Authentication

All API endpoints require an API key in the x-api-key header.

API key

curl https://apidocs.borderli.io/v1/schemes \
  -H "x-api-key: brly_test_key_001"

Sandbox key

Use brly_test_key_001 for sandbox testing. This key is pre-configured with a test tenant.

Missing or invalid key

Requests without a valid API key receive a 401 AuthError:

{
  "_tag": "AuthError",
  "type": "AuthError",
  "message": "Missing or invalid API key",
  "docs_url": "https://docs.borderli.dev/errors/AuthError",
  "request_id": "550e8400-e29b-41d4-a716-446655440000"
}

Rate limits

Authenticated endpoints are rate-limited to 100 requests per minute per API key.

Header	Description
`x-ratelimit-limit`	Maximum requests per window (100)
`x-ratelimit-remaining`	Requests remaining in current window
`x-ratelimit-reset`	Unix timestamp when the window resets

When you exceed the limit, you receive a 429 RateLimitError with a retryAfter field in seconds.

Response headers

Every response includes an x-request-id header with a unique UUID. Use this for support correlation.

x-request-id: 550e8400-e29b-41d4-a716-446655440000

Error responses also include the request_id in the response body.