REST API
One resource model across dashboard, CLI, and MCP
Predictable JSON, idempotency keys on writes, cursor pagination on reads, and the same policy engine behind every call.
POST /v1/cards
{
"amount_cents": 5000,
"currency": "USD",
"card_type": "single_use",
"agent_id": "agt_123",
"task_id": "task_456",
"expires_at": "2026-08-10T12:00:00Z",
"merchant_lock": "DoorDash",
"approval_policy_id": "pol_789",
"metadata": {
"project": "Office lunch",
"requested_by": "user_123"
}
}201 Created
{
"id": "card_123",
"status": "active",
"amount_cents": 5000,
"available_cents": 5000,
"currency": "USD",
"last_four": "4821",
"card_type": "single_use",
"agent_id": "agt_123",
"created_at": "2026-08-02T19:00:00Z"
}
// Full card numbers are never returned here.
// Use POST /v1/cards/:id/reveal instead.Endpoints
Core surface area
Agents
- POST/v1/agents
- GET/v1/agents
- GET/v1/agents/:id
- PATCH/v1/agents/:id
- POST/v1/agents/:id/pause
Cards
- POST/v1/cards
- GET/v1/cards
- GET/v1/cards/:id
- POST/v1/cards/:id/reveal
- POST/v1/cards/:id/freeze
- POST/v1/cards/:id/unfreeze
- POST/v1/cards/:id/cancel
- PATCH/v1/cards/:id/limit
Transactions
- GET/v1/transactions
- GET/v1/transactions/:id
Approvals
- POST/v1/approval-requests
- GET/v1/approval-requests
- POST/v1/approval-requests/:id/approve
- POST/v1/approval-requests/:id/decline
Budgets & purchases
- POST/v1/budgets
- PATCH/v1/budgets/:id
- POST/v1/purchases
- POST/v1/purchases/:id/confirm
- POST/v1/purchases/:id/cancel
Errors
Declines explain themselves
Every rejection names the rule that produced it, so your agent can correct course instead of retrying blindly.
402 Payment Required
{
"error": {
"type": "policy_violation",
"code": "budget_exceeded",
"message": "Agent agt_123 has $12.40 remaining of its $500.00 monthly budget.",
"policy_id": "pol_monthly_marketing",
"remaining_cents": 1240,
"suggested_action": "request_approval"
}
}