# Basic Concepts

## Base URL

```
https://api.pluggy.ai
```

One environment. Test against the [Sandbox connectors](/docs/guides/sandbox) rather than a separate host.

## Transport

HTTPS with TLS 1.2 or later. Connections negotiating an older TLS version are rejected.

## Requests

REST over JSON. Send `Content-Type: application/json` on every request with a body, and the credential in `X-API-KEY` — see [Authentication](/reference/authentication). Verbs mean what they say: `GET` reads, `POST` creates, `PATCH` updates, `DELETE` removes.

## Responses

JSON. The API evolves without versions by **adding** fields to responses; nothing is removed or renamed. Your client has to accept and ignore fields it does not know — most HTTP libraries do by default, a strict deserializer may not.

Errors share one shape, whatever the endpoint:

```json
{
  "code": 401,
  "codeDescription": "CLIENT_KEYS_UNAUTHORIZED",
  "message": "Client keys are invalid"
}
```

`code` repeats the HTTP status; `codeDescription`, when present, is the stable identifier to branch on; `message` is for people. Some errors add a `data` object. The status codes are listed in [Error Codes](/reference/error-codes).

## Pagination

Endpoints that can return many records return one page at a time:

```json
{
  "total": 200,
  "totalPages": 15,
  "page": 1,
  "results": []
}
```

| Field | Meaning |
| --- | --- |
| `total` | Records matching the request, across all pages. |
| `totalPages` | Pages needed to read them all. |
| `page` | The page in this response. |
| `results` | The records of this page. |

Two query parameters drive it: `page` (default `1`) and `pageSize` (default `500` where the endpoint accepts it — check the endpoint). To read everything, request `page=1`, then `page=2` … up to `totalPages`.

```
GET /transactions?accountId={ACCOUNT_ID}&page=2
```

Read the guide: [Basic concepts](/docs/developer-tools/basic-concepts).