Basic Concepts

Base URL#

https://api.pluggy.ai

One environment. Test against the Sandbox connectors rather than a separate host.

Transport#

HTTPS with TLS 1.2 or later. Connections negotiating an older TLS version are rejected.

Requests#

REST over JSON. Send Content-Type: application/json on every request with a body, and the credential in X-API-KEY — see AuthenticationAPI. Verbs mean what they say: GET reads, POST creates, PATCH updates, DELETE removes.

Responses#

JSON. The API evolves without versions by adding fields to responses; nothing is removed or renamed. Your client has to accept and ignore fields it does not know — most HTTP libraries do by default, a strict deserializer may not.

Errors share one shape, whatever the endpoint:

{
  "code": 401,
  "codeDescription": "CLIENT_KEYS_UNAUTHORIZED",
  "message": "Client keys are invalid"
}

code repeats the HTTP status; codeDescription, when present, is the stable identifier to branch on; message is for people. Some errors add a data object. The status codes are listed in Error CodesAPI.

Pagination#

Endpoints that can return many records return one page at a time:

{
  "total": 200,
  "totalPages": 15,
  "page": 1,
  "results": []
}

Two query parameters drive it: page (default 1) and pageSize (default 500 where the endpoint accepts it — check the endpoint). To read everything, request page=1, then page=2 … up to totalPages.

GET /transactions?accountId={ACCOUNT_ID}&page=2

Read the guide: Basic concepts.