API conventions

Every route follows the same rules, so learn them once:

• Authentication: send an API key in the Authorization header. Its grants decide what it can do.
• Environments: a project runs in sandbox (devnet) or production (mainnet-beta), and its keys work in that environment only.
• Idempotency: send an Idempotency-Key to retry a mutation safely. Routes that move money require one.
• Errors: one error envelope, with a code to branch on.
• Pagination: lists return one page at a time.
• Rate limits: each API key gets a set number of requests per minute.
• Versioning: the version is in the path, and a breaking change gets a new one.

A successful JSON response wraps its payload in data, with meta.requestId beside it; a 204 has no body, and the health checks answer with their own. Every response also carries the ID in X-Request-ID: quote it when you report a problem.