Model
Ledger-local vocabulary
Define stable string codes for assets, actions, and scenes so each balance movement carries your product language.
- Accounts use your external IDs
- Each ledger is isolated
- Meta carries support context
Product capabilities
Balance API features for reliable app-defined value
Accounts and balances are the visible surface. Transfers, records, time boundaries, scopes, and recovery make the system operable.
Transfer
N-to-M zero-sum movement
Submit one or more sources and destinations. XferAPI checks that totals match for every asset before work begins.
- Positive integer base units
- Stable transfer ID and scene
- Source and destination grouping
Time
Start and expiry boundaries
Destination value can begin later or expire at an exclusive Unix-second boundary.
- Current and future totals
- Permanent amount view
- Batch-level time windows
Platform
Platform account ranges
Use configured negative IDs for issuance, spending, fees, or settlement. Entry points can distribute writes deterministically.
- Configured per ledger
- Overdraft allowed by design
- Concrete bucket IDs remain inspectable
Operations
Boundaries that remain visible
Use the console and HTTP API to understand configuration and movement state without exposing internal ledger IDs to service-key clients.
Durable transfers and records
Read lifecycle state and account mutations without reconstructing the outcome from application logs.
Inspection recovery
A database-backed worker revisits stale intermediate transfers and follows the valid completion or reversal path.
Workspace and API access
People use workspace roles; backend services use keys restricted to one ledger and explicit scopes.
Two delivery models
Use the standard hosted API, or discuss an XferAPI-managed private deployment for a separate operating boundary.