> ## Documentation Index > Fetch the complete documentation index at: https://docs.rheon.io/llms.txt > Use this file to discover all available pages before exploring further. # Per-transfer ceilings by currency and rail > Bank rails only: the deposit path has no fixed ceiling, it is bounded by live route liquidity (the quote's no_route). A null `min` or `max` means the bank provider publishes no fixed figure for that rail - not that the figure is unknown to us. `settlement` is settlement TIME in the provider's t+N notation (see the field), not a status. ## OpenAPI ````yaml https://backend.rheon.io/openapi.json get /v1/limits openapi: 3.1.0 info: title: Rheon partner API version: 1.0.0 description: >- The /v1 surface a partner's backend calls with an API key. **Authentication.** Every route takes `Authorization: Bearer `. One kind of key: it carries its permissions and limits, and works from your server, a page, or this playground alike - where it is called from is not checked. Treat it as a secret all the same: anyone holding it acts under its permissions until it is rotated. **Rate limit.** Counted per key, at the requests-per-second rate configured on the key - never per IP, so your users do not throttle each other. Over it: `429 rate_limited`. **Amounts.** Token amounts are decimal strings in the token's smallest unit; fiat amounts are decimal strings in major units. Never JSON numbers. **Errors.** One envelope everywhere: `{ error: { code, message } }`, with `fields` added on bank refusals that named a field. A body that is not valid JSON answers `400 invalid_request`; an endpoint that does not exist answers `404 not_found`; a deployment with no partner keys configured answers `404 not_configured` for all of /v1. **Environment.** Every response carries `environment` as its first field: `sandbox` or `production`, derived from the upstreams this deployment is configured against (never a flag). Read it off any response you paste into a ticket. In `sandbox` no real money moves and the card corridor is the provider's sandbox asset, which differs from production - read it from GET /v1/config, not from these docs. **Card corridor.** The asset and chain a card purchase settles as are fixed per deployment, not chosen per request. GET /v1/config reports the one actually configured. servers: - url: https://api.rheon.io description: Production security: - bearerAuth: [] tags: - name: Configuration - name: Crypto deposits - name: Orders - name: Cards - name: Bank transfers - name: Virtual accounts - name: Reference - name: Sandbox only paths: /v1/limits: get: tags: - Reference summary: Per-transfer ceilings by currency and rail description: >- Bank rails only: the deposit path has no fixed ceiling, it is bounded by live route liquidity (the quote's no_route). A null `min` or `max` means the bank provider publishes no fixed figure for that rail - not that the figure is unknown to us. `settlement` is settlement TIME in the provider's t+N notation (see the field), not a status. operationId: limits parameters: - in: query name: currency schema: description: >- Filter to one ISO 4217 currency (case-insensitive). Omit for every row. example: EUR type: string pattern: ^[A-Za-z]{3}$ description: >- Filter to one ISO 4217 currency (case-insensitive). Omit for every row. responses: '200': description: The rows, optionally filtered. content: application/json: schema: $ref: '#/components/schemas/LimitsResponse' '400': description: |- Cannot filter by that. - `invalid_request`: currency is present but not three letters. x-error-codes: - invalid_request content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '401': description: >- No usable API key. - `unauthorized`: Missing, malformed or unknown key. One undifferentiated answer on purpose. x-error-codes: - unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '429': description: >- Over this key's rate. - `rate_limited`: More requests per second than the key is configured for. Counted PER KEY (all your users share one bucket), never per IP. x-error-codes: - rate_limited content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' security: - bearerAuth: [] components: schemas: LimitsResponse: type: object properties: environment: $ref: '#/components/schemas/Environment' limits: type: array items: $ref: '#/components/schemas/TransferLimit' required: - environment - limits additionalProperties: false ErrorEnvelope: type: object properties: environment: $ref: '#/components/schemas/Environment' error: type: object properties: code: type: string description: >- Machine-readable error code. Branch on this, never on the message. example: invalid_request message: type: string description: Human-readable explanation. Wording may change. example: amount must be a decimal string of the token's smallest unit. fields: description: >- Per-field complaints from the bank provider, when it named the field it refused (bank routes only). Field names, never values. example: applicantInfo.nationality: iso3166_1_alpha2 type: object propertyNames: type: string additionalProperties: type: string required: - code - message additionalProperties: false required: - environment - error additionalProperties: false description: The one error shape this API produces. Environment: type: string enum: - sandbox - production description: >- Which environment answered. `sandbox`: at least one money upstream is the provider's sandbox - no real money moves there, and the card corridor is the sandbox's asset (read GET /v1/config), not the documented production one. `production`: every configured upstream is real. Derived from the configured upstream hosts at boot, never a flag. example: sandbox TransferLimit: type: object properties: currency: type: string example: EUR rail: type: string example: sepa_instant direction: type: string enum: - pay_in - payout - both max: description: >- Per-transfer ceiling, decimal string in major units of `currency`. null means the bank provider publishes no fixed ceiling for this rail: there is no number to check against, and a transfer is bounded only by the provider's own acceptance at the time. Not "unknown" and not "zero". example: '100000' type: - string - 'null' min: description: >- Per-transfer minimum, decimal string in major units of `currency`, where the rail has one. null means the bank provider publishes no minimum for this rail - most rails have none. example: null type: - string - 'null' settlement: type: string description: >- Settlement time: how long after the transfer is sent the money settles, in the bank provider's notation. `instant`: seconds. `t+N`: N business days after the send day (`t+0` = same day, `t+1` = next business day). A range `a..b` spans the typical best and worst case, e.g. `t+1..t+3` = one to three business days, `instant..t+1` = usually instant, up to the next business day. `under_2h`: within two hours. This is the rail's published timing, not a guarantee. example: t+1..t+3 required: - currency - rail - direction - max - min - settlement additionalProperties: false securitySchemes: bearerAuth: type: http scheme: bearer description: Your API key, issued by us and shown once at creation. ````