST /users/{fp_id}/client_token
1curl -X POST https://api.onefootprint.com/users/{fp_id}/client_token \
2  -u sk_test_xxxxx: \
3  -d '{
4    "decrypt_reason": "Lorem ipsum dolor",
5    "fields": [
6      "id.first_name",
7      "id.middle_name"
8    ],
9    "scope": "vault",
10    "ttl": 300
11  }'
Response example
{
  "expires_at": "2022-01-04T12:00-07:00",
  "fields": [
    "id.first_name",
    "id.last_name"
  ],
  "token": "cttok_UxM6Vbvk2Rcy1gzcSuXgk3sj3L9I0pAnNH"
}