Reference

Go live

Before you point the system at real customers.

Server

  • NTP on. Skew > 300s drops every call (request_timestamp_skew).
  • Stable egress IP on the allowlist. NAT change: register the new CIDR, wait 18h, then change routing.
  • One process (or lock) requesting tokens: reuse until near expires_in. Not one token per request.

Private key

  • Out of the repository, Docker image and logs.
  • Restricted to the service that signs.
  • Rotation plan rehearsed: new key → 18h → switch kid → retire the old one. See Keys and IPs.
  • The last usable key is never deleted (409 last_public_key).

Calls

  • Host https://client.api.corpx.com on every /v1/** route
  • POST /v1/security/signature/verify with valid: true in the real environment, once, before the first payment
  • Idempotency-Key on every write that moves money; the same key does not change the body
  • No X-Transaction-Pin / X-Acting-Document
  • No legacy POST /v1/pix-out

Webhooks

  • HTTPS, HMAC, raw body
  • accountId on the subscription
  • Fast 2xx; queue for heavy work
  • The same eventId handled once (redelivery happens)
  • You can list deliveries and retry (GET/POST .../webhooks/{id}/deliveries)

Operations

  • The holder knows hour locks and outgoing blocks apply to the API. You read GET .../security/locks and handle cashout_locked / cashout_outside_hours
  • Sync PIX with the rate cap in mind; high volume uses /pix/out/async
  • Advanced statement is not on a cron
  • Runbook: expired token, unknown_kid, refused IP, stuck webhook
  • Bank channel noted for credential, IP and locks

Contract

Paths and schemas: /openapi/ib.yaml, only the operations this credential can call. Postman collection: ib.json (baseUrl already points at client.api.corpx.com; fill in tenantId, token and, per request, requestSignature).