# AletaPlanet Developer Documentation

> Card issuing and money movement API. Guides, API reference, and webhooks for developer.aletaplanet.com.

This file contains links to documentation sections following the llmstxt.org standard.

## Guides

- [AI-assisted integration](https://developer.aletaplanet.com/docs/get-started/ai-assisted-integration.md): Documentation files for AI coding assistants, including the llms files, OpenAPI specification, and raw Markdown pages.
- [Authentication](https://developer.aletaplanet.com/docs/get-started/authentication.md): How OAuth 2.0 client credentials and JWT assertions work, and what each authentication error means.
- [Environments](https://developer.aletaplanet.com/docs/get-started/environments.md): The difference between sandbox and production, how the token picks an environment, and the sandbox reset policy.
- [Go-live checklist](https://developer.aletaplanet.com/docs/get-started/go-live-checklist.md): The checklist before your integration is ready for live money.
- [Introduction](https://developer.aletaplanet.com/docs/get-started/introduction.md): What AletaPlanet does, who it is for, and what you can build with it.
- [Quickstart](https://developer.aletaplanet.com/docs/get-started/quickstart.md): Issue a virtual card and simulate an authorization, end to end, in about ten minutes.
- [Sandbox and test data](https://developer.aletaplanet.com/docs/get-started/sandbox-and-test-data.md): Test cardholders, test cards, and simulator endpoints for triggering authorizations, settlements, refunds, and disputes on demand.
- [Event catalog](https://developer.aletaplanet.com/docs/webhooks/event-catalog.md): The envelope every webhook arrives in, and where to find each product's events.
- [Card issuing events](https://developer.aletaplanet.com/docs/webhooks/events-card-issuing.md): Every webhook event a card issuing program emits, when it fires, and what its payload contains.
- [Idempotent event handling](https://developer.aletaplanet.com/docs/webhooks/idempotent-event-handling.md): Events can be delivered more than once, so make sure handling the same event twice doesn't cause duplicate work.
- [Overview and delivery guarantees](https://developer.aletaplanet.com/docs/webhooks/overview-and-delivery-guarantees.md): How webhooks work, what is guaranteed, what is not, and how to build a handler that survives production.
- [Retries, backoff and ordering](https://developer.aletaplanet.com/docs/webhooks/retries-backoff-and-ordering.md): What makes a delivery fail, how retries work, and why events can arrive out of order.
- [Signature verification](https://developer.aletaplanet.com/docs/webhooks/signature-verification.md): Verify the HMAC-SHA256 signature on every webhook delivery, with working examples in Node.js, Python, Go, Java, and PHP.
- [Testing locally](https://developer.aletaplanet.com/docs/webhooks/testing-locally.md): Point a sandbox endpoint at your laptop, send real events, and replay events while you build your handler.
- [Audit logs](https://developer.aletaplanet.com/docs/security/audit-logs.md): What the platform records about sensitive actions, how it is retrieved, and the half of the trail you have to keep yourself.
- [Encryption and key management](https://developer.aletaplanet.com/docs/security/encryption-and-key-management.md): Every key your integration handles — where it comes from, how long it lives, and how to rotate it without downtime.
- [Security overview](https://developer.aletaplanet.com/docs/security/overview.md): How card data, credentials, and cardholder PII are protected, and where the PCI DSS boundary sits.
- [PCI DSS scope](https://developer.aletaplanet.com/docs/security/pci-dss-scope.md): Where the cardholder-data boundary sits between our systems and yours, and what changes it.
- [Responsible disclosure](https://developer.aletaplanet.com/docs/security/responsible-disclosure.md): How to report a security vulnerability in the AletaPlanet platform.
- [API versioning and deprecation](https://developer.aletaplanet.com/docs/support/api-versioning-and-deprecation.md): What we can change without warning, what gets a new version, and the two changes that break clients most often.
- [Contacting support](https://developer.aletaplanet.com/docs/support/contacting-support.md): How to raise a support ticket, and the one piece of information that must be in it.
- [FAQ](https://developer.aletaplanet.com/docs/support/faq.md): The questions we get asked most, with short answers and links to the detail.
- [Troubleshooting](https://developer.aletaplanet.com/docs/support/troubleshooting.md): Find the cause from the symptom, starting with the request logs in Cockpit.
- [Balances: ledger vs available](https://developer.aletaplanet.com/docs/products/card-issuing/accounts-and-funding/balances-ledger-vs-available.md): The three balances, a worked example through a full authorization lifecycle, and which one to show a user.
- [Creating accounts](https://developer.aletaplanet.com/docs/products/card-issuing/accounts-and-funding/creating-accounts.md): Open a stored-value account for a cardholder, in a single currency.
- [Funding and defunding](https://developer.aletaplanet.com/docs/products/card-issuing/accounts-and-funding/funding-and-defunding.md): Move value into and out of an account with credit and debit, safely and idempotently.
- [Accounts & funding](https://developer.aletaplanet.com/docs/products/card-issuing/accounts-and-funding.md): Opening accounts, funding them, linking cards, and understanding the three balances.
- [Creating a cardholder](https://developer.aletaplanet.com/docs/products/card-issuing/cardholders-and-kyc/creating-a-cardholder.md): Create the record that every account and card hangs from.
- [Identity documents](https://developer.aletaplanet.com/docs/products/card-issuing/cardholders-and-kyc/document-upload.md): Why identity documents never pass through this API, what you retain, and what an auditor will ask each side for.
- [Cardholders & KYC](https://developer.aletaplanet.com/docs/products/card-issuing/cardholders-and-kyc.md): Creating cardholders and moving them through identity verification.
- [KYC lifecycle and statuses](https://developer.aletaplanet.com/docs/products/card-issuing/cardholders-and-kyc/kyc-lifecycle-and-statuses.md): Every verification state, what each one gates, and how to report an outcome.
- [Re-verification and remediation](https://developer.aletaplanet.com/docs/products/card-issuing/cardholders-and-kyc/re-verification-and-remediation.md): Handling expiry, review_required, and revoked verification on cardholders who already have live cards.
- [Card lifecycle](https://developer.aletaplanet.com/docs/products/card-issuing/cards/card-lifecycle.md): Understand the states a card can have, how cards move between them, and which states are permanent.
- [Displaying PAN and CVV securely](https://developer.aletaplanet.com/docs/products/card-issuing/cards/displaying-pan-and-cvv-securely.md): Show a cardholder their full card number, with the details encrypted until they reach the cardholder's device.
- [Freeze, replace, close](https://developer.aletaplanet.com/docs/products/card-issuing/cards/freeze-replace-close.md): The card actions support teams use most, and which ones can be undone.
- [Fulfillment and shipping tracking](https://developer.aletaplanet.com/docs/products/card-issuing/cards/fulfillment-and-shipping-tracking.md): Track a physical card through manufacturing and delivery, and keep the cardholder informed.
- [Cards](https://developer.aletaplanet.com/docs/products/card-issuing/cards.md): Issuing virtual cards, managing their lifecycle, and securely displaying card details.
- [Issuing a physical card](https://developer.aletaplanet.com/docs/products/card-issuing/cards/issuing-a-physical-card.md): Get a physical card, either by requesting one for a virtual card or by issuing it directly, and activate it once it arrives.
- [Issuing a virtual card](https://developer.aletaplanet.com/docs/products/card-issuing/cards/issuing-a-virtual-card.md): Issue a card that can be used within seconds of creation.
- [Operations by card status](https://developer.aletaplanet.com/docs/products/card-issuing/cards/operations-by-status.md): Card operations across the six card statuses, showing what succeeds, what gets refused, and what happens when a card in each state is presented.
- [PIN management](https://developer.aletaplanet.com/docs/products/card-issuing/cards/pin-management.md): Set or reset the PIN of a physical card with a PIN encrypted on the cardholder's device, without your servers ever seeing it.
- [Core concepts](https://developer.aletaplanet.com/docs/products/card-issuing/core-concepts.md): The card issuing object model and how its entities fit together.
- [How it works](https://developer.aletaplanet.com/docs/products/card-issuing.md): Who does what between you, AletaPlanet, the network, and the issuing bank.
- [Real-time decisioning](https://developer.aletaplanet.com/docs/products/card-issuing/real-time-decisioning.md): How an authorization is decided while the cardholder waits.
- [3-D Secure](https://developer.aletaplanet.com/docs/products/card-issuing/three-d-secure.md): Authenticating cardholders on online transactions.
- [How a challenge works](https://developer.aletaplanet.com/docs/products/card-issuing/three-d-secure/otp-delivery.md): Authentication challenges happen in the Access Control Server, not in your API, and what that means for you.
- [Out-of-band authentication](https://developer.aletaplanet.com/docs/products/card-issuing/three-d-secure/out-of-band-authentication.md): Approve a 3-D Secure challenge in your own app instead of sending the cardholder a passcode.
- [Transactions](https://developer.aletaplanet.com/docs/products/card-issuing/transactions.md): The record of money that has moved, how to read it, and why the authorization behind it is not visible yet.
- [eSIM](https://developer.aletaplanet.com/docs/products/esim.md): Sell mobile data plans as eSIM profiles, from catalog to installed profile.

## API Reference

- [Base URL and versioning](https://developer.aletaplanet.com/api-reference/conventions/base-urls-and-versioning.md): The API base URL, versioning, and how deprecations work.
- [ID prefixes](https://developer.aletaplanet.com/api-reference/conventions/id-prefixes.md): Every object type's ID prefix, the ID format, and how to handle identifiers.
- [Idempotency](https://developer.aletaplanet.com/api-reference/conventions/idempotency.md): Safely retry requests with the Idempotency-Key header, including replay windows, matching rules, and conflicts.
- [OpenAPI specification](https://developer.aletaplanet.com/api-reference/conventions/openapi-spec.md): Download the OpenAPI 3.1 specification and generate your own client.
- [Pagination](https://developer.aletaplanet.com/api-reference/conventions/pagination.md): Cursor-based pagination, including the list response, cursors, page size, and why offsets aren't supported.
- [Postman](https://developer.aletaplanet.com/api-reference/conventions/postman.md): Import a collection with every operation the API currently supports, plus a sandbox environment.
- [Rate limits](https://developer.aletaplanet.com/api-reference/conventions/rate-limits.md): Request limits, the headers that report them, and how to back off correctly.
- [Request and response format](https://developer.aletaplanet.com/api-reference/conventions/request-and-response-format.md): Content types, HTTP methods, the shape of every object, and standard headers.
- [Timestamps and money](https://developer.aletaplanet.com/api-reference/conventions/timestamps-and-money.md): RFC 3339 timestamps in UTC, and money as minor units with an ISO 4217 currency.
- [Error code catalog](https://developer.aletaplanet.com/api-reference/errors/error-code-catalog.md): Every error code the API can return, with its HTTP status, meaning, retryable flag, and fix.
- [The error object](https://developer.aletaplanet.com/api-reference/errors/error-object.md): The single error shape every failure returns, and what each field is for.
- [HTTP status mapping](https://developer.aletaplanet.com/api-reference/errors/http-status-mapping.md): Which HTTP status each error type returns, and which statuses are safe to retry.