Machine-readable contract

OpenAPI specification

The complete, versioned contract for the Vestavero public API — every endpoint, envelope, error code, and rate-limit header, exactly as the machine serves it. Read-only by design: version 1 exposes no public write handler.

DocumentVestavero APIServed verbatim from the API

API version1.1.0Versioned JSON over HTTPS

OpenAPI3.1.0Specification format

Write handlers0Reads only, fail closed

Authentication summary

Public reads, scoped keys

Public verification may be called without a key. Configured commercial access uses X-API-Key; keys are read-scoped, displayed once, stored only as SHA-256 digests, and fail closed when invalid, suspended, revoked, or expired. Responses carry rate-limit headers and a request ID.

/api/v1/openapi.json

View raw specification →

The raw document is served for machines and renders as plain JSON when opened directly — that is expected. For human-readable reference, use the developer documentation →