Developer portal

Public API contract at /openapi.json · Agent guide at /llms.txt · Portuguese version at Desenvolvedores · Markdown version at developers.md

What you can call without credentials

Four endpoints are open to anyone, and they are the ones described in the published OpenAPI 3.1 contract at /openapi.json. Base URL https://www.sistemacapitalis.com.br/api, same origin as this site.

GET /api/health and GET /api/health/ready — liveness and readiness of the platform.
GET /api/version — running version and environment (producao or sandbox).
GET /api/status — service-by-service state with latency, plus any declared maintenance window. This is what the status page reads.
POST /api/site/contato — the contact form on this site, with GET /api/site/contato/assuntos listing the accepted subjects.

Quickstart

Read the contract, then call the health endpoint. Nothing here needs a key.

curl -s https://www.sistemacapitalis.com.br/openapi.json | head -20
curl -s https://www.sistemacapitalis.com.br/api/health
curl -s https://www.sistemacapitalis.com.br/api/status

Every public page of this site also answers in markdown, for agents that would rather not parse HTML:

curl -sH 'Accept: text/markdown' https://www.sistemacapitalis.com.br/
curl -s https://www.sistemacapitalis.com.br/about.md

Everything else needs a contract

The product API — operations, registry, origination, finance, trustee, confirmation, collections, reports — and the MCP server are released to customers with an active subscription, together with their credentials, through comercial@sistemacapitalis.com.br. There is no self-service key signup, and we do not publish the full schema: the complete surface of a financial API is reconnaissance material, and keeping it closed is a deliberate security decision, not an oversight. Calling /api/* without credentials returns 401; do not retry with guessed paths.

How authentication works once you have a contract

Session tokens for the web app, and personal access tokens (PAT) for integrations.
A PAT can be bound to a key with DPoP (RFC 9449, sender-constrained tokens, FAPI 2.0): once enabled on a token, there is no permissive fallback.
Every route that moves money accepts or requires an Idempotency-Key, so a network retry is never a second payment order.
Each customer's data is isolated in the database itself (forced row-level security), and every sensitive action lands in an append-only audit trail correlated by X-Request-ID.

Sandbox

A sandbox environment exists and is where every change is homologated before production. It is not open to the public while the product is pre-beta: access is granted with the contract, so that no third party's demonstration data mixes with a customer's. Ask through the commercial channel and we provision credentials for it.

Rate limits, errors and support

Public endpoints are rate limited per IP and answer 429 with a Retry-After header when you go over. Errors are JSON with a stable detail code — treat the code, not the message, as the contract. Report a bug or a vulnerability to seguranca@sistemacapitalis.com.br; integration questions go to suporte@sistemacapitalis.com.br.