Conventions

Naming, dates, locales, store types, headers.

Updated 2026-05-24
2 min read

JSON field naming

All field names are snake_case in both requests and responses. UUIDs are strings (no special encoding). Timestamps are ISO 8601 with timezone (2026-05-24T14:32:01Z).

Store types

  • appstore: Apple App Store
  • playstore: Google Play Store

Locales

Pass locales as BCP-47 strings. en-US, tr-TR, de-DE, pt-BR. The full list of supported locales mirrors what the App Store and Play Store accept.

Country codes

Two-letter ISO 3166-1 alpha-2. US, TR, JP. We uppercase whatever you send.

Headers we send back

  • X-API-Version: always 1 on this surface.
  • X-Request-Id: UUID per request; echoes your value if you send one.
  • X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset: quota state.
  • Location: set on 201/202 responses pointing at the new (or polled) resource.

Headers we expect from you

  • Authorization: Bearer fvk_live_...: required on every authenticated route.
  • Content-Type: application/json: required on POST/PATCH bodies.
  • X-Request-Id: optional. Send one to trace your call through our logs.

CORS

The API responds to OPTIONS with permissive CORS headers. Bearer tokens never travel in cookies, so cross-origin browser calls are safe. But you should still treat fvk_live_* keys as secrets and call from a server when possible.