#  API Fundamentals

It follows REST conventions with JSON-encoded requests and responses. All requests require **server-to-server OAuth 2.0 client credentials** and are made over HTTPS. Requests can be sent to:

- **Sandbox** – safe testing with no impact on live data.
- **NPC** (Non-Playable Character) – a test environment for web-onboarding user journeys. Uses test-BankID instead of real BankID for authentication.
- **Production** – the live environment.


## Pagination

Some list endpoints support cursor-based pagination with two query parameters:

- **`start`** — a `sortedId` to begin from (inclusive — the item with this ID is included in the results). Omit on the first request.
- **`limit`** — maximum number of results to return. Default is unlimited.


Omit both parameters to retrieve the full result set in one request. To paginate, pass the `sortedId` of the last item you received as `start`. Since `start` is inclusive, skip the first item of each subsequent page to avoid duplicates.

## Real-time Updates

For near real-time updates, use:

- **WebSocket subscriptions** – keep a persistent connection to receive live events such as new orders or settlements.
- **Journey callbacks** – Fondo sends POST callbacks to the `callbackUrl` you provide when creating a journey, with status updates such as completion, cancellation, or errors.