> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # Link a source account to a member > Records that a source user account of a Provider belongs to the active member of the selected Workspace who signs in with the given email, when no exact identity link joins them. From the next access run, the member reads what that account may open in the Provider, as through an exact identity link, while the member is active and the account is an active user in the Provider. An account has at most one live link. Confirming the link that already exists returns it and changes nothing. Each new link is recorded in the audit trail with the person, the account and the member. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant `tenant.providerpolicies.manage`. ## Errors * `WA-PP-011`: No active member of the Workspace signs in with this email. Enter the email that a member of this Workspace signs in with. * `WA-PP-013`: The account is already linked to another member. Remove the account’s link first, then link it to this member. * `WA-PP-015`: The account is not a user account of a Provider in the catalog. Choose an account from the Unlinked accounts view. ## OpenAPI ````yaml /api-reference/openapi.json post /api/provider-policies/source-permissions/account-links openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/provider-policies/source-permissions/account-links: post: tags: - Provider policies summary: Link a source account to a member description: >- Records that a source user account of a Provider belongs to the active member of the selected Workspace who signs in with the given email, when no exact identity link joins them. From the next access run, the member reads what that account may open in the Provider, as through an exact identity link, while the member is active and the account is an active user in the Provider. An account has at most one live link. Confirming the link that already exists returns it and changes nothing. Each new link is recorded in the audit trail with the person, the account and the member. operationId: ProviderPoliciesConfirmSourceAccountLinkHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/ConfirmSourceAccountLinkInput' required: true responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/SourceAccountLink' links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The request is not valid. `detail` says why. A value that breaks a field rule gives the code `WA-VL-001` and an `errors` member that names each field. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '429': content: text/plain: schema: example: Too Many Requests type: string description: >- More than 20 requests a minute came from your address. Wait for the number of seconds in `Retry-After`, then try again. headers: Retry-After: description: The number of seconds to wait before you try again. schema: type: integer X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: >- import { WebApiSDK } from "@parable-platform/web-api-sdk"; import type { ConfirmSourceAccountLinkInput } from "@parable-platform/web-api-types"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const input: ConfirmSourceAccountLinkInput = JSON.parse(`{ "providerKey": "550e8400-e29b-41d4-a716-446655440000", "principalKey": "example", "email": "person@example.com" }`); const result = await sdk.providerPolicies.confirmSourceAccountLink( input ); - label: Python SDK lang: python source: >- import json import os from parable_types_web_api import ConfirmSourceAccountLinkInput from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) input_data = ConfirmSourceAccountLinkInput.model_validate( json.loads("{\"providerKey\":\"550e8400-e29b-41d4-a716-446655440000\",\"principalKey\":\"example\",\"email\":\"person@example.com\"}"), ) result = sdk.provider_policies.confirm_source_account_link(input_data) - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{types, ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let input: types::ConfirmSourceAccountLinkInput = serde_json::from_value( serde_json::json!({ "providerKey": "550e8400-e29b-41d4-a716-446655440000", "principalKey": "example", "email": "person@example.com" }), )?; let result = sdk.provider_policies.confirm_source_account_link( input, Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nvar input webapitypes.ConfirmSourceAccountLinkInput\nif err := json.Unmarshal([]byte(`{\"providerKey\":\"550e8400-e29b-41d4-a716-446655440000\",\"principalKey\":\"example\",\"email\":\"person@example.com\"}`), &input); err != nil {\n\treturn err\n}\nresult, err := sdk.ProviderPoliciesNamespace.ConfirmSourceAccountLink(ctx, input)" components: schemas: ConfirmSourceAccountLinkInput: additionalProperties: false description: Links one source account to the member who signs in with `email`. properties: email: description: The email the member signs in with. format: email maxLength: 255 pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ type: string principalKey: description: |- The account's principal key, `user:`, as the Unlinked accounts view lists it. maxLength: 1024 minLength: 6 type: string providerKey: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string required: - providerKey - principalKey - email type: object SourceAccountLink: description: >- A source account a Workspace administrator linked to a member; spec 0095 "Admin-confirmed links"). On each access run the member's login email gets the account's tokens, as through an exact identity link, while the member is active and the account is an active user in the Provider. properties: confirmedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string confirmedBy: description: Who confirmed the link, and when. pattern: ^[0-9A-Za-z]{1,22}$ type: string id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string member: $ref: '#/components/schemas/SourcePermissionsPerson' description: The member, with the email of their Parable account. memberActive: description: |- False while the member is not an active member of the Workspace. The link then gives nobody the account's tokens. type: boolean principalKey: description: The account's principal key, `user:`. type: string providerKey: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string required: - id - providerKey - principalKey - member - memberActive - confirmedBy - confirmedAt type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object SourcePermissionsPerson: description: >- The person a source permissions preview or explanation is about: an active member of the Workspace, found by the email they sign in with. properties: email: description: |- The email they sign in with, which source permissions match to their accounts in each Provider. format: email maxLength: 255 pattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ type: string userId: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string required: - userId - email type: object headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.