Base URL
Authentication
Every request requires a bearer API key in theAuthorization header:
Content type
All requests and responses useapplication/json.
Endpoints
| Method | Path | Purpose | Scope |
|---|---|---|---|
| POST | /customers | Create / upsert a customer | customers:write |
| GET | /customers | List / poll | customers:read |
| GET | /customers/{id} | Read one | customers:read |
| PATCH | /customers/{id} | Update | customers:write |
| GET | /customers/{id}/aml | Read AML status | aml:read |
OpenAPI
The machine-readable OpenAPI 3.1 spec is available atopenapi.yaml. Import it into Postman, Insomnia,
Stoplight, or your preferred SDK generator.
Conventions
- Identifiers. Customer ids are UUIDs. Wherever a
{id}path parameter appears, you can also pass your ownexternal_id— we detect the format and resolve accordingly. - Timestamps. ISO-8601 with offset (
2026-06-23T01:12:00Z). - Pagination. Cursor-based. See Pagination.
- Idempotency. Pass
Idempotency-Keyon writes. See Idempotency. - Errors. Standard envelope. See Errors.

