Make your first requests

Production endpoint

These examples target production. Run only the individual reads shown here. The complete client-admin walkthrough remains a publication check.

Send individual requests. Do not run the entire collection against production: it includes operations that change resources and initiate payments. Have your approved secrets workflow supply XDC_API_KEY privately to the process environment; do not type its value into shell history or enable command tracing.

Check reachability

curl --silent --show-error --include \
  'https://api.xdc.tech/v1/health'

Expect HTTP 200 with status: "ok". This does not prove credentials, database readiness or payment eligibility.

Check identity and permissions

curl --silent --show-error --include \
  'https://api.xdc.tech/v1/me' \
  --header "X-Api-Key: ${XDC_API_KEY}"

Expect HTTP 200. Check customer.id, customer.business_name and api_key.scopes. Stop and contact XDC Tech if the business or permissions are unexpected. Never supply another business's ID as a workaround.

Read wallets

curl --silent --show-error --include \
  'https://api.xdc.tech/v1/wallets' \
  --header "X-Api-Key: ${XDC_API_KEY}"

An empty list can be valid. Confirm expected resources before creating anything. Ordinary reads may refresh provider caches; explicit sync=true requires resource-management permission.

Troubleshooting

Response or symptom	Next step
401, API key required	Supply X-Api-Key on the request.
401, Invalid or revoked API key	Check the active key and environment. Account ineligibility can also produce this response; ask your contact to verify status.
403, INSUFFICIENT_API_KEY_SCOPE	Compare the operation with the key's scopes. Arrange an authorized replacement if necessary.
403, API_KEY_SCOPE_REVIEW_REQUIRED	Contact XDC Tech to resolve legacy-key classification.
No creation controls or no business listed	Confirm your client-level membership and business eligibility.
Timeout on a write	Check actual operation status before retrying.

Contact your named XDC Tech onboarding representative. Include the business name, endpoint and method, approximate time/timezone, HTTP status and sanitized error text, plus a request identifier if available. Exclude keys, passwords, confirmation codes, full account numbers and unredacted customer responses.

Continue with Postman or endpoint coverage.