> ## Documentation Index > Fetch the complete documentation index at: https://docs.interchange.io/llms.txt > Use this file to discover all available pages before exploring further. # Open a payment capture link > Exchange a capture-link token issued by the add_payment_authority task. No API key or session applies — the single-use token (valid 30 minutes, one verified card capture) is the authorization; the hosted capture page calls this on the cardholder's behalf. Marks the link opened and returns the org display name plus the embedded card form's client secret and publishable key while the link is still capturable; once verified or expired it returns the status alone. Pass `view=status` for a cheap status-only poll that opens nothing. Unknown or malformed tokens return a bare 404/400 with no organization information. Requests are IP rate-limited. ## OpenAPI ````yaml /v2/buyer-api-v2.yaml get /capture-links/{token} openapi: 3.0.0 info: title: Scope3 Buyer API version: 2.0.0 description: |- REST API for advertisers to manage advertisers, campaigns, and reporting. ## Authentication All endpoints require a Bearer token in the Authorization header: ``` Authorization: Bearer your-api-key ``` ## Base URL `https://api.interchange.io/api/v2/buyer` ## For AI Agents AI agents can use the MCP endpoint at `/mcp/v2/buyer` with three tools: - `initialize`: Start an MCP session - `api_call`: Make REST API calls - `ask_about_capability`: Learn about API features servers: - url: https://api.interchange.io/api/v2/buyer description: Production server security: [] tags: - name: Account description: Account management, service tokens, and preferences - name: Advertisers description: Manage advertisers - name: Product Discovery description: Discover and select products - name: Campaigns description: Manage advertising campaigns - name: Creatives description: Build, manage, and sync campaign creatives via AdCP Creative Protocol - name: Reporting description: Access performance metrics - name: Event Sources description: >- Manage event source configurations and log conversion/marketing events for attribution - name: Property Lists description: Validate property lists against AAO registry - name: Sales Agents description: View and connect sales agents - name: Measurement description: Measurement sources, records, context, and freshness - name: Syndication description: Syndicate resources to ADCP agents - name: Tasks description: Track async operation status - name: Planning Briefs description: >- Share prospective briefs with publishers and collect their fit/quote/clarify/decline/book responses (gated by the demand-supply-signals flag). - name: Buyer Billing description: >- Consolidated invoicing for buyers — invoices and pending invoice items issued by Scope3 across the buyer customer. - name: MCP description: Model Context Protocol endpoints for AI agents paths: /capture-links/{token}: servers: - url: https://api.interchange.io/api/v2 description: Production server get: tags: - Buyer Billing summary: Open a payment capture link description: >- Exchange a capture-link token issued by the add_payment_authority task. No API key or session applies — the single-use token (valid 30 minutes, one verified card capture) is the authorization; the hosted capture page calls this on the cardholder's behalf. Marks the link opened and returns the org display name plus the embedded card form's client secret and publishable key while the link is still capturable; once verified or expired it returns the status alone. Pass `view=status` for a cheap status-only poll that opens nothing. Unknown or malformed tokens return a bare 404/400 with no organization information. Requests are IP rate-limited. operationId: exchangeCaptureLink parameters: - in: query name: view schema: description: >- Pass `status` for the cheap status-only poll: returns status and expiry without opening the link or minting card-form credentials. type: string enum: - status description: >- Pass `status` for the cheap status-only poll: returns status and expiry without opening the link or minting card-form credentials. - in: path name: token schema: description: >- The single-use capture-link token from the URL issued by add_payment_authority. The token is the authorization — no session or API key applies. type: string pattern: ^[A-Za-z0-9_-]{40,64}$ required: true description: >- The single-use capture-link token from the URL issued by add_payment_authority. The token is the authorization — no session or API key applies. responses: '200': description: Open a payment capture link content: application/json: schema: $ref: '#/components/schemas/CaptureLinkExchangeResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: >- NOT_FOUND (unknown token — deliberately indistinguishable from any other failure; no organization information is returned). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: RATE_LIMITED (per-IP enumeration cap). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: [] components: schemas: CaptureLinkExchangeResponse: description: >- Validates the capture-link token, marks it opened, and returns everything the hosted page needs to mount the embedded card form (or render the current status if already verified/expired). type: object properties: status: description: >- `pending`: issued, not yet opened. `opened`: the hosted page exchanged the token at least once. `verified`: the card-rail webhook confirmed a payment method for this link. `expired`: the TTL elapsed before verification — terminal, never re-armed. type: string enum: - pending - opened - verified - expired orgDisplayName: description: >- The requesting org's display name, shown so the cardholder knows whose payment method they're adding. Omitted from the status-only poll view. type: string expiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ clientSecret: description: >- The capture-session client secret for the embedded card form. Present only while status is pending or opened. type: string publishableKey: type: string required: - status - expiresAt additionalProperties: false ErrorResponse: description: Standard error response type: object properties: data: type: string nullable: true enum: - null error: $ref: '#/components/schemas/ApiError' required: - data - error additionalProperties: false ApiError: description: Structured error object type: object properties: code: description: Machine-readable error code type: string message: description: Human-readable error message type: string field: description: Field path associated with the error type: string details: description: Additional error context type: object additionalProperties: {} required: - code - message additionalProperties: false ````