Skip to main content
Bank consent has to happen on a hosted page (CDR). The API mints a link session and you send the user to its url; they sign in to Redbark with the same account the key belongs to, finish the bank’s consent, and land on your return_url with ?link_session=completed (or failed&reason=…).
institution (Fiskil only) must be an id from GET /v2/institutions. Poll GET /v2/link_sessions/{id} until status is completed (then connection is set) or subscribe to connection.created. Sessions expire after 30 minutes. Scope connections:write.

​
Connection lifecycle

GET /v2/institutions?provider=fiskil&q=anz lists banks with current availability (scope connections:read):
available and status answer different questions and can disagree. available is whether we offer the bank for linking at all; status is what the provider reports about it right now (ONLINE, OUTAGE, or null when unknown). available: true with status: "OUTAGE" is the normal way a supported bank looks during an outage: the link session will be created, but the consent may not complete until the bank is back. OAuth destinations go through a destination link: POST /v2/destination_links { type, return_url } → send the user to url. On completion a draft destination exists (status: incomplete, destination set on the link). Then:
  1. GET /v2/destinations/{id}/resources?type=spreadsheet (or sheet&parent=<spreadsheet id>, database, base, table&parent=app…, budget, account&parent=…, category&parent=…) to see what the grant can reach. A child type with no parent falls back to the destination’s current target, so type=sheet alone lists the tabs of the spreadsheet the destination already points at.
  2. POST /v2/destinations/{id} { "target": { "spreadsheet_id": "1AbC…", "sheet_id": 0 } } to aim it. The destination becomes active.
Targets by type: Sheets spreadsheet_id (+ sheet_id, names), Notion database_id, Airtable base_id + table_id, YNAB budget_id, Webhook url.

​
Webhook destinations

Created directly: POST /v2/destinations { "type": "webhook", "name": "My endpoint", "target": { "url": "https://example.com/redbark" } }. The signing secret (config.signing_secret) is returned on create and POST /v2/destinations/{id}/rotate_secret only; store it then. Payloads and headers are documented under Webhooks.

​
The destination object

status: active, incomplete (no target yet), reauth_required (the grant failed on a sync; use a new destination link or the dashboard), disabled (auto-disabled webhook; POST …/enable). Deleting a destination also deletes syncs that only wrote to it; 409 destination_in_use while a run is writing.