/api/v1/graphql, and the token decides whose account you’re operating on.
Endpoints
Access tokens are minted at the same endpoint via the
generateUserAccessToken mutation, authorized with your API Key — see Authentication.
Anatomy of a request
query— the GraphQL document. Use named operations (query GetSpendAccount) for better logs.variables— typed inputs, keeping values out of the query string.operationName— optional, useful when a document defines multiple operations.
Queries vs. mutations
- Queries are read-only (
viewer,wallet,transactions). - Mutations change state (
createVirtualCard,purchaseGiftCard,depositCashBalance,createTransfer).
Response format
A query that runs returns HTTP 200 with adata / errors envelope, including when it fails with an application error:
data may be null and errors will describe what went wrong — including a machine-readable code you can branch on. See Errors.
A variable whose value doesn’t match its declared type also returns 200, with BAD_USER_INPUT. Other requests rejected before they run get a different status, for example 429 from the rate limiter or 400 for a query over the query cost limits.
Introspection and schema
Introspection is enabled in staging so you can point tools like Apollo Studio or GraphiQL at the endpoint. In live, introspection is disabled; use the published schema from API reference instead.Next steps
Authentication
How the token in that
Authorization header gets minted — for your account or a customer’s.Errors
What the
errors array contains and how to branch on error codes.