Do you provide an OpenAPI spec?
Yes. Download JSON/YAML from Developers → API. Use it to generate clients or validate requests.
How do I authenticate API calls?
Use the session cookie after login:
curl -X POST $API_BASE/api/auth/login \
-H 'Content-Type: application/json' \
-d '{"email":"[email protected]","password":"••••••"}' \
-c cookies.txt
Then pass -b cookies.txt on subsequent calls. (If API keys are enabled for your plan, you’ll pass Authorization: Bearer <key>.)
Do you support idempotency keys?
Yes. Provide a stable reference in your requests or an Idempotency-Key header.
Why it matters
Safe retries on network errors.
Webhooks can deliver duplicates; dedupe by event ID/reference.
What rate limits apply?
Default 100 req/min per org, burstable with fair‑use.
If you hit limits
Back off with exponential retry.
Contact support for plan‑based increases.
How do I secure webhooks?
Stripe: use
express.raw()for body + verify withSTRIPE_WEBHOOK_SECRET.Bank/open banking: verify
X‑Hmac‑Signature.Store event IDs; ignore duplicates; time‑box processing to avoid retries.
Can I replay webhook events?
Yes. Use your provider dashboard (Stripe “replay”). Replaying helps recover from outages or bad secrets.
What events are in SSE?
Orders (order.created, order.status.changed), Contracts (contract.signed, contract.message), Payments (payment.succeeded), Escrow (escrow.released), Disputes (dispute.opened, dispute.resolved).
Client pattern
const es = new EventSource('/api/events/stream', { withCredentials: true });
['order.status.changed','payment.succeeded','dispute.opened'].forEach(n =>
es.addEventListener(n, e => console.log(n, JSON.parse(e.data))));
How do I paginate and filter?
Use standard query params (e.g., ?limit=50&cursor=abc&status=InProgress&from=2025-01-01). Responses include a nextCursor when more data is available.
What’s your error format?
{
"code":"VALIDATION_ERROR",
"message":"Invalid payload",
"issues":[{"path":["currency"],"message":"Must be a 3-letter code"}]
}
See API → Errors for details.
Do you offer SDKs?
You can generate one from the OpenAPI spec. Community SDKs may be available; otherwise use fetch/axios or your preferred HTTP client.