Using the APIIntroduction

Introduction

The conventions every Rasto Business endpoint follows, and where to find each one documented.

The Rasto Business API is REST over HTTPS, with JSON request and response bodies. Every endpoint in the reference follows the conventions on this page, so learning them once covers the whole surface.

export BASE=https://sandbox.rasto.co
export KEY=sk_test_...

curl -s $BASE/api/customers -H "Api-Key: $KEY"

The conventions

ConventionRuleDetail
AuthenticationApi-Key header on every requestAuthentication
EnvironmentsTwo hosts, two key prefixes, partitioned dataEnvironments
VersioningOptional Api-Version header, ISO date. Omitting it pins the oldest supported versionEnvironments
IdempotencyIdempotency-Key required on every POST /api/*Idempotency
ErrorsOne envelope, a coarse kind and a specific codeErrors
StatusesStable vocabulary, forward only, one webhook per transition worth reacting toStatuses & Lifecycles
PaginationCursor based, limit 1 to 100, default 25Pagination & Filtering
AmountsDecimal strings. Rates in basis pointsAmounts & Precision

Three surfaces

The URL prefix tells you who a route is for.

PrefixCallerAuth
/api/*You, from your backendApi-Key
/dashboard/*Your team, from the dashboardDashboard session

Tenant-level operations live on /dashboard/* deliberately: signing up, managing API keys, and registering wallet keys. A leaked API key cannot reach them.

A third surface receives inbound callbacks from the banking and verification systems behind the API. It is authenticated separately and is never callable with an API key, which is why it is not documented here.

Naming rules worth knowing

  • Discriminator fields are always kind, never type. A customer's kind, a destination's kind, an event's kind.
  • Money values are decimal strings in the asset's major units, never floats and never smallest-unit integers.
  • Rates are basis points, never percent. 100 means 1%.
  • Bank details use native vocabulary: account_number and routing_number for USD, iban and bic for SEPA. There is no generic account identifier field.
  • Ids are opaque strings with a stable prefix (cus_, va_, wop_). Do not parse them. See Objects & Terminology.

Objects and envelopes

Single resources return the object directly, with an object field naming its kind:

{"id": "cus_033y1FhTOmoW9W2jAuSvQx", "object": "customer", "kind": "individual"}

Lists return a fixed wrapper:

{"data": [], "has_more": false, "next_cursor": null}

Webhook payloads carry the same objects. data.object inside an event is byte-identical to what the matching GET returns, so your models never fork.

Errors

Every failure, on every endpoint, returns the same envelope:

{
  "error": {
    "kind": "invalid_request_error",
    "code": "endorsement_required",
    "message": "...",
    "param": null,
    "request_id": "req_033xhsr1AZZxC8AOkK7y3W"
  }
}

Branch on code. Every documented code carries a retry class in Errors.

Was this page helpful?