> ## Documentation Index > Fetch the complete documentation index at: https://docs.rheon.io/llms.txt > Use this file to discover all available pages before exploring further. # What this key may use > One section per product - `crypto` (the catalogue of chains and tokens, narrowed to the calling key), `card`, `bank`, `virtualAccounts` - plus the key's own `products` and `maxExecutionUsd`. Call it first and build your corridor list from it instead of keeping a copy. A product section is present only when that vertical is configured on this deployment; whether YOUR key may call it is `products`. ## OpenAPI ````yaml https://backend.rheon.io/openapi.json get /v1/config openapi: 3.1.0 info: title: Rheon partner API version: 1.0.0 description: >- The /v1 surface a partner's backend calls with an API key. **Authentication.** Every route takes `Authorization: Bearer `. One kind of key: it carries its permissions and limits, and works from your server, a page, or this playground alike - where it is called from is not checked. Treat it as a secret all the same: anyone holding it acts under its permissions until it is rotated. **Rate limit.** Counted per key, at the requests-per-second rate configured on the key - never per IP, so your users do not throttle each other. Over it: `429 rate_limited`. **Amounts.** Token amounts are decimal strings in the token's smallest unit; fiat amounts are decimal strings in major units. Never JSON numbers. **Errors.** One envelope everywhere: `{ error: { code, message } }`, with `fields` added on bank refusals that named a field. A body that is not valid JSON answers `400 invalid_request`; an endpoint that does not exist answers `404 not_found`; a deployment with no partner keys configured answers `404 not_configured` for all of /v1. **Environment.** Every response carries `environment` as its first field: `sandbox` or `production`, derived from the upstreams this deployment is configured against (never a flag). Read it off any response you paste into a ticket. In `sandbox` no real money moves and the card corridor is the provider's sandbox asset, which differs from production - read it from GET /v1/config, not from these docs. **Card corridor.** The asset and chain a card purchase settles as are fixed per deployment, not chosen per request. GET /v1/config reports the one actually configured. servers: - url: https://api.rheon.io description: Production security: - bearerAuth: [] tags: - name: Configuration - name: Crypto deposits - name: Orders - name: Cards - name: Bank transfers - name: Virtual accounts - name: Reference - name: Sandbox only paths: /v1/config: get: tags: - Configuration summary: What this key may use description: >- One section per product - `crypto` (the catalogue of chains and tokens, narrowed to the calling key), `card`, `bank`, `virtualAccounts` - plus the key's own `products` and `maxExecutionUsd`. Call it first and build your corridor list from it instead of keeping a copy. A product section is present only when that vertical is configured on this deployment; whether YOUR key may call it is `products`. operationId: getConfig responses: '200': description: What this key may use, by product. content: application/json: schema: $ref: '#/components/schemas/ConfigResponse' '401': description: >- No usable API key. - `unauthorized`: Missing, malformed or unknown key. One undifferentiated answer on purpose. x-error-codes: - unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '403': description: >- Refused by permission. - `permission_denied`: The key does not carry the `deposits` permission. x-error-codes: - permission_denied content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '429': description: >- Over this key's rate. - `rate_limited`: More requests per second than the key is configured for. Counted PER KEY (all your users share one bucket), never per IP. x-error-codes: - rate_limited content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' security: - bearerAuth: [] components: schemas: ConfigResponse: type: object properties: environment: $ref: '#/components/schemas/Environment' products: type: array items: type: string enum: - deposits - cards - bank - virtual-accounts description: >- The products THIS key may call, exactly as granted: deposits (the crypto product), cards, bank, virtual-accounts. A product not listed answers 403 permission_denied on its endpoints. Keys issued before per-product permissions carry deposits only. example: - deposits - cards maxExecutionUsd: anyOf: - type: integer exclusiveMinimum: 0 maximum: 9007199254740991 - type: 'null' description: >- This key's execution ceiling: the largest transfer it may BUILD, in USD (the catalogue is USD-pegged stablecoins). null means no ceiling. Quoting is never capped; over it, /v1/deposit/transaction answers 403 execution_capped. example: null crypto: $ref: '#/components/schemas/ConfigCrypto' card: $ref: '#/components/schemas/ConfigCardCorridor' description: >- The configured card corridor. Absent when this deployment has no card vertical configured (the /v1/card/* lookups answer 503 not_configured there). bank: $ref: '#/components/schemas/ConfigBankCorridor' description: >- The configured bank corridor. Absent when this deployment has no bank vertical configured. virtualAccounts: $ref: '#/components/schemas/ConfigVirtualAccounts' description: >- The virtual-account product. Absent when this deployment has no bank vertical configured (virtual accounts open on the bank corridor). required: - environment - products - maxExecutionUsd - crypto additionalProperties: false description: >- What this key may use and how each product is configured here: the key's products and ceiling, then one section per product - crypto (the catalogue narrowed to the key), card, bank, virtualAccounts. A product section is present only when that vertical is configured on this deployment; presence says nothing about the key's permission (read `products` for that). ErrorEnvelope: type: object properties: environment: $ref: '#/components/schemas/Environment' error: type: object properties: code: type: string description: >- Machine-readable error code. Branch on this, never on the message. example: invalid_request message: type: string description: Human-readable explanation. Wording may change. example: amount must be a decimal string of the token's smallest unit. fields: description: >- Per-field complaints from the bank provider, when it named the field it refused (bank routes only). Field names, never values. example: applicantInfo.nationality: iso3166_1_alpha2 type: object propertyNames: type: string additionalProperties: type: string required: - code - message additionalProperties: false required: - environment - error additionalProperties: false description: The one error shape this API produces. Environment: type: string enum: - sandbox - production description: >- Which environment answered. `sandbox`: at least one money upstream is the provider's sandbox - no real money moves there, and the card corridor is the sandbox's asset (read GET /v1/config), not the documented production one. `production`: every configured upstream is real. Derived from the configured upstream hosts at boot, never a flag. example: sandbox ConfigCrypto: type: object properties: chains: type: array items: $ref: '#/components/schemas/ConfigChain' description: >- One entry per chain the key may use on at least one side. A chain the key can name no token on is dropped entirely. required: - chains additionalProperties: false description: 'The crypto deposit product: the catalogue narrowed to the calling key.' ConfigCardCorridor: type: object properties: cryptoCurrency: type: string description: >- The one asset a card purchase settles as here. Compare card responses and your `cryptoCurrency` parameters against THIS, not the docs. example: ETH network: type: string description: The network it lands on, as the card provider names it. example: arbitrum required: - cryptoCurrency - network additionalProperties: false description: The card corridor this deployment is configured with. ConfigBankCorridor: type: object properties: fiatCurrency: type: string description: ISO 4217 currency a bank transfer is received in here. example: EUR fiatRail: type: string description: >- The bank rail the transfer arrives on, as the bank provider names it. example: bank_sepa cryptoCurrency: type: string description: The asset a bank transfer settles as on the linked wallet. example: USDC network: type: string description: >- The network it lands on, as the bank provider names it. On the provider's sandbox this is a testnet (e.g. base-sepolia). example: base-sepolia required: - fiatCurrency - fiatRail - cryptoCurrency - network additionalProperties: false description: The bank corridor this deployment is configured with. ConfigVirtualAccounts: type: object properties: fiatCurrency: type: string description: The currency a virtual account opened here is denominated in. example: EUR readBack: type: boolean description: >- Whether GET /v1/virtual-accounts and GET /v1/virtual-accounts/{id} answer on this deployment. false: they answer 501 not_implemented - keep the details returned at creation. example: true required: - fiatCurrency - readBack additionalProperties: false description: The virtual-account product as configured on this deployment. ConfigChain: type: object properties: id: $ref: '#/components/schemas/ChainId' name: type: string example: Arbitrum One source: type: boolean description: Whether this key may pay FROM this chain. destination: type: boolean description: Whether this key may settle ON this chain. explorerTxUrl: type: string description: >- Block-explorer transaction URL prefix - append a tx hash to get a link. example: https://arbiscan.io/tx/ tokens: type: array items: $ref: '#/components/schemas/CatalogueToken' description: Tokens this key may name on this chain (never empty). required: - id - name - source - destination - explorerTxUrl - tokens additionalProperties: false ChainId: type: integer exclusiveMinimum: 0 maximum: 9007199254740991 description: EVM chain id, a positive integer (e.g. 42161 for Arbitrum One). example: 42161 CatalogueToken: type: object properties: symbol: type: string example: USDC name: type: string example: USD Coin address: $ref: '#/components/schemas/EvmAddress' description: >- Token contract address on this chain, checksummed. Match on this, never on symbol. example: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831' decimals: type: integer minimum: -9007199254740991 maximum: 9007199254740991 description: Decimal places one unit carries. example: 6 required: - symbol - name - address - decimals additionalProperties: false EvmAddress: type: string pattern: ^0x[0-9a-fA-F]{40}$ description: >- EVM address: 0x followed by 40 hex characters. Checksum casing is not required. example: '0x1111111111111111111111111111111111111111' securitySchemes: bearerAuth: type: http scheme: bearer description: Your API key, issued by us and shown once at creation. ````