Skip to main content
The VEXiON cards API is built on REST principles. Always call it over HTTPS.

​
How a request flows

Every call passes a few gates before your endpoint runs. The first gate that fails decides the response, so knowing the order makes every response code on this page predictable.
  • IP throttle. Floods and repeated failed sign-ins from one IP address get 429 before your key is read. See Rate Limits.
  • Plan and account state. API access is included in every plan except VEXiON ONE. An organization that is paused (hibernating), locked, cancelled or not yet active gets 403 on every call. GET /v1/organization is the exception: it always answers, so a blocked integration can read account_state and find out why.
  • Scope. Each endpoint needs a scope on the key. A missing scope is a 403.
  • Rate limit. Each key has its own budget per endpoint. See Rate Limits.
The Errors page lists the full order, including request validation. Every response carries a Vexion-Request-Id. Every error response uses the standard error envelope, so failures are always traceable and machine-readable.

​
Base URL

All requests use this base URL:

​
Authentication

Every request requires an Authorization header with a Bearer API key:
Get your API key from Dashboard → Settings → Developer. Keys are created by organization admins, on every plan except VEXiON ONE, after accepting the API terms. A key that is not used for 90 days is revoked automatically, unless that option is switched off for the key. Key format: a production key looks like vxn_sk_<suffix> and a sandbox key looks like vxn_test_sk_<suffix>, so you can always tell which environment a key belongs to. Build against the sandbox first; see Testing and environments.
API keys are secret. Never commit them, log them, or put them in client-side code.

​
User-Agent

Every request should include a User-Agent header identifying your integration:
Requests without a User-Agent are still accepted.

​
Response codes

The API uses standard HTTP status codes: See the Errors page for the error envelope.

​
Response headers

Vexion-Request-Id is on every response. The X-RateLimit-* headers are on responses to authenticated requests that reach a rate-limited endpoint. They are not on 401, on 403, or on a pre-authentication 429. Idempotent-Replayed appears only on a replayed response.

​
Request IDs

If something goes wrong, grab the Vexion-Request-Id header from your failed request and include it when contacting support@vexioncards.one. We can trace the exact request across our systems from that ID. The same value is also sent as x-request-id, for HTTP clients that read that header by default, but Vexion-Request-Id remains the documented, canonical header to use.

​
For AI agents and assistants

  • MCP server. AI assistants such as Claude and ChatGPT can work with your account through the VEXiON MCP server. See MCP server.
  • Machine-readable docs. These docs serve /llms.txt and /openapi.json for AI tools and code generators. The API host (api.vexioncards.one) does not serve /openapi.json.

​
Next steps

Quickstart

Make your first authenticated call in a few minutes.

Testing and environments

Build against the sandbox before you touch production data.

Errors

The error envelope and every code the API can return.

Rate limits

Limits, headers, and how to back off cleanly.

Idempotency

Retry writes without creating duplicates.

Webhooks

Receive events instead of polling.