> ## Documentation Index
> Fetch the complete documentation index at: https://docs.centsless.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Centsless API reference overview

> The Centsless REST API base URL, authentication method, versioning, and rate limits. All endpoints accept JSON and return JSON except the CSV export endpoint.

Centsless is a REST API. Every request goes to the base URL below, and every endpoint except `GET /health` and `GET /version` requires an `x-api-key` header. Requests and responses use JSON throughout, with the single exception of `POST /export`, which returns a CSV file.

## Base URL

```bash theme={null}
https://api.centsless.org/api/v1
```

## Authentication

Pass your API key in the `x-api-key` request header on every call that requires authentication.

```bash theme={null}
curl https://api.centsless.org/api/v1/transaction \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "merchant_id": "MERCHANT-001", ... }'
```

Keys are role-scoped. Merchant keys authorize transaction processing, auditor keys grant read-only access to compliance data, and admin keys provide full platform access. See the [Authentication](/authentication) page for the full key type reference.

<Warning>
  API keys are shown **once** at creation and hashed with SHA-256 before storage. Store them in a secrets manager immediately — they cannot be retrieved later.
</Warning>

## API version

The current API version is **3.6.0**. The version is also available at runtime from `GET /version`, which returns the engine version and available endpoints without requiring authentication.

## Rate limits

Rate limits are enforced per API key.

| Environment | Limit                  |
| ----------- | ---------------------- |
| Sandbox     | 1,000 requests / hour  |
| Production  | 10,000 requests / hour |

When you exceed the limit, the API returns `429 Too Many Requests`. See [Error codes](/api-reference/errors) for the full error schema.

## Request format

Set `Content-Type: application/json` on all requests that include a body. The API rejects requests with a malformed or missing content type.

```bash theme={null}
Content-Type: application/json
```

## Endpoints that do not require authentication

The following endpoints are open and do not require an `x-api-key` header:

| Method | Endpoint   | Description                                                           |
| ------ | ---------- | --------------------------------------------------------------------- |
| `GET`  | `/health`  | Platform status, database connectivity, and compliance certifications |
| `GET`  | `/version` | Current API version, engine version, and available endpoints          |

## Explore the API

<CardGroup cols={2}>
  <Card title="Transactions" href="/api-reference/transactions/process">
    Process cash transactions with jurisdiction-aware rounding, query transaction history, and manage voids and refunds.
  </Card>

  <Card title="Jurisdiction" href="/api-reference/jurisdiction/resolve-zip">
    Resolve rounding rules by ZIP code, state, county, or city using the 33,000+ ZIP code Census database.
  </Card>

  <Card title="Tipping" href="/api-reference/tipping/process">
    Record and pool tips with FLSA-compliant rounding, process payouts, and detect wage theft patterns.
  </Card>

  <Card title="Compliance & Audit" href="/api-reference/compliance/overview">
    Query immutable audit logs, verify hash chain integrity, and run void and override analytics.
  </Card>
</CardGroup>