Developer portal

The Cortex API is one REST surface: 319 documented operations over the same ledger, products and parties the consoles use. The API reference is generated from the live OpenAPI contract; the pages in this section explain the conventions that apply across those operations, so you only learn them once.

Start here

• Authentication: OAuth2, service clients, and how permissions in the token gate every call.
• Conventions: base URL and versioning, the money shape, dates, filtering.
• Idempotency: how to make writes safe to retry.
• Errors: the error shapes and what each status means.
• Maker-checker over the API: the 202 that means "an approver must decide".
• Events & integration: how effects reach other systems (and the honest limits).
• AI & agent access: the MCP gateway with preview-then-commit, autonomy tiers, signing.
• Quickstart tutorial: token → customer → account → transfer → journal, with curl.

The shape of the API in one minute

• One versioned REST surface. Every path is under /api/v1. Money moves only through the ledger, and the API is the same governed surface the admin console uses.
• OAuth2 bearer tokens. A service integration authenticates with the client_credentials grant; the token carries the permissions that authorise each call.
• Money is a {amount, currency} object. The amount is an exact decimal and currency is an ISO 4217 code. Never a bare float.
• Writes are idempotent. Every money-moving command carries an idempotencyKey; replaying it returns the original result instead of acting twice.
• Four eyes is built in. A write over a configured threshold returns 202 Accepted with an approvalId instead of executing. A human authorises it, and your original command is replayed.
• One tenant. Your credentials are bound to your institution; every record you touch belongs to it, and isolation is physical (a database per institution).

The contract under-specifies two things: these docs are authoritative

The generated openapi.json lists only a placeholder localhost server and declares no security scheme. The real base hosts and the OAuth2 model are documented here and in Authentication. When the two disagree, trust these pages.

→ Browse the full API reference