---
search:
  tags:
    - End users
    - POST
seo:
  description: >-
    Your server confirms that the consent which came back to… Reference for the
    POST /api/v2/end-users/{endUserId}/connections/confirm endpoint in the
    Anlyon API.
sidebar:
  label: Confirm a connection
  badge: POST
title: Confirm a connection
type: openapi-operation
---
Your server confirms that the consent which came back to your redirect with `anlyon_flow` belongs to the end user signed in to your app. This is the defence against cross-app account takeover: anyone holding a link can finish its consent, so the grant stays unusable until you confirm it for the end user the link was created for. Confirmed for anyone else, it is refused with `403 END_USER_MISMATCH`, revoked at the provider and deleted. Single use; a flow nobody confirms is deleted after 10 minutes. A replayed, expired or unknown flow answers `404 CONNECT_FLOW_NOT_FOUND`. The confirmed account replaces the end user's previous one for the integration.

`POST /api/v2/end-users/{endUserId}/connections/confirm`