Create a bundle link
const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/bundles/2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64/links';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"label":"Acme partner offer","limit":25}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/bundles/2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64/links \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "label": "Acme partner offer", "limit": 25 }'Creates a link on a Live or Retired private bundle. Send the returned url to a team. Its use count starts at 0, and each link has its own token.
Required permissions
- None beyond a valid token; requires an OAuth token with the
developerorbundlesscope, for an owner of the addressed organization or a member with thebundlesfinance area and all apps
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the organization that owns the bundles, as listed by GET /me under organizations.
Example
9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7bUnique id (UUID) of the organization that owns the bundles, as listed by GET /me under organizations.
Unique id (UUID) of the bundle, as returned by the create and list operations.
Example
2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64Unique id (UUID) of the bundle, as returned by the create and list operations.
Request Bodyrequired
Section titled “Request Bodyrequired”The label and limit of the link.
Responses
Section titled “Responses”The created link.
object
A link that offers a private bundle to whoever holds it.
object
Server-assigned unique id of the link.
Id of the bundle the link belongs to.
What the developer calls the link.
The token in the link’s URL. It stays readable, so the link can be copied again at any time.
The URL to send to a team.
How many teams have bought through the link.
When the link was revoked, as an ISO 8601 UTC timestamp. Null while it is not revoked.
Id of the user who created the link. Null once that user is deleted.
When the link was created, as an ISO 8601 UTC timestamp.
Example
{ "link": { "linkId": "5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345", "bundleId": "2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64", "label": "Acme partner offer", "limit": 25, "token": "3f9a1c7e5b2d4806a1e3c5f7092b4d6e8f0a1c3e5b7d9f1a2c4e6b8d0f2a4c6e", "url": "https://platform.blotout.io/bundles/link?token=3f9a1c7e5b2d4806a1e3c5f7092b4d6e8f0a1c3e5b7d9f1a2c4e6b8d0f2a4c6e", "useCount": 0, "revokedAt": "2026-11-05T00:00:00.000Z", "createdByUserId": "c7d1e2f3-4a5b-4c6d-8e9f-0a1b2c3d4e5f", "createdAt": "2026-11-05T00:00:00.000Z" }}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter. invalid_body — The JSON body is unparseable or failed schema validation; details pinpoints the offending fields when the body could be parsed. invalid_bundle — The bundle details were rejected, such as a name or description that is empty or too long, a description with a line break, an app that is not a published app of the organization, or a price, trial, site limit, service, link label or link limit out of range. message states which.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "message": "The Cloudflare API token is invalid or expired.", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known. bundles_scope_required — The bearer credential has neither the developer nor the bundles scope, so it reaches no bundle operation whatever the role of its user. Authorize again to get a token with one of them.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}not_found — The addressed resource does not exist within this team; check the id and retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_found"}bundle_links_unavailable — A new link needs a Live or Retired private bundle, so this bundle takes none. Nothing changed. Publish a Draft first; a Paused bundle takes one once Blotout lifts the pause; a public bundle can’t have links.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "bundle_links_unavailable", "message": "The Cloudflare API token is invalid or expired."}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}