Reference

HTTP API

The app's JSON endpoints. Public reads need nothing; account reads need a wallet session.

All endpoints return JSON and Cache-Control: no-store. Errors return { "error": { "code", "message", "requestId" } }.

Public#

Endpoint	Returns
`GET /api/markets`	The configured markets: mints, program addresses, fee, oracle bounds, and whether each is open for orders
`GET /api/market-state?marketId=<market address>`	The chain's current view of a market: oracle price and age, the sixteen positions, what the book is computing, the session calendar, totals and accrued fees
`GET /api/mids`	Display midpoints from Pyth for the listed xStocks
`GET /api/calendar`	The next 35 days of US regular sessions in UTC, computed for the administrator to publish
`GET /api/health`	`200` with `status: "ready"` when every market is open, or `"waiting"` while the programs or a market are still being set up; `503` with `"unavailable"` when the database, RPC or worker fails, the RPC is on another cluster, or a market disagrees with the chain
`GET /api/health/live`	`200` while the process is up
`GET /api/status`	The same report as `/api/health`, always `200`
`POST /api/rpc`	The app's Solana RPC: a fixed set of JSON-RPC read and send methods, forwarded for the app's own pages only

POST /api/auth/challenge with { "wallet" } returns { challengeId, message }.
Sign message with the wallet (a message signature, not a transaction).
POST /api/auth/verify with { challengeId, signature } (base58) sets an HTTP-only session cookie for eight hours.

GET /api/session returns the signed-in wallet, and POST /api/auth/logout ends the session. Requests that change state must come from the app's own origin.

Signed in#

Endpoint	Returns
`GET /api/account`	Your vault balances (and whether your vault is registered for matching), your orders with their status, and your fills
`POST /api/orders`	Records a finalized order transaction with its encrypted envelope. The server checks the envelope against the signed transaction on chain
`GET /api/remaining?marketId=&orderId=&nonce=&offset=`	The indexed encrypted answer to one of your remaining-size reads, for your browser to verify and decrypt

The server never receives an order's terms in the clear and holds no key to decrypt them.