Rails API

Entitled server-to-server signed quotes, pay-ins, and pay-outs.

The Rails API is a server-only Gate surface for partners with rails_api enabled. It uses signed, single-use quotes and the KYC-approved user attached to a GateSession.

Rail availability depends on partner entitlement, environment configuration, currency, country, and payment method. Query capabilities first. The public contract includes methods such as PIX and SPEI where configured; it does not promise a provider or corridor merely because a schema accepts the method name.

1. Create the GateSession

Create a session for the same commercial intent and user context. The rail later derives the 0Bit user from gate_session_id.

2. Lock a quote

curl -X POST https://gate-api-sandbox.0bit.app/quotes \
  -H "Authorization: Bearer sk_test_..." \
  -H "Content-Type: application/json" \
  -d '{
    "currency":"BRL",
    "asset":"USDC",
    "amount":"100.00",
    "side":"on_ramp",
    "payment_method":"PIX"
  }'

The response includes quote id, amounts, exchange rate, fees, fiat_pay_or_receive, USD-normalized amount, signature, and expiry. A quote is single-use.

3. Redeem the quote

For fiat into crypto:

curl -X POST https://gate-api-sandbox.0bit.app/rails/pay_ins \
  -H "Authorization: Bearer sk_test_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"gate_session_id":"67a1f3b9e4b0c10001234567","quote_id":"sq_abc123"}'

For crypto into fiat, use POST /rails/pay_outs with the same body shape.

The request accepts only gate_session_id, quote_id, optional reference, and optional metadata. Do not send names, bank accounts, documents, or payment keys; Gate derives regulated account data from the approved user record and rejects extra PII fields.

4. Reconcile

• GET /rails/pay_ins/{id}
• GET /rails/pay_outs/{id}
• signed rail.pay_in.* and rail.pay_out.* webhooks
• quote.consumed

Rail states are pending, processing, settled, failed, or cancelled. Preserve the same idempotency key when retrying the same create request.

The response's provider and provider_ref fields are reconciliation data. Integrations must not branch on a hard-coded provider name.