> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments and requests

> Configure the correct API host, transport, and headers before making requests.

## Base URL

Set `AMLOK_API_BASE_URL` to the HTTPS origin issued for your institution and environment. Use the matching environment-specific API key.

| Setting | Meaning |
| - | - |
| `AMLOK_API_BASE_URL` | Approved HTTPS origin, without `/v1` or a trailing slash. |
| `AMLOK_API_KEY` | Server-side key for that environment and institution. |
| Webhook destination and secret | Separate endpoint configuration for the same environment. |

Sandbox and production keys, subjects, provider connections, consent records, event destinations, and idempotency records must remain separate. Do not copy production evidence into a sandbox unless your approved data-handling process explicitly allows it.

## Request format

Paths begin `/v1`. JSON writes use `Content-Type: application/json`. JSON reads use `Accept: application/json`. Document uploads use multipart form data with a client-generated boundary.

| Header | When to send it |
| - | - |
| `Authorization` | Every authenticated financial-data or reporting request. |
| `Content-Type` | JSON body or multipart upload. Let the HTTP client set the multipart boundary. |
| `X-Request-ID` | Optional caller correlation ID. Record AMLOK's returned `request_id` separately. |
| `Idempotency-Key` | Every POST command, including download-link issuance and event replay. |
| `If-Match` | PATCH configuration with the current quoted ETag. |

Treat IDs as opaque case-sensitive strings. Do not trim leading zeros, infer information from a prefix, or reuse an ID across environments.

## Network behavior

The examples use a 30-second client timeout as an illustration, not a server SLA. Set explicit timeouts suited to your application. A timeout does not prove a command was rejected; retain its idempotency key when retrying.

Do not forward an API credential to a redirected host. Configure the correct origin and reject unexpected redirects. Long-running work returns a resource to poll instead of holding the HTTP connection open.

## Environment configuration

Onboarding must provide the production and sandbox origins, enabled scopes and providers, numeric quotas, network controls, support route, incident contacts, and any contractual service commitments. See [integration onboarding](https://docs.amlok.io/api-reference/onboarding.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.