> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aropay.aro.media/llms.txt
> Use this file to discover all available pages before exploring further.

# Echo JSON

> Unauthenticated echo probe with a **flat** response shape. Send any
valid JSON and receive it back under `echo`, useful for verifying
JSON serialization end to end. Invalid JSON returns a flat
`400 { "ok": false, "error": "<string>" }`.




## OpenAPI

````yaml /api-reference/openapi.yaml post /sandbox
openapi: 3.1.0
info:
  title: AroPay API
  version: 1.0.0
  description: |
    The AroPay API for orchestrating sealed, private payments on public
    ledgers, built on the Aro Confidential Rails (Zama Protocol FHE). The
    current deployment is an MVP sandbox for B2B users on Ethereum Sepolia,
    with Mainnet to follow.

    Every response (except the flat Sandbox probes)
    uses the shared envelope: `{ "ok": true, "data": … }` on success and
    `{ "ok": false, "error": { "code", "message", "details?" } }` on failure.

    Amounts are decimal strings in human units (e.g. `"125.50"`). Write
    requests must send `Content-Type: application/json`.
  contact:
    name: Aro Media
    url: https://aro.media
servers:
  - url: https://aropay.aro.media/api/v1
    description: Sandbox
  - url: http://aropay.localhost:3000/api/v1
    description: Local development
security:
  - apiKeyAuth: []
  - sessionCookie: []
tags:
  - name: Auth
    description: Password, TOTP, and passkey login; session inspection and logout.
  - name: Profile & security
    description: Profile, password, two-factor authentication, and passkey management.
    x-group: Profile & security
  - name: API keys
    description: Programmatic credentials. Creation and revocation are session-only.
  - name: Wallets
    description: Custodial and external (watch-only) wallets.
  - name: Balances
    description: Balance triples and lightweight gas reads.
  - name: Money movement
    description: Faucet funding, minting, transfers, and redemptions.
  - name: Transactions
    description: History, single-transaction reads, and notarized receipts.
  - name: Sandbox
    description: Unauthenticated status and echo probes with a flat response shape.
paths:
  /sandbox:
    post:
      tags:
        - Sandbox
      summary: Echo JSON
      description: |
        Unauthenticated echo probe with a **flat** response shape. Send any
        valid JSON and receive it back under `echo`, useful for verifying
        JSON serialization end to end. Invalid JSON returns a flat
        `400 { "ok": false, "error": "<string>" }`.
      operationId: echoJson
      requestBody:
        required: true
        content:
          application/json:
            schema:
              description: Any valid JSON value.
            example:
              hello: aropay
      responses:
        '200':
          description: Echoed payload.
          content:
            application/json:
              schema:
                type: object
                required:
                  - ok
                  - service
                  - version
                  - echo
                  - timestamp
                properties:
                  ok:
                    const: true
                  service:
                    type: string
                  version:
                    type: string
                  echo:
                    description: The request body, returned verbatim.
                  timestamp:
                    type: string
                    format: date-time
              example:
                ok: true
                service: aropay-sandbox
                version: v1
                echo:
                  hello: aropay
                timestamp: '2026-08-13T09:00:00.000Z'
        '400':
          description: Invalid JSON (flat shape, string error).
          content:
            application/json:
              schema:
                type: object
                required:
                  - ok
                  - error
                properties:
                  ok:
                    const: false
                  error:
                    type: string
      security: []
components:
  securitySchemes:
    apiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: aro_sk_…
      description: |
        AroPay API key, sent as `Authorization: Bearer aro_sk_…`. Created in
        the dashboard under Settings → API keys. Takes precedence over a
        session cookie when both are present.
      x-default: aro_sk_your_key_here
    sessionCookie:
      type: apiKey
      in: cookie
      name: aropay_session
      description: |
        Browser session cookie minted by `POST /auth/login` (or passkey
        login). httpOnly, `SameSite=Lax`, 24 h TTL. Endpoints marked
        **Session-only** accept only this credential and return
        `403 session_required` for API keys.

````