fix things

app/controllers/api/v1/money_transactions_controller.rb

@@ -51,6 +51,7 @@ class Api::V1::MoneyTransactionsController < Api::V1::BaseController
     end
 
     def money_transaction_params
-        params.require(:money_transaction).permit(:creditor_id, :debitor_id, :amount, :paid_at)
+        p = params.require(:data).permit(:type, attributes: %i[amount paid_at], relationships: %i[creditor_id debitor_id])
+        p[:attributes].merge(p[:relationships]) if p[:type] == 'money_transaction'
     end
 end

config/initializers/cors.rb

 Rails.application.config.middleware.insert_before 0, Rack::Cors do
     allow do
       origins '*'
-      resource '/*', headers: :any, methods: :get
+      resource '/*', headers: :any, methods: %i(get post put patch delete options head)
     end
    
     allow do