Skip to content
/Generic Tokens

Guardian API (1.0)

Download OpenAPI description
guardian-openapi.json
guardian-openapi.yaml
Overview
URL
https://hellgate.io/cpa/guardian
Starfish GmbH & Co. KG
hello@starfish.team
License
Hellgate API Terms
Languages
Servers
Guardian service instance
https://{cluster_id}.on-hellgate.cloud

PCI Tokens

Management of card payment credentials under the ruling of PCI/DSS.

Operations

Network Tokens

Management of network tokens, including cryptograms for secure transactions.

Operations

Generic Tokens

Management of generic tokens and their schemas for various use cases.

Operations

Create token

Request

Create a new token in the generic scope. This type of token can be used for various use cases that do not involve sensitive card payment credentials.

Security
APIKey or AdminToken
Bodyapplication/json
expiration_timeinteger[ 1 .. 2592000 ]

The expiry time is used to specify after how many seconds a token should be automatically deleted after creation.

payloadobjectrequired

The payload is a key-value map, that can contain any information the user wants to store in the token.

  • Maximum 20 key-value pairs.
  • Maximum 20 characters per key.
  • Maximum 80 characters per value.
metadataobject

Metadata consisting of entries, each of which each includes a key and an associated value:

  • Maximum 20 key-value pairs.
  • Maximum 20 characters per key.
  • Maximum 80 characters per value.
Example: {"my_key_one":"my_value_one","my_key_two":"my_value_two"}
type_idstring(uuid)

The ID of a type to apply for this payload.

If provided the payload will be validated against the schema of the type and the tokens can be filtered by the type ID as well.

curl -i -X POST \
  https://my-cluster-id.on-hellgate.cloud/api/generic/tokens \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: YOUR_API_KEY_HERE' \
  -d '{
    "payload": {
      "iban": "DE89370400440532013000",
      "bic": "COBADEFFXXX",
      "account_holder_name": "John Doe"
    }
  }'

Responses

Success response

Bodyapplication/json
idstring(uuid)required
created_atstring(date-time)required
expires_atstring(data-time)
metadataobject

Metadata consisting of entries, each of which each includes a key and an associated value:

  • Maximum 20 key-value pairs.
  • Maximum 20 characters per key.
  • Maximum 80 characters per value.
Example: {"my_key_one":"my_value_one","my_key_two":"my_value_two"}
Response
application/json
{
  "id": "8744c9ea-a02b-4ae6-875c-b64fc333e3ef",
  "created_at": "2023-10-01T12:34:56Z"
}

Get tokens

Request

List all tokens in the generic scope.

Security
APIKey or AdminToken
Query
schema_idstring(uuid)

Filter the tokens by their schema, referenced by this schema ID.

limitinteger[ 1 .. 100 ]

The limit parameter defines the maximum number of rows returned in a single call and enables consecutive pagination using the next link provided in the response payload.

Default 20
curl -i -X GET \
  'https://my-cluster-id.on-hellgate.cloud/api/generic/tokens?schema_id=497f6eca-6276-4993-bfeb-53cbbbba6f08&limit=20' \
  -H 'x-api-key: YOUR_API_KEY_HERE'

Responses

Success response

Bodyapplication/json
dataArray of objectsrequired
Example: [{"id":"8744c9ea-a02b-4ae6-875c-b64fc333e3ef","created_at":"2023-10-01T12:00:00Z"}]
data[].​idstring(uuid)required
data[].​created_atstring(date-time)required
data[].​expires_atstring(data-time)
data[].​metadataobject

Metadata consisting of entries, each of which each includes a key and an associated value:

  • Maximum 20 key-value pairs.
  • Maximum 20 characters per key.
  • Maximum 80 characters per value.
Example: {"my_key_one":"my_value_one","my_key_two":"my_value_two"}
linksobjectrequired
Example: {"next":"https://my-cluster-id.on-hellgate.cloud/generic/tokens?after=8744c9ea-a02b-4ae6-875c-b64fc333e3ef&limit=20"}
links.​nextstring(uri)required
Example: "https://my-cluster-id.on-hellgate.cloud/generic/tokens?after=8744c9ea-a02b-4ae6-875c-b64fc333e3ef&limit=20"
Response
application/json
{
  "data": [
    { … }
  ],
  "links": {
    "next": "https://my-cluster-id.on-hellgate.cloud/generic/tokens?after=8744c9ea-a02b-4ae6-875c-b64fc333e3ef&limit=20"
  }
}

Get token details

Request

Get a token by its identifier.

Security
APIKey or AdminToken
Path
idstring(uuid)required

The ID of the token to read.

curl -i -X GET \
  'https://my-cluster-id.on-hellgate.cloud/api/generic/tokens/{id}' \
  -H 'x-api-key: YOUR_API_KEY_HERE'

Responses

Success response

Bodyapplication/json
idstring(uuid)required
created_atstring(date-time)required
expires_atstring(data-time)
metadataobject

Metadata consisting of entries, each of which each includes a key and an associated value:

  • Maximum 20 key-value pairs.
  • Maximum 20 characters per key.
  • Maximum 80 characters per value.
Example: {"my_key_one":"my_value_one","my_key_two":"my_value_two"}
Response
application/json
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "created_at": "2019-08-24T14:15:22Z",
  "expires_at": "string",
  "metadata": {
    "my_key_one": "my_value_one",
    "my_key_two": "my_value_two"
  }
}

API Keys

Management of API keys for service access.

The capabilities an API keys has access to can be scoped to these areas:

  • API Keys
    • admin:api-keys:create
    • admin:api-keys:read
    • admin:api-keys:update
    • admin:api-keys:delete
  • Webhooks
    • admin:webhooks:create
    • admin:webhooks:read
    • admin:webhooks:delete
  • Types
    • admin:types:create
    • admin:types:ready
    • admin:types:delete
  • PCI Tokens
    • pci:tokens:create
    • pci:tokens:read
    • pci:tokens:update
    • pci:tokens:delete
    • pci:tokens:forward
  • Network Tokens
    • network:tokens:create
    • network:tokens:read
    • network:tokens:delete
    • network:tokens:use
  • Generic Tokens
    • generic:tokens:create
    • generic:tokens:read
    • generic:tokens:delete
Operations

Webhooks

Management of webhooks for event notifications.

Guardian uses tiny events as notification payload. They give you the context of what happened and you can use this information to fetch more details via our API.

Please find the documentation about the callback on the endpoint that registers the webhook.

Operations

Types

Management of types on Guardian.

Types can be used as a schema for generic token payloads, which enables futher features likes filters and validations.

Operations
Starfish GmbH & Co. KG © 2025