PesaGuard Docs
Ctrl K

Getting started

First authenticated request Live

PesaGuard uses bearer authentication. Every request carries a token; every token carries a scope, an expiry and the tenant it belongs to.

The header

AUTHAuthorization
Authorization: Bearer <token>

The backend validates the token's issuer, audience and tenant claims where applicable. Tokens are issued per deployment by the team that runs it — see Create an API key for what you receive.

Scopes decide what a token may do

Permissions are expressed as resource-oriented scopes, for example:

  • dashboard:read — operational telemetry
  • transactions:read / transactions:write / transactions:export
  • reconciliation:read / reconciliation:create
  • anomalies:read / anomalies:investigate
  • integrations:read / integrations:manage
  • audit:read, settings:read, settings:write

A token grants exactly the scopes it was issued for. Anything else returns 403; see Errors.

What an unauthenticated call returns

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication failed.",
    "request_id": "<uuid>"
  }
}
There is no anonymous fallback

When authentication fails, the request ends there. No degraded mode serves financial data without a verified identity.

Next