> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agg.market/llms.txt
> Use this file to discover all available pages before exploring further.

# Confirm account linking

> Exchanges the short-lived `link_confirm_token` (handed to the partner app by the link callback redirect) for an actual Account row attached to the current user's principal. The server matches the bearer's principalId AND appId to the token's values before writing — this is the final ownership check. A collision with an existing Account attached to a different Principal returns HTTP 409; the 200 success shape only covers `linked` and `already_linked_same`.



## OpenAPI

````yaml /openapi/openapi.json post /users/me/link-account/confirm
openapi: 3.0.2
info:
  title: AGG API
  version: 1.0.0
  description: >-
    Prediction market aggregator REST API — authentication, users, venue events,
    venue markets, orderbooks, charts, and execution workflows.
servers:
  - url: https://api.agg.market
    description: Production
  - url: https://api.staging.agg.market
    description: Staging
security: []
paths:
  /users/me/link-account/confirm:
    post:
      tags:
        - Users
      summary: Confirm account linking
      description: >-
        Exchanges the short-lived `link_confirm_token` (handed to the partner
        app by the link callback redirect) for an actual Account row attached to
        the current user's principal. The server matches the bearer's
        principalId AND appId to the token's values before writing — this is the
        final ownership check. A collision with an existing Account attached to
        a different Principal returns HTTP 409; the 200 success shape only
        covers `linked` and `already_linked_same`.
      operationId: linkAccountConfirm
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - token
              properties:
                token:
                  minLength: 1
                  type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - provider
                properties:
                  status:
                    type: string
                    enum:
                      - linked
                      - already_linked_same
                  provider:
                    type: string
        '400':
          description: '400'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '401':
          description: '401'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '403':
          description: '403'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '409':
          description: '409'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
      security:
        - appId: []
          bearerAuth: []
components:
  securitySchemes:
    appId:
      type: apiKey
      in: header
      name: x-app-id
      description: Your application ID. Required for all app-tier and user-tier routes.
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        JWT access token returned by POST /auth/verify. Required for user-tier
        routes.

````