API reference

Base URL

https://passify.biz/api/v1

OpenAPI specification

The full API is described by a machine-readable OpenAPI 3.1 document. Use it to generate clients, drive an API explorer, or validate requests.

# JSON (served live)
curl https://passify.biz/api/openapi

# YAML (published in the repo)
# openapi.yaml

Authentication

Send your API key as a bearer token on every request except /health. See Authentication for key management.

Authorization: Bearer passify_live_xxx

Errors

Every error uses the same shape. Include request_id when contacting support.

{
  "error": "error_code",
  "detail": "Human-readable description.",
  "request_id": "a1b2c3d4"
}

Rate limits

Idempotency

Write endpoints (POST /kyc/start, POST /token/mint, POST /token/transfer) accept an optional Idempotency-Key header so a retried request is never processed twice. Reuse the same key when retrying after a network error.

curl -X POST https://passify.biz/api/v1/token/mint \
  -H "Authorization: Bearer passify_live_xxx" \
  -H "Idempotency-Key: 7b9c1e2f-..." \
  -H "Content-Type: application/json" \
  -d '{"user_pubkey":"7xKX...","mint_config":"us_real_estate_fund_v1","amount":1000}'

• The first request for a key is processed normally; the response is stored for 24 hours.
• A replay with the same key returns the original response with the header Idempotent-Replayed: true.
• Server errors (5xx) are not stored, so a failed write can be safely retried.
• Keys are scoped per API key and must be 255 characters or fewer.

Conventions

• All request and response bodies are JSON; send Content-Type: application/json on writes.
• Timestamps are UTC, ISO 8601 (e.g. 2026-12-15T00:00:00Z).
• Solana addresses and signatures are base58 strings.
• All traffic must use HTTPS; HSTS is enforced.

Endpoint index