openapi.json in this repository.
That file is produced by scripts/generate-public-openapi.mjs in the Backend repository (npm run docs:openapi), which declares an explicit whitelist of client-facing operations. Internal admin, support, script, frontend-only, and infrastructure routes are never part of it, so they cannot leak into client docs.
Do not hand-edit openapi.json. Change the generator in the Backend repository and regenerate.
Included groups
Response envelope
Most responses wrap the payload inresult. GET /account, POST /transactions/count, POST /transactions/summary and GET /user return the object bare.
Money values
Amounts are transported as decimal strings in USD (for example"150.00") on the account, transaction, and card-list endpoints, so clients never have to parse a float. The single-card and card-issuing responses still return the stored numbers.