Base URLs
Test keys use the
rmf_test_ prefix; live keys use rmf_live_. Both work against the same base URL — environment is encoded in the key, not the hostname.Versioning
All routes are prefixed with/v1. Breaking changes will ship under a new version path with advance notice.
HTTPS
Production requests must use HTTPS. Plain HTTP is only appropriate for local development.Request format
Send JSON bodies withContent-Type: application/json on POST requests.
Response format
All responses use a consistent envelope. Success (2xx):422) include an errors object with per-field messages.
Each endpoint in the API reference documents its response shape under Response — field names, types, and the status / message / data envelope. Discovery endpoints return network keys and symbols only (no internal chain IDs).
Authentication
Business endpoints accept either:
See Authentication.
Idempotency
API-key mutating requests requireIdempotency-Key. See Idempotency.
Rate limits
Global limit: 200 requests per 15 minutes per IP. Auth endpoints have a stricter limit of 20 per 15 minutes. When exceeded, the API returns429 Too Many Requests.
Health check
GET /health (no /v1 prefix, no auth):
Path IDs
Path placeholders are named RemitFlex UUIDs — not provider ids, wallet addresses, or bank account numbers.
OpenAPI path parameters use the same names and describe which resource each refers to.
Available resources
Browse the API Reference tab in the sidebar for interactive endpoint documentation and the API playground.
JWT-only routes (not in API reference)
/v1/auth/*— dashboard login and signup/v1/api-keys/*— key management/v1/admin/ops/*— RemitFlex internal ops only (not a merchant API)