openapi.json in this repository.
That file is produced by scripts/generate-public-openapi.mjs in the Backend repository (npm run docs:openapi), which declares an explicit whitelist of client-facing operations. Internal admin, support, script, frontend-only, and infrastructure routes are never part of it, so they cannot leak into client docs.
Do not hand-edit openapi.json. Change the generator in the Backend repository and regenerate.
Included groups
Money values
Amounts are transported as decimal strings in USD (for example"150.00") on the account, transaction, and card-list endpoints, so clients never have to parse a float. The single-card and card-issuing responses still return the stored numbers.