Making Requests#

Base URLs#

The API is only available over HTTPS. Attempting to access the API over HTTP will return a tls_required error.

Healthcheck#

Both environments expose a health check endpoint you can use to verify connectivity. It requires no authorisation and is not rate limited — a 200 response means the API is available.

• https://api.gocardless.com/health_check (live)
• https://api-sandbox.gocardless.com/health_check (sandbox)

Authentication#

After creating an access token in the dashboard, pass it in an Authorization header using the bearer scheme:

Authorization: Bearer TOP_SECRET_ACCESS_TOKEN

Versions#

Every request must include a GoCardless-Version header specifying a released API version:

GoCardless-Version: 2015-07-06

Headers#

Content type#

All requests and responses are JSON-formatted and UTF-8 encoded. Include an Accept header on all requests:

Accept: application/json

For POST and PUT requests, also include Content-Type and Content-Length:

Content-Type: application/json
Content-Length: 3495

You may use either application/json or application/vnd.api+json for both headers.

HTTP methods#

The API supports GET, POST, PUT, and DELETE. If your HTTP client or proxy doesn't support PUT or DELETE, send a POST with an override header:

X-HTTP-Method-Override: PUT
X-HTTP-Method-Override: DELETE

Optional properties#

When making requests, omit optional properties from the JSON body entirely rather than sending null. Our API libraries handle this automatically — it's only relevant if you're constructing raw requests.

What's next#