Base URL
{your-broker-domain} with
the domain issued during onboarding.
Authentication
All authenticated requests require a Bearer token in theAuthorization header:
Rate Limits
| Bucket | Limit |
|---|---|
| Authenticated endpoints | 300 requests / minute / user |
| Registration endpoint | 600 requests / minute / IP |
X-RateLimit-* headers when a limit applies.
Errors
The API uses conventional HTTP status codes. Error responses are JSON:| Code | Meaning |
|---|---|
400 | Validation failed — see detail |
401 | Missing or invalid credentials |
403 | Credentials valid but insufficient scope |
404 | Resource not found |
409 | Conflict — typically a duplicate or state mismatch |
429 | Rate limit exceeded |
5xx | Platform error — safe to retry with exponential backoff |
Versioning
The API is versioned through its hostname. Breaking changes ship on a new subdomain; non-breaking additions roll out in place and are announced in the changelog.Next
- Authentication — obtain and refresh access tokens
- API Reference — the full endpoint catalog