Support

Getting Started

Zoniqx APIs are REST over HTTPS — every request and response is JSON. This guide walks you from your first token to your first successful request.

Overview

The platform exposes four independent services. Each has its own OpenAPI spec, its own base URL, and its own tag groups in the API Reference. All share the same auth model.

ServicePurposeBase path
HeimdallIdentity, KYC, Wallets, Payments/
z360Deals, Assets, Investments, Payouts/api/v2
MimirVouchers & Redemptions/api
zConnectGateway & Webhooks/api/v1

Authentication

All endpoints are protected with JWT Bearer tokens issued by Heimdall. Obtain a token by posting your credentials to POST /auth/login:

POST /auth/login

The response contains an accessToken (JWT) and a refreshToken. Attach the access token to every subsequent request:

Authorization: Bearer <accessToken>
⚠

Keep tokens secret. Never log, commit, or expose tokens in client-side code. Store them in environment variables or a secrets manager.

Tenant Header

Every request must also carry an x-tenant-id header that scopes the operation to a specific tenant. Your tenant ID is provisioned when your account is created. 

x-tenant-id: <your-tenant-id>
ℹ

Missing either header returns 401 Unauthorized. Both must be present on every request.

First Request

Once authenticated, verify everything works by fetching your own user profile:

GET /users/me

A 200 OK response with your user object confirms auth is set up correctly.

  1. 1

    Login and capture the token

    Call POST /auth/login with your credentials to receive accessToken.

  2. 2

    Set the two required headers

    Add Authorization: Bearer <accessToken> and x-tenant-id to your client.

  3. 3

    Call GET /users/me

    A 200 response with your profile confirms the setup is working end-to-end.

Token Refresh

Access tokens expire after 15 minutes. Before that window closes, call POST /auth/refresh with your refreshToken to get a new pair without re-entering credentials:

POST /auth/refresh
✓

Proactively refresh before expiry (e.g. at 12 minutes) to avoid 401 errors mid-session. The refresh token itself has a 7-day lifetime.

Base URLs

Use the environment picker in the API Reference to switch between Production, Staging, and Development servers.

EnvironmentHeimdallz360
Productionhttps://api.zoniqx.comhttps://api.zoniqx.com/api/v2
Staginghttps://api.stage.zoniqx.comhttps://api.stage.zoniqx.com/api/v2
Developmenthttps://heimdall.qa.zoniqx.comhttps://nestjs.dev.api.realtoapps.com/api/v2

HTTP Status Codes

All errors return JSON with a statusCode, message, and optional error field.

CodeMeaningCommon cause
200 / 201Success—
400Bad RequestValidation error — check message
401UnauthorizedMissing, expired, or malformed token
403ForbiddenValid token but insufficient role/permissions
404Not FoundResource doesn't exist or wrong tenant
429Rate LimitedBack off and retry with exponential delay
500Server ErrorContact developers@zoniqx.com

Pagination

List endpoints accept limit (default 20, max 100) and offset query parameters. Cursor-based paging is available on some endpoints via afterId. Responses always include a total count. 

GET /deals?limit=20&offset=40
→ { "total": 87, "data": [ ... ] }

KYC & Compliance Flow

Before an investor can participate in a deal they must complete identity verification via Veriff:

  1. 1

    Create a Veriff session

    Call POST /kyc/veriff/session. The response includes a sessionUrl to redirect the user to.

  2. 2

    User completes Veriff

    Veriff posts a webhook back to Heimdall automatically — no action required on your end.

  3. 3

    Poll for approval

    Call GET /kyc/attempts until status === "approved". US investors follow the same pattern under /accreditations.

ℹ

Need help? Open the API Reference to browse all endpoints live, or email developers@zoniqx.com.