Conventions

Base URL: use https://api-staging.asqary.com for now. Production, https://api.asqary.com, is not live yet.

Authentication

Send your API key as a bearer token:

Authorization: Bearer asq_test_…

asq_test_… keys use test data and asq_live_… keys use live data. Decisions, behavioural history, backtests and feedback are stored per environment, so test and live data never mix.

Scopes

Scope	Allows
risk:query	Score transactions
risk:read	Read decisions
policies:read, policies:write	Read, and change, policies
backtest:read, backtest:write	Read, and submit, backtests
feedback:write	Submit feedback
webhooks:read, webhooks:manage	List, and change, webhook endpoints

Wildcards such as risk:* and * are supported.

Requests

• JSON bodies are decoded strictly. Unknown fields are rejected with 400 invalid_request.
• Amounts are integers in minor units (kobo for NGN).
• Timestamps are RFC 3339.
• Identifiers are never sent raw. See Identifier hashing.

IDs

IDs are prefixed by type:

Prefix	Object
pol_	Policy
plv_	Policy version
dec_	Decision
bt_	Backtest
fbk_	Feedback
evt_	Webhook event
whd_	Webhook delivery

Request IDs

Every response has an X-Request-Id header. It is also returned as request_id in error bodies and stored on decisions. Send your own X-Request-Id (1–128 characters of letters, digits and . _ : -) to correlate with your logs. Otherwise one is generated. Quote it when you contact support.

Idempotency

• POST /v1/score is idempotent on transaction.id.
• POST /v1/policies, /v1/backtest and /v1/feedback accept an Idempotency-Key header (1–128 characters of letters, digits and . _ : -). Repeating the request with the same key returns the original result with 200 and Idempotent-Replayed: true. Reusing a key with a different request returns 409 idempotency_key_reused.