Skip to main content
The Orchestra API accepts JSON requests at https://orchestration.flashnet.xyz.

​
Conventions

  • Request bodies are JSON. Any other content type returns 415 unsupported_media_type.
  • Bodies are capped at 1 MiB. Larger requests return 413 payload_too_large.
  • API errors normally return { "error": { "code": "...", "message": "..." } }; attestation has a separate response shape. See Errors.
  • Amounts are integer strings in the asset’s smallest unit.
  • This reference is generated from the official OpenAPI 3.1 document. Swagger UI is also available.

​
Idempotency

Every mutating endpoint called with a partner key requires an X-Idempotency-Key header of 1 to 255 printable ASCII characters. A UUID works. Server-key requests are scoped to (partnerId, endpoint, key), so the same string on two endpoints is two keys. Client requests also include the API-key ID and caller IP in the scope; changing either does not preserve the same replay guarantee. Replaying a request with the same key and body returns the stored response with X-Idempotency-Replayed: true. The same key with a different body returns 409 idempotency_conflict. A replay while the original is still executing returns 409 idempotency_in_progress with a Retry-After header; wait and retry with the same key. Reuse the key after a timeout or 5xx response. Handler-produced 4xx responses are cached: after a definitive rejection, correcting the request or retrying with newly available deposit evidence is a new attempt and needs a new key. Keep the original funding transaction; do not send funds again.

​
Endpoint groups

Pay links and SSE have prose references; they are not in the OpenAPI document. Authentication, key types, and scopes are on Authentication. Per-endpoint request quotas are on Rate limits.