THE HTTP
SURFACE.

REST over HTTPS, JSON in and out, bearer authentication, versioned under /api/v1. Errors return a message intended for a person to read rather than a code to look up, on the basis that most integration debugging is done by whoever wrote it at the time.

Routes resolve the actor from the token and check what that actor may do. There is no separate permission model for programmatic access, which is deliberate: two permission systems are two chances to disagree, and the disagreement is always a hole.

Amounts are never accepted from a caller where they can be computed. A tax figure, a commission or a settlement share supplied by a client is a figure a client can edit, and the liability for getting it wrong sits with the participant rather than with whoever sent it.

Anything that moves money carries an idempotency key, so a retried request settles once. Duplicate charges are the failure customers never forgive and the one that is entirely preventable.