> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zeam.money/llms.txt
> Use this file to discover all available pages before exploring further.

# Conventions

> Base URL, versioning, field formats, and the headers shared by every endpoint.

The gateway uses the same conventions everywhere, so once you learn them they
apply to every endpoint.

## Base URL

* `https://api.zeam.money/gw/v1`

Sandbox and production share this base URL; your application's registration
determines which environment a request runs in.

## Versioning

The API is versioned in the path (`/v1`). Additive, backward-compatible changes
ship within `/v1`. Breaking changes ship under a new version. Deprecations are
announced ahead of time with `Deprecation` and `Sunset` response headers and a
[changelog](/changelog) entry.

## Resource format

* **JSON, camelCase.** All request and response fields use camelCase.
* **Identifiers** are UUID strings. Stellar public keys are 56-character `G…`
  strings.
* **Timestamps** are ISO 8601 / RFC 3339 in UTC, for example
  `2026-01-15T10:30:00Z`.
* **Amounts** are decimal strings where precision matters, to avoid
  floating-point rounding.

Collections are wrapped for [pagination](/platform/pagination); single resources
are returned directly.

## Request headers

| Header                           | When                    | Purpose                                                       |
| -------------------------------- | ----------------------- | ------------------------------------------------------------- |
| `Authorization: Bearer`          | every protected request | Access token. See [Authentication](/authentication/overview). |
| `x-zeam-auth`                    | every protected request | Application secret (API key).                                 |
| `Content-Type: application/json` | requests with a body    | Required on `POST` requests.                                  |

The association is resolved server-side from the verified token — you do not
need to send an association id header. Payment endpoints take an
`idempotencyKey` in the request body, not a header, so a retry cannot create a
duplicate.

## Response headers

Every response includes an `X-Request-Id`. If you send one, the gateway uses it;
otherwise it generates one. Log it and include it in
[support](/resources/support) requests so Zeam can trace the exact call.

<Tip>
  Make payments safe to retry: send a unique `idempotencyKey` in the request
  body. Replaying it returns the original result with `isIdempotent: true`.
</Tip>