Programmatic access to the valueverde platform: browse the cooperative catalogue, provision investors, and place share purchases on their behalf. OAuth2 client_credentials in, JSON out.
Every guarantee below applies to every endpoint, every token, every request — no premium tier required.
RS256 access tokens, 15-minute TTL, JWKS-published verification keys. No secrets on the wire after token mint.
RFC 9457 Problem Details with stable error codes. snake_case field names. Forward-compatible — clients tolerate unknown fields.
One-based page/size with total_items and has_next. Six sort tokens. Filter combinations are pure AND.
TLS 1.2+, HSTS preload, frame-deny, strict referrer policy. 90-day request audit. Argon2id-hashed client secrets.
All data stored in Frankfurt with cross-AZ replication. No US or APAC replica.
Forward-compatible additions are silent. Breaking changes get a new URL prefix and a 12-month dual-run window.
One contract, under /v1. OAuth2 throughout.