generated: '2026-07-18'
method: searched
source: https://developers.cora.com.br/docs/utilização-das-apis
docs:
- https://developers.cora.com.br/docs/instrucoes-iniciais
- https://developers.cora.com.br/docs/utilização-das-apis
authentication:
  style: mutual-TLS + OAuth2 client-credentials bearer token
  detail: >-
    Direct Integration presents an X.509 client certificate + private key on every
    request plus an Authorization: Bearer token; Partnership uses client_secret.
  ref: authentication/cora-authentication.yml
idempotency:
  supported: true
  header: Idempotency-Key
  value_format: UUID
  scope: per-request, prevents duplicate record creation on retry
  spec: RFC 9110
  detail: >-
    A UUID generated by the caller and sent in the Idempotency-Key request header.
    Cora uses the key to avoid duplicate records — if a response is not received and
    the same UUID is resent, the record is not duplicated.
  source: https://developers.cora.com.br/docs/instrucoes-iniciais
versioning:
  style: uri-path
  current: v2
  example: /v2/invoices
  detail: Resource versions are carried in the URL path (e.g. v2 for invoices/boletos and Pix QR codes).
amounts:
  representation: integer minor units (cents)
  detail: Monetary amounts are expressed as integers in centavos (e.g. 25000 = R$ 250.00).
environments:
  stage:
    direct_integration: https://matls-clients.api.stage.cora.com.br/
    partnership: https://api.stage.cora.com.br/
  production:
    direct_integration: https://matls-clients.api.cora.com.br/
    partnership: https://api.cora.com.br/
webhooks:
  supported: true
  detail: >-
    Consumers register notification endpoints (Criação/Lista/Exclusão de endpoints)
    to receive event notifications via HTTP POST.
  ref: asyncapi/cora-webhooks.yml
approvals:
  detail: >-
    Money-movement operations initiated via API (payments, transfers, DARF/GPS) must
    be approved in the Cora app before they execute.