Skip to main content
Reads GET /v1/units/{unit_id}/tap-intents with the active tap session once per session, and again whenever you call refresh(). approve and cancel call the session’s approve and cancel endpoints. All three take the tap session token only, so the page needs a publishable key and no server of its own. See Confirm a step with a tap. The SDK does not retry approve or cancel after a failure, because a repeated wrong code would spend one of the five tries. Only a 429 rate_limit.exceeded, refused before anything runs, is retried. The hook sends one request per tap intent at a time: a second approve while one is in flight resolves with the first, and a cancel during a approve (or the reverse) rejects. Do not retry them in a loop. Call approve only after the person confirms, never when the page loads.

Example

Returns

readonly OpenTapIntent[]
One { id, title, codeRequired, redirectOrigin } per open tap intent. redirectOrigin is the origin of the tap intent’s redirect URL, or null. The list never carries a code. It is empty without a tap session, while the first read loads, and when nothing is open. A row leaves the list when approve or cancel resolves for it, or is refused because the tap intent is closed.
"idle" | "loading" | "ready" | "error"
"idle" without a tap session, "loading" while it reads, then "ready" or "error". A new tap reads as "loading" until its own answer lands.
Error | null
The failure that moved status to "error". A refused approve or cancel is not shown here: it rejects the call.
() => Promise<readonly OpenTapIntent[]>
Reads the list again for the current tap. Throws when there is no active session.
(tapIntentId: string, args?: { tapCode?: string }) => Promise<TapIntentOutcome>
Approves one tap intent. Pass tapCode, the six digits the person typed, when the row has codeRequired. Resolves with { id, status: "approved", redirectUrl }. It does not navigate: redirectUrl already has tap_intent=<id> added, and is null when the tap intent has no redirect URL. Throws when there is no active session.
(tapIntentId: string) => Promise<TapIntentOutcome>
Cancels one tap intent for the person, with no code. Resolves with { id, status: "canceled", redirectUrl: null }. Throws when there is no active session.

Errors

approve and cancel reject with the SDK error. Branch on error.code. These calls need the @endstate-sdk/core release that adds session.tapIntents.