REST API

Every stackin capability is reachable over a documented, versioned REST API — JSON requests and responses, authenticated with a single Bearer API key tied to one company and one environment (homologation or production).

This is the same contract the official SDKs are built on top of, so anything the SDK can do, the raw API can do too — useful for languages without an official client yet, or integrations that would rather not add a dependency.

Pagination is uniform across every list endpoint: offset/limit in the request (default limit=20, max 100), plus sort_by/order_by for ordering; the response comes back with total, page, per_page, total_pages, next_page, and prev_page — one pagination helper covers issuance history no matter how large the company's volume gets.

Errors map to real HTTP status codes, with a JSON body — {"detail": "..."} in most cases, except 502, which has its own shape. 400 is missing company configuration (usually a missing certificate); 401 is a missing, rotated, or unsent key; 402 is exhausted plan quota (only issuance/reissuance consume it — cancellation and consultation are free); 409 is an operation the document's current state doesn't allow (cancelling something already cancelled, for instance); 422 is validation with the offending field named in the body; 501 is a document type not yet wired for signing on that flow; 502 is the government authorizer rejecting or failing to process — the only one carrying the authorizer's own code/message, since that's the information that decides whether the fix is on your data or on retrying later.

There's no separate "SDK-only" functionality hidden behind the client libraries — the SDKs exist for typing, retries, and ergonomics, not to unlock capability the raw API doesn't have.

See the full API reference for authentication, pagination, error codes, and every endpoint.