Skip to content
Crossnetting
Sign inOpen demo

Docs

API reference

Base URL and access

One gateway behind every route

All endpoints below are served by the gateway and require an Authorization: Bearer <session token> header, except /healthz and POST /v1/auth/session. Responses use the { "data": ... } / { "error": { code, message } } envelopes described in the quickstart, and every response carries an x-request-id correlation header (a valid client-supplied id is reused, otherwise the gateway mints a UUID).

The machine-readable contract is packages/api-contracts/openapi.yaml in the repository — request/response schemas with exact field types live there.

  • Local development

    http://localhost:3000

  • Rate limit

    100 requests / minute / tenant

  • Money

    Integer minor units — never floats

Gateway

Operational endpoints on the gateway itself — no authentication required.

  • GET/healthzLiveness probe for the gateway.

Auth

Session issuance. The token subject becomes your tenant id on every subsequent call.

  • POST/v1/auth/sessionExchange a BankID/MitID verification result for an HS256 JWT session token (one hour TTL).

Accounts

Virtual multi-currency accounts with real IBANs and live balances.

  • POST/v1/accountsCreate a multi-currency virtual account.
  • GET/v1/accountsList virtual accounts for the tenant — cursor-paginated, oldest first; limit 1-100 (default 20) plus an opaque cursor, response carries meta { nextCursor, hasMore }.
  • GET/v1/accounts/{id}Get one virtual account.
  • PATCH/v1/accounts/{id}Transition an account to active, frozen or closed — closing is done via status; there is no DELETE route.
  • GET/v1/accounts/{id}/balanceReal-time balance via the Open Banking provider adapter.

Payments

SEPA and cross-border payments, batch submission and indicative FX rates.

  • GET/v1/paymentsList the tenant's payments, optionally filtered by status and currency.
  • POST/v1/payments/cross-borderCreate a cross-border payment with a firm FX quote and ledger debit. Body uses flat minor-unit fields: sourceAmountMinor, sourceCurrency, targetCurrency. Optional Idempotency-Key header (8-128 printable ASCII chars): replaying the identical request returns the stored response; the same key with a different body is a 409 conflict.
  • POST/v1/payments/batchBulk payments with partial accept — each item is validated and queued independently; per-item rejections are reported alongside the accepted ones. Same Idempotency-Key semantics as the cross-border call.
  • GET/v1/payments/{id}Get one payment by id (tenant-scoped).
  • POST/v1/payments/{id}/executeExecute (release) a quoted payment against a previously issued quoteId, settling at the quoted rate.
  • GET/v1/fx/ratesIndicative FX quote for a currency pair, tiered by plan.

Compliance

KYC/AML screening, the CSRD/ESG report pipeline, DORA controls and MiCA token classification.

  • POST/v1/compliance/screeningKYC/KYB plus AML/PEP/sanction screening.
  • GET/v1/compliance/screeningsList the tenant's screening cases — cursor-paginated, newest first (limit + opaque cursor, meta { nextCursor, hasMore }).
  • GET/v1/compliance/screenings/{id}Fetch one screening case with verdict and hits.
  • POST/v1/compliance/transactionsRecord tenant transaction stream as the CSRD/ESG data foundation.
  • GET/v1/compliance/transactionsList the tenant's recorded transactions — cursor-paginated, oldest first (limit + opaque cursor, meta { nextCursor, hasMore }).
  • POST/v1/compliance/csrd-reportGenerate a CSRD-compatible ESG report from recorded transactions.
  • GET/v1/compliance/csrd-reportsList the tenant's generated CSRD reports.
  • GET/v1/compliance/csrd-reports/{period}Fetch one stored CSRD report by period (e.g. 2026-Q3).
  • GET/v1/compliance/dora-statusICT risk dashboard: DORA control status with open incidents.
  • POST/v1/compliance/dora/incidentsReport a DORA ICT incident; affected controls are downgraded and the change set is returned.
  • POST/v1/compliance/mica/classifyMiCA token classification via deterministic decision tree (EMT / ART / utility / other).

Treasury

Balance and cash-flow ingestion, FX exposure, hedging and liquidity forecasting.

  • POST/v1/treasury/balancesIngest/upsert one account balance snapshot for exposure analytics.
  • POST/v1/treasury/transactionsIngest cash-flow transactions (inflow/outflow) as forecast input.
  • GET/v1/treasury/fx-exposureNet FX exposure per non-base currency, derived from stored balances.
  • POST/v1/treasury/hedge-recommendationsRecompute exposures with optional FX pair return series and publish the hedge recommendation event.
  • GET/v1/liquidity/forecastLiquidity forecast over configurable horizons (30/60/90 days).

Analytics

Reporting reads: the audit log, summaries and ESG scores.

  • GET/v1/analytics/audit-logsTenant-scoped append-only audit log (event bus archive).
  • GET/v1/analytics/summaryPayment volume and count per currency, screening verdicts, latest ESG score.
  • GET/v1/analytics/esg-scoreEU Taxonomy alignment score from the latest CSRD report.
  • POST/v1/analytics/snapshotRoll counts and volumes since the last snapshot; emits analytics.snapshot.ready.

Webhooks

Subscribe your own endpoints to platform events. Deliveries POST the event envelope with x-crossnetting-event-type, x-crossnetting-event-id and x-crossnetting-signature (v1=<hex>, HMAC-SHA256 over '<event-id>.<raw JSON body>') headers; failed deliveries retry up to 3 times (250 ms / 1 s / 4 s backoff) and the subscription reports lastDeliveryStatus, lastDeliveryAttempts, lastDeliveryStatusCode and lastDeliveryError.

  • GET/v1/webhooksList the tenant's webhook subscriptions.
  • POST/v1/webhooksSubscribe a URL to a set of platform event types.
  • DELETE/v1/webhooks/{id}Remove a webhook subscription.

Models

Direct inference endpoints for the platform's models.

  • POST/v1/models/cash-flow-predictCash-flow prediction — weighted moving average plus trend with a confidence band.
  • POST/v1/models/fx-risk-scoreFX risk scoring — volatility per exposure and a recommended hedge ratio.
  • POST/v1/models/fraud-scoreFraud detection — rule-weighted risk score over transaction features.
  • POST/v1/models/esg-classifyESG classification — EU taxonomy keyword screening of activity text.
← QuickstartOpen the demo dashboard →