{ "info": { "_postman_id": "8c2d4e61-7a95-4b3f-8e10-4f6a9b2c7d35", "name": "Vestiarion API reference", "description": "Read a workspace's ledger, books, counterparties, milestones, treasury and insights, and add counterparties, invoices, milestones and payee links, with a workspace API key.\n\nEvery `/api/v1` operation, generated from the OpenAPI document at https://www.vestiarion.xyz/api/v1/openapi.json: one request per operation, in a folder per tag, with its parameters, its body and a saved example of each answer it documents. Optional parameters are listed and switched off; tick one to send it.\n\n**Authentication.** Each request sends `{{apiKey}}` as `Authorization: Bearer`. Import the Vestiarion environment, choose it, and paste a workspace API key as the value of `apiKey`. That value stays on your machine: never share it, and leave the variable's shared value empty. A read-only key reads everything; the `POST` requests need a read-and-write key. No request can approve, reject or pay: no API call can.\n\nNew to the API? Start with the \"Vestiarion: Getting Started\" collection. Guide: https://www.vestiarion.xyz/docs/get-started/postman", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{apiKey}}", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "if (!pm.variables.get(\"apiKey\")) {", " throw new Error(\"apiKey is empty. Choose the Vestiarion environment, top right, and paste a workspace API key as the value of apiKey. That value stays on this machine: never share it.\");", "}" ] } } ], "variable": [ { "key": "baseUrl", "value": "https://www.vestiarion.xyz", "type": "string", "description": "Where the API is. The Vestiarion environment sets the same value." } ], "item": [ { "name": "Workspace", "item": [ { "name": "Get workspace status", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "status" ] }, "description": "What this workspace is, and what it can actually do. The first call a client should make: whether payments and yield are live, simulated or unavailable, the workspace clock, running totals, and a description of its configuration. Secrets are never included.\n\n`unavailable` means nothing can pay in this workspace now: its Circle credentials are stored but cannot be read; or it is on Arc mainnet with no Circle account connected yet, or not live yet; or this deployment has Arc mainnet switched off. A cycle refuses to pay then rather than fall back to simulation, so status does not report it as `simulate`. Yield is also `unavailable` on a network with no yield reserve, such as Arc mainnet.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/get-status" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "status" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"businessName\": \"Vestiarion workspace\",\n \"provenance\": {\n \"payments\": \"live\",\n \"yield\": \"simulate\",\n \"screening\": \"simulate\"\n },\n \"clock\": {\n \"mode\": \"simulate\",\n \"day\": 25,\n \"lastCycleAt\": \"2026-09-24T18:33:04.546517+00:00\"\n },\n \"totals\": {\n \"decisionsLogged\": 77,\n \"totalPaidOut\": 4.815,\n \"flagged\": 1\n },\n \"configuration\": {\n \"businessName\": \"Vestiarion workspace\",\n \"chain\": {\n \"circleConfigured\": true,\n \"arcRpcConfigured\": false\n },\n \"llm\": {\n \"pinned\": null,\n \"available\": [\n \"deepseek\"\n ]\n },\n \"compliance\": {\n \"mode\": \"bundled\",\n \"rescreenIntervalHours\": 0\n },\n \"followUp\": {\n \"staleAfterDays\": 3,\n \"reEscalateAfterDays\": 7\n },\n \"ledgerSigningKeyProvided\": false,\n \"githubTokenProvided\": false,\n \"clockMode\": \"simulate\"\n },\n \"apiVersion\": \"v1\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "status" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "status" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "status" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] } ] }, { "name": "Ledger", "item": [ { "name": "List ledger entries", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "domain", "value": "system", "description": "Only entries in this domain.", "disabled": true }, { "key": "actor", "value": "system", "description": "Only entries written by this actor.", "disabled": true } ] }, "description": "The audit chain, oldest first, as a resumable stream. Because the ledger is append-only and ascending by `seq`, a stored `page.nextCursor` is a watermark: a request from it never returns an entry before it. Persist the last non-null `nextCursor` only after processing every entry in the responses read, and resume from it; the last page, which had no cursor of its own, is returned again, so de-duplicate on `seq`.\n\n`seq` is monotonic within a workspace but not gap-free; continuity is proven by the hash chain, not by `seq`.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/list-ledger-entries" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "domain", "value": "system", "description": "Only entries in this domain.", "disabled": true }, { "key": "actor", "value": "system", "description": "Only entries written by this actor.", "disabled": true } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": [\n {\n \"seq\": 82,\n \"id\": \"4566714f-a9f0-42c8-bcd4-d89adf830806\",\n \"ts\": \"2026-09-24T11:55:00.370366+00:00\",\n \"actor\": \"system\",\n \"domain\": \"system\",\n \"action\": \"seed\",\n \"summary\": \"Seeded demo business: Northstar Studio\",\n \"detail\": {\n \"accounts\": 3,\n \"invoices\": 6,\n \"milestones\": 3,\n \"amountScale\": 0.001,\n \"counterparties\": 7\n },\n \"bodyHash\": \"8780d07cb3d083d359119e58fd4783f5e4b32aac14e0a8d9f7a5bb13365a4537\",\n \"signature\": \"c14f06b751d31be6566ed11676d60d2db731ab8bbc5972f79d0a0c131e9e37200303d5b3ad04993b7973b1ce7200e7214e5a9b511306fa30538f072eb0d34705\",\n \"prevHash\": \"0000000000000000000000000000000000000000000000000000000000000000\",\n \"hash\": \"b0ac72908868ddd5ed4722fd8a14ff4a844eee4dad382c5c85288bca73737669\",\n \"signingKeyId\": null\n }\n ],\n \"page\": {\n \"nextCursor\": \"eyJrIjo4Mn0\",\n \"hasMore\": true,\n \"count\": 1\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "domain", "value": "system", "description": "Only entries in this domain.", "disabled": true }, { "key": "actor", "value": "system", "description": "Only entries written by this actor.", "disabled": true } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"cursor is not a cursor this API issued.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "domain", "value": "system", "description": "Only entries in this domain.", "disabled": true }, { "key": "actor", "value": "system", "description": "Only entries written by this actor.", "disabled": true } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "domain", "value": "system", "description": "Only entries in this domain.", "disabled": true }, { "key": "actor", "value": "system", "description": "Only entries written by this actor.", "disabled": true } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "domain", "value": "system", "description": "Only entries in this domain.", "disabled": true }, { "key": "actor", "value": "system", "description": "Only entries written by this actor.", "disabled": true } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] }, { "name": "Verify the ledger", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger/verify", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger", "verify" ] }, "description": "Replays signatures, body hashes and hash-chain continuity for the workspace the calling key belongs to.\n\n`valid` has three values, not two. `true` verified and `false` broken are findings about the chain; `null` means no verdict was produced, because there was no key to check authorship against. `reason` says which case it is. A key that is stored but cannot be read is a configuration problem, reported in `warnings`, not a finding about the chain.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/verify-ledger" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger/verify", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger", "verify" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"valid\": true,\n \"checkedEntries\": 99\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger/verify", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger", "verify" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger/verify", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger", "verify" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/ledger/verify", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "ledger", "verify" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] } ] }, { "name": "Payables and receivables", "item": [ { "name": "List invoices", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "direction", "value": "payable", "description": "Only payables, or only receivables. One of: `payable`, `receivable`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only invoices in this status. One of: `pending`, `matched`, `scheduled`, `paid`, `held`, `flagged`, `awaiting_info`, `received`, `rejected`.", "disabled": true }, { "key": "counterpartyId", "value": "4e363b59-d1ca-4425-924c-5c894bc3373f", "description": "Only invoices from or to this counterparty.", "disabled": true } ] }, "description": "The payable and receivable book, newest first, with the row id breaking equal timestamps. Each invoice carries the agent's reasoning, not only its verdict. Only a transaction reference beginning with `0x` is exposed as `txHash`; a simulated receipt gives `null`.\n\nAn unknown `direction` or `status` is refused with `400` rather than ignored.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/list-invoices" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "direction", "value": "payable", "description": "Only payables, or only receivables. One of: `payable`, `receivable`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only invoices in this status. One of: `pending`, `matched`, `scheduled`, `paid`, `held`, `flagged`, `awaiting_info`, `received`, `rejected`.", "disabled": true }, { "key": "counterpartyId", "value": "4e363b59-d1ca-4425-924c-5c894bc3373f", "description": "Only invoices from or to this counterparty.", "disabled": true } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": [\n {\n \"id\": \"9440f32c-000d-4a63-97f1-4eb6bf78439f\",\n \"direction\": \"payable\",\n \"status\": \"paid\",\n \"amount\": 0.11,\n \"currency\": \"USDC\",\n \"memo\": \"Stage-isolation verification\",\n \"poReference\": \"PO-4001\",\n \"goodsReceived\": true,\n \"dueDate\": \"2026-09-28T15:22:48.928+00:00\",\n \"scheduledFor\": null,\n \"earlyPayDiscount\": null,\n \"decidedAt\": \"2026-09-24T15:24:22.75+00:00\",\n \"settledAt\": \"2026-09-24T15:24:22.75+00:00\",\n \"escalatedAt\": null,\n \"agentReasoning\": \"Three-way match is complete: PO-4001 is on file and goodsReceived is true. Counterparty Vercel Inc has riskLevel 'clear' (not high) and the invoice amount 0.11 USDC is below the counterparty payment limit of 2 USDC. Treasury operatingBalance is 22.875 USDC, leaving 22.765 USDC after payment, and no duplicate matches were found (duplicateNote confirms no earlier payable from this counterparty resembles this invoice), so there is no fraud indicator.\",\n \"txHash\": \"0xda97ba74aca6a45e4759858230e743aac0735252b874fb07c20ec8026d80a7bf\",\n \"paidAmount\": 0.11,\n \"counterparty\": {\n \"id\": \"4e363b59-d1ca-4425-924c-5c894bc3373f\",\n \"name\": \"Vercel Inc\",\n \"riskLevel\": \"clear\"\n },\n \"createdAt\": \"2026-09-24T15:22:50.176754+00:00\"\n }\n ],\n \"page\": {\n \"nextCursor\": \"eyJrIjoiMjAyNi0wOS0yNFQxNToyMjo1MC4xNzY3NTQrMDA6MDAiLCJpZCI6Ijk0NDBmMzJjLTAwMGQtNGE2My05N2YxLTRlYjZiZjc4NDM5ZiJ9\",\n \"hasMore\": true,\n \"count\": 1\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "direction", "value": "payable", "description": "Only payables, or only receivables. One of: `payable`, `receivable`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only invoices in this status. One of: `pending`, `matched`, `scheduled`, `paid`, `held`, `flagged`, `awaiting_info`, `received`, `rejected`.", "disabled": true }, { "key": "counterpartyId", "value": "4e363b59-d1ca-4425-924c-5c894bc3373f", "description": "Only invoices from or to this counterparty.", "disabled": true } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"cursor is not a cursor this API issued.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "direction", "value": "payable", "description": "Only payables, or only receivables. One of: `payable`, `receivable`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only invoices in this status. One of: `pending`, `matched`, `scheduled`, `paid`, `held`, `flagged`, `awaiting_info`, `received`, `rejected`.", "disabled": true }, { "key": "counterpartyId", "value": "4e363b59-d1ca-4425-924c-5c894bc3373f", "description": "Only invoices from or to this counterparty.", "disabled": true } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "direction", "value": "payable", "description": "Only payables, or only receivables. One of: `payable`, `receivable`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only invoices in this status. One of: `pending`, `matched`, `scheduled`, `paid`, `held`, `flagged`, `awaiting_info`, `received`, `rejected`.", "disabled": true }, { "key": "counterpartyId", "value": "4e363b59-d1ca-4425-924c-5c894bc3373f", "description": "Only invoices from or to this counterparty.", "disabled": true } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "direction", "value": "payable", "description": "Only payables, or only receivables. One of: `payable`, `receivable`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only invoices in this status. One of: `pending`, `matched`, `scheduled`, `paid`, `held`, `flagged`, `awaiting_info`, `received`, `rejected`.", "disabled": true }, { "key": "counterpartyId", "value": "4e363b59-d1ca-4425-924c-5c894bc3373f", "description": "Only invoices from or to this counterparty.", "disabled": true } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] }, { "name": "Add an invoice", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 201 Created\", function () {", " pm.response.to.have.status(201);", "});" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] }, "description": "Adds a payable or a receivable, checked by the rules of the console's invoice form, and recorded in the ledger as `create_invoice` with `via: \"api\"` and the key's id. It is added as the key's issuer's: if the agent holds it, the issuer cannot approve it, unless they are the workspace's only approver.\n\nThe agent decides a payable as one typed in, with every guardrail and the workspace's limits, usually within a minute. The API never approves or pays. A `counterpartyId` the workspace does not hold, including another workspace's, answers `400`.\n\n**Key:** a read-and-write key. A read-only key gets `403 forbidden`.\n\nReference: https://www.vestiarion.xyz/docs/api/create-invoice" }, "response": [ { "name": "201 Created", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"id\": \"1f96fd0b-71de-41bf-b088-779655ea6df4\",\n \"direction\": \"payable\",\n \"status\": \"pending\",\n \"amount\": 0.1,\n \"currency\": \"USDC\",\n \"memo\": null,\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true,\n \"dueDate\": \"2026-10-03T12:00:00+00:00\",\n \"scheduledFor\": null,\n \"earlyPayDiscount\": null,\n \"decidedAt\": null,\n \"settledAt\": null,\n \"escalatedAt\": null,\n \"agentReasoning\": null,\n \"txHash\": null,\n \"paidAmount\": null,\n \"counterparty\": {\n \"id\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"name\": \"API Test Vendor\",\n \"riskLevel\": \"clear\"\n },\n \"createdAt\": \"2026-10-03T10:16:16.374931+00:00\"\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"The body must be JSON.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "409 conflict", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] } }, "status": "Conflict", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"conflict\",\n \"message\": \"This Idempotency-Key was already used for a different request. Use a new key for a new request.\"\n }\n}" }, { "name": "429 rate_limited", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Retry-After", "value": "60" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"rate_limited\",\n \"message\": \"Too many writes from this key. Try again in a minute.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "billing-inv-2026-0042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"amount\": \"0.10\",\n \"dueDate\": \"2026-10-03\",\n \"poReference\": \"PO-API-1\",\n \"goodsReceived\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/invoices", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "invoices" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] } ] }, { "name": "Counterparties", "item": [ { "name": "List counterparties", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "role", "value": "vendor", "description": "Only counterparties with this role. One of: `vendor`, `client`, `contractor`.", "disabled": true }, { "key": "riskLevel", "value": "unscreened", "description": "Only counterparties at this risk tier. One of: `unscreened`, `clear`, `medium`, `high`.", "disabled": true } ] }, "description": "Vendors, clients and contractors, newest first, with the row id breaking equal timestamps. Both the business's baseline payment limit and the current limit derived from the risk tier are reported. `performanceScore` is `null` when there is no history.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/list-counterparties" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "role", "value": "vendor", "description": "Only counterparties with this role. One of: `vendor`, `client`, `contractor`.", "disabled": true }, { "key": "riskLevel", "value": "unscreened", "description": "Only counterparties at this risk tier. One of: `unscreened`, `clear`, `medium`, `high`.", "disabled": true } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": [\n {\n \"id\": \"dc5e5751-3287-46c9-8bd1-83a42ab02699\",\n \"name\": \"Anthropic API Services\",\n \"role\": \"vendor\",\n \"address\": \"0x90a5821e8a59b711777c49d11a283c9c76cd811e\",\n \"chain\": \"ARC-TESTNET\",\n \"jurisdiction\": null,\n \"riskLevel\": \"clear\",\n \"riskNotes\": \"No match against watchlist\",\n \"baselinePaymentLimit\": 5,\n \"paymentLimit\": 5,\n \"lastScreenedAt\": \"2026-09-24T18:32:57.327+00:00\",\n \"performanceScore\": 0.667,\n \"performanceInputs\": {\n \"heldOrFlagged\": 0,\n \"heldByOurPolicy\": 1,\n \"riskTierChanges\": 0,\n \"duplicateSubmissions\": 0,\n \"informationRequested\": 0,\n \"paidWithoutIntervention\": 1\n },\n \"createdAt\": \"2026-09-24T11:54:57.677284+00:00\"\n }\n ],\n \"page\": {\n \"nextCursor\": \"eyJrIjoiMjAyNi0wOS0yNFQxMTo1NDo1Ny42NzcyODQrMDA6MDAiLCJpZCI6ImRjNWU1NzUxLTMyODctNDZjOS04YmQxLTgzYTQyYWIwMjY5OSJ9\",\n \"hasMore\": true,\n \"count\": 1\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "role", "value": "vendor", "description": "Only counterparties with this role. One of: `vendor`, `client`, `contractor`.", "disabled": true }, { "key": "riskLevel", "value": "unscreened", "description": "Only counterparties at this risk tier. One of: `unscreened`, `clear`, `medium`, `high`.", "disabled": true } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"cursor is not a cursor this API issued.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "role", "value": "vendor", "description": "Only counterparties with this role. One of: `vendor`, `client`, `contractor`.", "disabled": true }, { "key": "riskLevel", "value": "unscreened", "description": "Only counterparties at this risk tier. One of: `unscreened`, `clear`, `medium`, `high`.", "disabled": true } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "role", "value": "vendor", "description": "Only counterparties with this role. One of: `vendor`, `client`, `contractor`.", "disabled": true }, { "key": "riskLevel", "value": "unscreened", "description": "Only counterparties at this risk tier. One of: `unscreened`, `clear`, `medium`, `high`.", "disabled": true } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "role", "value": "vendor", "description": "Only counterparties with this role. One of: `vendor`, `client`, `contractor`.", "disabled": true }, { "key": "riskLevel", "value": "unscreened", "description": "Only counterparties at this risk tier. One of: `unscreened`, `clear`, `medium`, `high`.", "disabled": true } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] }, { "name": "Add a counterparty", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 201 Created\", function () {", " pm.response.to.have.status(201);", "});" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] }, "description": "Adds a vendor, contractor or client, checked by the rules of the console's form and screened as one added there: the answer's `riskLevel` is the screening's verdict, or `unscreened` when screening could not finish. It is recorded in the ledger as `create_counterparty` with `via: \"api\"` and the key's id.\n\nAn address added through the API waits for a person. The agent pays nothing to it until an owner, admin or approver confirms it on Counterparties, so a key can add records but cannot point the agent's payments at a new address.\n\n**Key:** a read-and-write key. A read-only key gets `403 forbidden`.\n\nReference: https://www.vestiarion.xyz/docs/api/create-counterparty" }, "response": [ { "name": "201 Created", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"id\": \"6b361405-cfda-4400-a286-364b561911ce\",\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"chain\": \"ARC-TESTNET\",\n \"jurisdiction\": null,\n \"riskLevel\": \"clear\",\n \"riskNotes\": \"OpenSanctions returned no matching entity\",\n \"baselinePaymentLimit\": 1,\n \"paymentLimit\": 1,\n \"lastScreenedAt\": \"2026-10-03T10:15:29.759+00:00\",\n \"performanceScore\": null,\n \"performanceInputs\": null,\n \"createdAt\": \"2026-10-03T10:15:26.865688+00:00\"\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"The body must be JSON.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "409 conflict", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] } }, "status": "Conflict", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"conflict\",\n \"message\": \"This Idempotency-Key was already used for a different request. Use a new key for a new request.\"\n }\n}" }, { "name": "429 rate_limited", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Retry-After", "value": "60" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"rate_limited\",\n \"message\": \"Too many writes from this key. Try again in a minute.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "crm-vendor-1042", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"API Test Vendor\",\n \"role\": \"vendor\",\n \"address\": \"0x6b3A4C65f362b818bb7FD6f999477A03CE07e51a\",\n \"paymentLimit\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/counterparties", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] }, { "name": "Get a counterparty", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties/:id", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties", ":id" ], "variable": [ { "key": "id", "value": "dc5e5751-3287-46c9-8bd1-83a42ab02699", "description": "The counterparty's id." } ] }, "description": "One counterparty, with up to 20 recent compliance screenings, newest first. An id this workspace does not hold, including another workspace's, answers `404`.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/get-counterparty" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties/:id", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties", ":id" ], "variable": [ { "key": "id", "value": "dc5e5751-3287-46c9-8bd1-83a42ab02699", "description": "The counterparty's id." } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"id\": \"dc5e5751-3287-46c9-8bd1-83a42ab02699\",\n \"name\": \"Anthropic API Services\",\n \"role\": \"vendor\",\n \"address\": \"0x90a5821e8a59b711777c49d11a283c9c76cd811e\",\n \"chain\": \"ARC-TESTNET\",\n \"jurisdiction\": null,\n \"riskLevel\": \"clear\",\n \"riskNotes\": \"No match against watchlist\",\n \"baselinePaymentLimit\": 5,\n \"paymentLimit\": 5,\n \"lastScreenedAt\": \"2026-09-24T18:32:57.327+00:00\",\n \"performanceScore\": 0.667,\n \"performanceInputs\": {\n \"heldOrFlagged\": 0,\n \"heldByOurPolicy\": 1,\n \"riskTierChanges\": 0,\n \"duplicateSubmissions\": 0,\n \"informationRequested\": 0,\n \"paidWithoutIntervention\": 1\n },\n \"createdAt\": \"2026-09-24T11:54:57.677284+00:00\",\n \"screeningHistory\": [\n {\n \"id\": \"d49b558b-199f-46d5-a43e-ae2af3ad9c49\",\n \"riskLevel\": \"clear\",\n \"source\": \"simulated-sanctions-list\",\n \"notes\": \"No match against watchlist\",\n \"rawScore\": null,\n \"matchedEntityId\": null,\n \"screeningMode\": \"simulate\",\n \"status\": \"complete\",\n \"createdAt\": \"2026-09-24T18:32:58.403732+00:00\"\n }\n ]\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties/:id", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties", ":id" ], "variable": [ { "key": "id", "value": "dc5e5751-3287-46c9-8bd1-83a42ab02699", "description": "The counterparty's id." } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties/:id", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties", ":id" ], "variable": [ { "key": "id", "value": "dc5e5751-3287-46c9-8bd1-83a42ab02699", "description": "The counterparty's id." } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "404 not_found", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties/:id", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties", ":id" ], "variable": [ { "key": "id", "value": "dc5e5751-3287-46c9-8bd1-83a42ab02699", "description": "The counterparty's id." } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"not_found\",\n \"message\": \"Counterparty \\\"dc5e5751-3287-46c9-8bd1-83a42ab02699\\\" was not found.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/counterparties/:id", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "counterparties", ":id" ], "variable": [ { "key": "id", "value": "dc5e5751-3287-46c9-8bd1-83a42ab02699", "description": "The counterparty's id." } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] }, { "name": "Create a payee link", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 201 Created\", function () {", " pm.response.to.have.status(201);", "});" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/payee-links", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "payee-links" ] }, "description": "Makes a one-time link where a vendor or contractor enters the address they are paid at, recorded in the ledger as `payee_link_created` with `via: \"api\"` and the key's id. Send `url` to the payee yourself. It is in this answer only, since Vestiarion keeps just its hash, and the answer is sent with `Cache-Control: no-store`. The link works once and expires after 7 days.\n\nThe address the payee enters waits for a person in the workspace to confirm it on Counterparties; until then the agent pays nothing to it. Making a link revokes the payee's unused one, so only the newest works. For the same reason this operation keeps no outcome for an `Idempotency-Key`, which would store the link: a repeat makes a new link. A `counterpartyId` the workspace does not hold, or a client's, answers `400`.\n\n**Key:** a read-and-write key. A read-only key gets `403 forbidden`.\n\nReference: https://www.vestiarion.xyz/docs/api/create-payee-link" }, "response": [ { "name": "201 Created", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/payee-links", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "payee-links" ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"id\": \"0810c2f3-dc6b-487e-aff5-63297ad33813\",\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"url\": \"https://www.vestiarion.xyz/payee/vxp_ExampleOnly_NotARealPayeeLinkToken_Examples\",\n \"expiresAt\": \"2026-10-10T15:42:04.28+00:00\"\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/payee-links", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "payee-links" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"The body must be JSON.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/payee-links", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "payee-links" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/payee-links", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "payee-links" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "429 rate_limited", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/payee-links", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "payee-links" ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Retry-After", "value": "60" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"rate_limited\",\n \"message\": \"Too many writes from this key. Try again in a minute.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"counterpartyId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/payee-links", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "payee-links" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] } ] }, { "name": "Milestones", "item": [ { "name": "List milestones", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only milestones in this status. One of: `pending`, `verified`, `paid`, `held`, `closed`.", "disabled": true }, { "key": "contractorId", "value": "5541f1a4-4e48-4fa5-880c-9ffc97d8953b", "description": "Only milestones for this contractor.", "disabled": true } ] }, "description": "Contractor milestones, newest first, with the row id breaking equal timestamps: how each was verified, and whether it was paid. Only a real `0x` transaction is exposed as `txHash`.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/list-milestones" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only milestones in this status. One of: `pending`, `verified`, `paid`, `held`, `closed`.", "disabled": true }, { "key": "contractorId", "value": "5541f1a4-4e48-4fa5-880c-9ffc97d8953b", "description": "Only milestones for this contractor.", "disabled": true } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": [\n {\n \"id\": \"d01b2b49-2ca3-45fe-898c-f2c0128f6188\",\n \"title\": \"Landing page redesign — milestone 2\",\n \"amount\": 0.9,\n \"status\": \"paid\",\n \"verificationSource\": \"timesheet:kimai\",\n \"verificationMethod\": \"seed\",\n \"verificationStatus\": \"verified\",\n \"verificationCheckedAt\": null,\n \"verifiedAt\": \"2026-09-24T11:54:57.14+00:00\",\n \"verificationDetail\": {\n \"fixture\": true\n },\n \"verified\": true,\n \"decidedAt\": \"2026-09-24T11:55:54.276+00:00\",\n \"settledAt\": \"2026-09-24T11:55:54.276+00:00\",\n \"closedAt\": null,\n \"closeReason\": null,\n \"agentReasoning\": \"Milestone 'Landing page redesign — milestone 2' for 0.9 USDC is verified via timesheet:kimai, contractor Diego Ramirez has riskLevel 'clear' (not high), and the amount 0.9 is below his paymentLimit of 2.5. No duplicate invoice or PO mismatch indicated, and verification source is confirmed, so immediate release is justified rather than deferring to Net-30.\",\n \"txHash\": \"0xa710040ac59af4501a4c91f70287f1fecec1aad037e5d0fc2141fe270f81d969\",\n \"contractor\": {\n \"id\": \"5541f1a4-4e48-4fa5-880c-9ffc97d8953b\",\n \"name\": \"Diego Ramirez — Design Contractor\",\n \"riskLevel\": \"clear\"\n },\n \"createdAt\": \"2026-09-24T11:54:57.933771+00:00\"\n }\n ],\n \"page\": {\n \"nextCursor\": \"eyJrIjoiMjAyNi0wOS0yNFQxMTo1NDo1Ny45MzM3NzErMDA6MDAiLCJpZCI6ImQwMWIyYjQ5LTJjYTMtNDVmZS04OThjLWYyYzAxMjhmNjE4OCJ9\",\n \"hasMore\": true,\n \"count\": 1\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only milestones in this status. One of: `pending`, `verified`, `paid`, `held`, `closed`.", "disabled": true }, { "key": "contractorId", "value": "5541f1a4-4e48-4fa5-880c-9ffc97d8953b", "description": "Only milestones for this contractor.", "disabled": true } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"cursor is not a cursor this API issued.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only milestones in this status. One of: `pending`, `verified`, `paid`, `held`, `closed`.", "disabled": true }, { "key": "contractorId", "value": "5541f1a4-4e48-4fa5-880c-9ffc97d8953b", "description": "Only milestones for this contractor.", "disabled": true } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only milestones in this status. One of: `pending`, `verified`, `paid`, `held`, `closed`.", "disabled": true }, { "key": "contractorId", "value": "5541f1a4-4e48-4fa5-880c-9ffc97d8953b", "description": "Only milestones for this contractor.", "disabled": true } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ], "query": [ { "key": "limit", "value": "50", "description": "How many items to return. Defaults to 50; a larger value is capped at 200.", "disabled": true }, { "key": "cursor", "value": "", "description": "The previous response's `page.nextCursor`, passed back unchanged to continue. Opaque: never decode or construct one. A cursor this endpoint could not have issued is refused with `400`.", "disabled": true }, { "key": "status", "value": "pending", "description": "Only milestones in this status. One of: `pending`, `verified`, `paid`, `held`, `closed`.", "disabled": true }, { "key": "contractorId", "value": "5541f1a4-4e48-4fa5-880c-9ffc97d8953b", "description": "Only milestones for this contractor.", "disabled": true } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] }, { "name": "Add a milestone", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 201 Created\", function () {", " pm.response.to.have.status(201);", "});" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] }, "description": "Adds work a contractor is to be paid for, checked by the rules of the console's Add milestone form, and recorded in the ledger as `create_milestone` with `via: \"api\"` and the key's id. It is added as the key's issuer's: if the agent holds it on its own judgment, someone other than the issuer must choose Pay now, unless the issuer is the workspace's only approver.\n\nIt starts `pending`, and the API cannot verify it. A GitHub pull request in `verificationSource` is checked by the agent, which verifies the milestone once the pull request is merged; any other link is evidence for the person who verifies it on Contractors. Once it is verified, the agent decides the payment with every guardrail, and pays only to the contractor's confirmed address. A `contractorId` the workspace does not hold, or a client's, answers `400`.\n\n**Key:** a read-and-write key. A read-only key gets `403 forbidden`.\n\nReference: https://www.vestiarion.xyz/docs/api/create-milestone" }, "response": [ { "name": "201 Created", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"id\": \"354132aa-e7f6-46f8-ae3c-aa6809f9b9b6\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": 0.1,\n \"status\": \"pending\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\",\n \"verificationMethod\": \"unverified\",\n \"verificationStatus\": \"unverified\",\n \"verificationCheckedAt\": null,\n \"verifiedAt\": null,\n \"verificationDetail\": {},\n \"verified\": false,\n \"decidedAt\": null,\n \"settledAt\": null,\n \"closedAt\": null,\n \"closeReason\": null,\n \"agentReasoning\": null,\n \"txHash\": null,\n \"contractor\": {\n \"id\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"name\": \"API Test Contractor\",\n \"riskLevel\": \"clear\"\n },\n \"createdAt\": \"2026-10-03T15:43:09.204631+00:00\"\n }\n}" }, { "name": "400 invalid_request", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"invalid_request\",\n \"message\": \"The body must be JSON.\"\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "409 conflict", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] } }, "status": "Conflict", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"conflict\",\n \"message\": \"This Idempotency-Key was already used for a different request. Use a new key for a new request.\"\n }\n}" }, { "name": "429 rate_limited", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Retry-After", "value": "60" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"rate_limited\",\n \"message\": \"Too many writes from this key. Try again in a minute.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Idempotency-Key", "value": "ci-bounty-pr-176", "description": "Makes a retry safe: up to 255 printable ASCII characters, unique to the record being added, such as its id in your own system. A repeat with the same key and the same body within 24 hours gets the first answer back, with `Idempotent-Replayed: true`, and adds nothing. The same key with a different body answers `409`." } ], "body": { "mode": "raw", "raw": "{\n \"contractorId\": \"26d6ffed-356d-474a-8d42-89bc942f6b4e\",\n \"title\": \"TypeScript SDK for the API\",\n \"amount\": \"0.10\",\n \"verificationSource\": \"https://github.com/duongnq2798/vestiarion/pull/176\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/v1/milestones", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "milestones" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] } ] }, { "name": "Treasury", "item": [ { "name": "Get the treasury", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/treasury", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "treasury" ] }, "description": "The workspace's accounts and reserve position, its obligations from the latest cycle snapshot, the latest liquidity forecast, and up to 20 recent treasury moves. Obligations stay `null` before any snapshot exists; the API does not invent zeroes.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/get-treasury" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/treasury", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "treasury" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"accounts\": [\n {\n \"id\": \"55ce33e5-4b1c-47e6-838b-2446b80300c7\",\n \"name\": \"Base Client Wallet\",\n \"kind\": \"chain\",\n \"chain\": \"BASE-SEPOLIA\",\n \"token\": \"USDC\",\n \"address\": \"0x4d10b4076a4975650e80d087fc9c99610ca76266\",\n \"balance\": 0,\n \"apy\": 0\n },\n {\n \"id\": \"6f32681d-2f32-4db2-9841-c44f9be25965\",\n \"name\": \"Arc Operating Wallet\",\n \"kind\": \"operating\",\n \"chain\": \"ARC-TESTNET\",\n \"token\": \"USDC\",\n \"address\": \"0x2fafdda3f973e8f993911f1c2196d5e72d51d71d\",\n \"balance\": 22.765,\n \"apy\": 0\n },\n {\n \"id\": \"02a3c356-9571-4d5e-992a-5672dedba590\",\n \"name\": \"USYC Reserve\",\n \"kind\": \"reserve\",\n \"chain\": \"ARC-TESTNET\",\n \"token\": \"USYC\",\n \"address\": \"0x8c99d5b1ee35e7d02887f5064a1b3f1a78a0ab66\",\n \"balance\": 0,\n \"apy\": 0.045\n }\n ],\n \"reservePosition\": 0,\n \"obligations\": {\n \"asOf\": \"2026-09-24T18:33:03.344+00:00\",\n \"dueWithin7Days\": 11.2,\n \"dueWithin14Days\": 11.2\n },\n \"latestForecast\": {\n \"id\": \"73400ece-0f38-4695-9bad-3816650b71fb\",\n \"asOf\": \"2026-09-24T18:33:03.226+00:00\",\n \"horizonDays\": 14,\n \"projectedInflow\": 9,\n \"projectedOutflow\": 11.2,\n \"liquidBalance\": 22.765,\n \"recommendation\": \"Liquidity healthy.\"\n },\n \"recentActions\": []\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/treasury", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "treasury" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/treasury", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "treasury" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/treasury", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "treasury" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] } ] }, { "name": "Insights", "item": [ { "name": "Get insights", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"answers 200 OK\", function () {", " pm.response.to.have.status(200);", "});" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/insights", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "insights" ] }, "description": "The telemetry behind the Insights page: recent transfers, cycle runs, cycle snapshots, treasury moves and screenings. `referenceDisagreementCount: null` means the cycle predates the comparison, and `status: \"partial\"` is reported as it is, not rewritten as completed or failed.\n\n**Key:** any workspace API key; a read-only one is enough.\n\nReference: https://www.vestiarion.xyz/docs/api/get-insights" }, "response": [ { "name": "200 OK", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/insights", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "insights" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"data\": {\n \"transfers\": [\n {\n \"id\": \"359e82e1-958d-4327-9174-e0b885eebe8f\",\n \"targetType\": \"invoice\",\n \"targetId\": \"1d7e1714-3f84-493e-a3ea-c984a2881100\",\n \"txRef\": \"0x36ea71ac97cad3743f227860785207e6f25148251735569be0f6b16c73130343\",\n \"feeUsd\": 0.003248,\n \"feeSource\": \"chain_reported\",\n \"settledInMs\": 5000,\n \"chain\": \"ARC-TESTNET\",\n \"providerMode\": \"live\",\n \"executedAt\": \"2026-09-24T11:55:24.131+00:00\",\n \"status\": \"confirmed\"\n }\n ],\n \"runs\": [\n {\n \"id\": \"8cbcf6ca-2d58-43c9-9237-3000851e7046\",\n \"startedAt\": \"2026-09-24T11:53:06.672+00:00\",\n \"finishedAt\": \"2026-09-24T11:53:16.101+00:00\",\n \"durationMs\": 9429,\n \"decisionCount\": 1,\n \"paidCount\": 0,\n \"heldCount\": 0,\n \"flaggedCount\": 0,\n \"awaitingInfoCount\": 0,\n \"releasedCount\": 0,\n \"modelDecisionCount\": 1,\n \"heuristicDecisionCount\": 0,\n \"guardrailOverrideCount\": 0,\n \"referenceDisagreementCount\": null,\n \"status\": \"completed\",\n \"failedStage\": null,\n \"errorMessage\": null,\n \"chainMode\": \"live\",\n \"screeningMode\": \"simulate\"\n },\n {\n \"id\": \"bd76f653-4352-42b3-aec5-5ddbbe01c882\",\n \"startedAt\": \"2026-09-24T15:22:50.871+00:00\",\n \"finishedAt\": \"2026-09-24T15:23:00.617+00:00\",\n \"durationMs\": 9746,\n \"decisionCount\": 0,\n \"paidCount\": 0,\n \"heldCount\": 0,\n \"flaggedCount\": 0,\n \"awaitingInfoCount\": 0,\n \"releasedCount\": 0,\n \"modelDecisionCount\": 0,\n \"heuristicDecisionCount\": 0,\n \"guardrailOverrideCount\": 0,\n \"referenceDisagreementCount\": 0,\n \"status\": \"partial\",\n \"failedStage\": \"ap\",\n \"errorMessage\": \"ap: AGENT_LLM_PROVIDER=openai but OPENAI_API_KEY is not set; treasury: AGENT_LLM_PROVIDER=openai but OPENAI_API_KEY is not set\",\n \"chainMode\": \"live\",\n \"screeningMode\": \"simulate\"\n }\n ],\n \"snapshots\": [\n {\n \"id\": \"352d94e4-a945-420f-a933-34b06b46412b\",\n \"cycleRunId\": \"8cbcf6ca-2d58-43c9-9237-3000851e7046\",\n \"capturedAt\": \"2026-09-24T11:53:16.101+00:00\",\n \"totalLiquid\": 27.58,\n \"openPayables\": 10.695,\n \"openReceivables\": 9,\n \"obligationsDue7d\": 12.195,\n \"obligationsDue14d\": 12.195,\n \"reservePosition\": 0,\n \"chainMode\": \"live\"\n }\n ],\n \"treasuryMoves\": [],\n \"screenings\": [\n {\n \"id\": \"54d6f2a8-d939-45ef-a41e-61f88fd362ae\",\n \"counterpartyId\": \"dc5e5751-3287-46c9-8bd1-83a42ab02699\",\n \"counterpartyName\": \"Anthropic API Services\",\n \"riskLevel\": \"clear\",\n \"previousRiskLevel\": null,\n \"tierChanged\": false,\n \"mode\": \"simulate\",\n \"source\": \"simulated-sanctions-list\",\n \"status\": \"complete\",\n \"createdAt\": \"2026-09-24T11:55:11.147351+00:00\"\n }\n ]\n }\n}" }, { "name": "401 unauthorized", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/insights", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "insights" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"unauthorized\",\n \"message\": \"A valid API key is required.\"\n }\n}" }, { "name": "403 forbidden", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/insights", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "insights" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"forbidden\",\n \"message\": \"This key cannot do that.\"\n }\n}" }, { "name": "500 internal", "originalRequest": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/v1/insights", "host": [ "{{baseUrl}}" ], "path": [ "api", "v1", "insights" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "body": "{\n \"error\": {\n \"code\": \"internal\",\n \"message\": \"The request could not be completed.\"\n }\n}" } ] } ] } ] }