---
updatedAt: 2026-09-08T09:37:43.000Z
agentTools:
  projectIndex: https://docs.bridgeapi.io/llms.txt
---

# API basics

## Requests

### Base URL

All API access is conducted over HTTPS and is accessible from the `api.bridgeapi.io/v3` domain.<br />Any non-secure requests will automatically redirect (HTTP 301) to the equivalent HTTPS URI.

### HTTP verbs

Bridge API follows RESTful design patterns. Our API implements following HTTP verbs:

* `GET` - Read resources
* `POST` - Create new resources
* `PUT` - Modify existing resources
* `DELETE` - Remove resources

### HTTP headers

Our API implements following HTTP headers on every endpoint:

* `Client-Id` - Your Bridge application client id (see [API credentials](https://docs.bridgeapi.io/update/docs/api-credentials))
* `Client-Secret` - Your Bridge application client secret (see [API credentials](https://docs.bridgeapi.io/update/docs/api-credentials))
* `Bridge-Version` -  `2025-01-15`

## HTTP status codes

All responses follow standard HTTP status codes.<br />Typically, codes in the 2xx range signify success, codes in the 4xx range are for client-related issues, and 5xx codes are reserved for Bridge-related problems (which are rare).

* `200 OK` Successful request.
* `201 Created` New resource created.
* `202 Accepted` The request has been accepted for processing, but the processing has not been completed.
* `204 No Content` Resource deleted.
* `400 Bad Request` The request is malformed. Check the parameters or the syntax.
* `401 Unauthorized` Couldn’t authenticate the request.
* `403 Forbidden` The request is not allowed.
* `404 Not Found` No such resource.
* `409 Conflict` The resource already exists.
* `415 Unsupported media type` The resource requires `Content-Type: application/json` header and a JSON body.
* `422 Unprocessable entity` The provided JSON is not valid.
* `429 Too Many Requests` Too many requests hit the API too quickly. See [Rate limits](https://docs.bridgeapi.io/docs/basics#rate-limits).
* `500 Internal Server Error` Something went wrong on our end (these are rare).

### Errors

|                            |                                       |
| :------------------------- | :------------------------------------ |
| **code**<br />*string*     | Error code                            |
| **property**<br />*string* | Property or parameter that is invalid |
| **message**<br />*string*  | Human-readable error description      |

```json
{
	"code": "invalid_client_credentials",
	"message": "client_id and client_secret are invalid",
}
```

## Rate limits

Bridge API enforces rate limits with the following pattern:

* 3000 requests per Application within a 5-minute period

* 60 requests per User within a 60-second period

* 10 `/authenticate` requests per User within a 60-second period

* 4 Connect Sessions by 24-hour period (including the one created during User Management Sessions)

* 60 `/transactions/{transactionId}/attachments/{attachmentId}` requests within a 60-second period

* Additional undisclosed limits apply to endpoints that do not require authentication

<Callout icon="📘" theme="info">
  ### Raising the rate limit

  For large applications, the rate limit of 3000 requests per 5 minutes can be increased. Please contact our support team if you require this adjustment.
</Callout>

The following headers are returned in case of rate limit:

```text
X-RateLimit-Remaining
X-RateLimit-Requested-Tokens
X-RateLimit-Burst-Capacity
X-RateLimit-Replenish-Rate
```

## Timestamps and dates

All timestamps are provided in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format with millisecond precision : `yyyy-MM-ddTHH:mm:ss.SSSZ`<br />Dates are returned in the format: `yyyy-MM-dd`

## Pagination

All endpoints that return a list of objects support pagination, with pagination information available within a pagination object.

Bridge uses a cursor-based pagination via the `after` parameter.

<Callout icon="❗️" theme="error">
  Do not forge or store the `after` cursors, as they may change over time.
</Callout>

<Callout icon="📘" theme="info">
  By default, all objects are ordered and paginated in reverse chronological order, with a default limit of 50.
</Callout>

### Options

|                        |                                                                        |
| :--------------------- | :--------------------------------------------------------------------- |
| `limit`<br />*integer* | Number of results per call. Accepted values: 1 - 500.<br />Default 50. |
| `after`<br />*string*  | Cursor pointing to the start of the desired set.                       |

### Response

Paginated results are always returned in an array and include pagination information in the `pagination` object:

|            |                                                                                                                                                                                       |
| :--------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `next_uri` | To make it easier, the API will build the next call into `next_uri` together with all the current pagination parameters.<br />Can be `null` if there are no more results in the list. |

```curl Request example
curl "https://api.bridgeapi.io/v3/transactions?limit=2" \
	-X GET \
	-H 'Bridge-Version: 2025-01-15' \
	-H 'Client-Id: MY_CLIENT_ID' \
	-H 'Client-Secret: MY_CLIENT_SECRET' \
	-H 'Authorization: Bearer TOP_SECRET_ACCESS_TOKEN'
```

```json Response example
{  
	"resources": [
		{
			"id": 9,
			//...
		},
		{
			"id": 8,
			//...
		}
	],
	"pagination": {
		"next_uri": "/v3/transactions?limit=2&after=MzIx"
	}
}
```

## Versioning

We release a new version of the API with a new date when making backward-incompatible changes. The following changes are considered backward-compatible:

* Adding new API endpoints
* Adding new properties to responses from existing API endpoints
* Adding optional request parameters to existing API endpoints
* Altering message attributes returned by validation failures or other errors