GET /v1/units/{unit_id}/tap-intents with the active tap session once
per session, and again whenever you call refresh(). approve and cancel
call the session’s approve and cancel endpoints. All three take the tap
session token only, so the page needs a publishable key and no server of its
own. See Confirm a step with a tap.
The SDK does not retry approve or cancel after a failure, because a
repeated wrong code would spend one of the five tries. Only a 429 rate_limit.exceeded, refused before anything runs, is retried. The hook sends
one request per tap intent at a time: a second approve while one is in
flight resolves with the first, and a cancel during a approve (or the
reverse) rejects. Do not retry them in a loop. Call approve only after the person confirms, never when the page loads.
Example
Returns
readonly OpenTapIntent[]
One
{ id, title, codeRequired, redirectOrigin } per open tap intent.
redirectOrigin is the origin of the tap intent’s redirect URL, or null.
The list never carries a code. It is empty without a tap session, while the
first read loads, and when nothing is open. A row leaves the list when
approve or cancel resolves for it, or is refused because the tap intent
is closed."idle" | "loading" | "ready" | "error"
"idle" without a tap session, "loading" while it reads, then "ready" or
"error". A new tap reads as "loading" until its own answer lands.Error | null
The failure that moved
status to "error". A refused approve or
cancel is not shown here: it rejects the call.() => Promise<readonly OpenTapIntent[]>
Reads the list again for the current tap. Throws when there is no active
session.
(tapIntentId: string, args?: { tapCode?: string }) => Promise<TapIntentOutcome>
Approves one tap intent. Pass
tapCode, the six digits the person typed,
when the row has codeRequired. Resolves with
{ id, status: "approved", redirectUrl }. It does not navigate:
redirectUrl already has tap_intent=<id> added, and is null when the
tap intent has no redirect URL. Throws when there is no active session.(tapIntentId: string) => Promise<TapIntentOutcome>
Cancels one tap intent for the person, with no code. Resolves with
{ id, status: "canceled", redirectUrl: null }. Throws when there is no
active session.Errors
approve and cancel reject with the SDK error. Branch on error.code.
These calls need the
@endstate-sdk/core release that adds
session.tapIntents.
