API Basics

Authenticating

An API key is required to get started. Generate one on the Program settings page of the Lithic Dashboard.

Requests are authenticated with an API (secret) key with the following request header:

"Authorization: YOUR_API_KEY"

Example

curl --request GET \
     --url 'https://api.lithic.com/v1/cards' \
     --header 'Accept: application/json' \
     --header 'Authorization: YOUR_API_KEY'

Errors

You can use this information to diagnose failed transactions and fine-tune your exception-handling capabilities.

400

[query] is not a valid parameter A parameter in the query given in the request does not match the valid queries for the endpoint

401

User has not been authenticated Invalid or missing API key
API key is not active The API key used is no longer active
Could not find API key The API key provided is not associated with any user
Please provide API key in Authorization header The Authorization header is not in the request
Please provide API key in the form Authorization: [api-key] The Authorization header is not formatted properly
Insufficient Privileges. Issuing API key required Write access requires an Issuing API key. Please contact support.lithic.com
Insufficient privileges to create virtual cards. Creating virtual cards requires an additional privilege Please contact support.lithic.com

422

Authorization failed (in simulation) An authorization fails when simulating an authorization

429

Rate limited, too many requests per second User has exceeded their per second rate limit

5xx

Lithic APIs may return HTTP 5xx errors in case of issues on Lithic's side. This always indicates a server-side error, and the specific HTTP error should not matter to the caller. The recommended action is to retry the request. If the issue persists, check our Status Page and contact support.lithic.com.

500 Internal Server Error There was a processing error on the server-side.
502 Bad Gateway There was a processing error on the server-side due to network configuration
503 Service Unavailable There was a processing error on the server-side due to unavailability of an internal service
504 Gateway Timeout There was a processing error on the server-side due to network timeout

General Notes

Pagination

Top-level API resources support bulk fetches through "list" API methods, such as list events, list disputes, and list settlement records. These methods have a common structure, taking at least page_size, starting_after, and ending_before as parameters.

Request Parameters:

To navigate through pages:

If neither starting_after or ending_before are provided, then the API will return the newest objects. Objects are always returned in reverse chronological order (newest first). starting_after and ending_before cannot be used together.

Response Parameters:

has_more: true when there are more records that match the API request. To access those items, update either the starting_after or ending_before parameters and send another request.

Pagination Example

// Example Request to GET /disputes using Pagination
{
  ...
  "page_size": 5,
  "starting_after": "bf3022a8-4628-4417-b4db-e1ba72075a08",
  // Returns the next page of results (older items) after this dispute in the list.
}

// Response
{
  "data": [...], // 5 items returned because of the provided "page_size" in the request.
  "has_more": true // More items exist that match the query.
}

Transitioning from offset pagination to cursor-based pagination

If you are using an SDK, all Lithic client libraries now use cursor-based pagination by default. Update your libraries to the latest version to leverage this enhancement

If you are directly querying our APIs, to transition to cursor-based pagination, you would include the header X-Lithic-Pagination: cursor in your API requests and use starting_after or end_before query parameters instead of page.

Versioning and backwards compatibility

The Lithic API will not make backwards-incompatible changes (such as removing a field from the API) without reaching out to you first. We're continually making backwards-compatible changes to the API, however. A record of backwards-compatible changes can be found in our Changelog. Examples of backwards-compatible changes which we do not consider "breaking" include:

  1. Adding new optional request parameters to existing API methods.
  2. Adding new properties to existing API responses.
  3. Changing the order of properties in existing API responses.
  4. Adding new API resources or methods.
  5. Changing the length or format of opaque strings, such as resource IDs, error messages, and other human-readable strings.