API reference
The public origin is https://magnum.lat. Development uses http://localhost:3100. Functional responses use { "data": ... }; errors use { "error": ... }.
Server integration
| Method | Path | Authorization |
|---|---|---|
| GET | /v1/capabilities | Public |
| GET | /v1/networks | Public |
| GET | /v1/quotes?asset=USDT | Public |
| GET/POST | /v1/integrations | integrations:read/write |
| POST | /v1/checkout-sessions | checkouts:write + idempotency |
| GET | /v1/checkout-sessions/:id | checkouts:read |
| GET | /v1/payments | payments:read |
| GET | /v1/metrics | metrics:read |
| GET | /v1/requests | metrics:read |
| POST | /v1/webhook-endpoints | webhooks:write |
| DELETE | /v1/webhook-endpoints/:id | webhooks:write |
| GET | /v1/webhook-deliveries | webhooks:write |
Checkout browser
| Method | Path | Requirement |
|---|---|---|
| GET | /v1/public/checkouts/:id | Checkout capability |
| POST | /v1/public/checkouts/:id/payments | Capability + idempotency |
| GET | /v1/public/checkouts/:id/payment | Checkout capability |
| POST | /v1/public/checkouts/:id/simulate | Capability + sandbox |
| POST | /v1/sandbox/sessions | Same origin + rate limit |
Account endpoints are covered in Accounts. /healthz is liveness; /readyz checks PostgreSQL. /v1/providers/4p/notifications is blocked by live policy.
OpenAPI
The generated contract is at /v1/openapi.json. Business-input schemas come from the same validation used by the server. Account authentication is delegated to Better Auth and is not part of this document. Undocumented extra fields are rejected.
Merchant session API
See Merchant console for the authenticated console endpoints, configuration builder and account lifecycle. These session endpoints are distinct from server API-key authorization.
GET /v1/metrics returns receivedBrlCents as integer BRL cents and settledUsdt as an exact decimal string, with sandbox counts separate from live results. See operations for definitions. Business owners configure fixed network/asset receiving addresses with GET and PUT /v1/console/workspaces/:workspaceId/settlement; provider credentials are operator-only and are not accepted in these requests.