API reference

Use this page for the rules shared by the public API. Each endpoint page explains what it returns, its parameters, and the limits that affect your client. Most data routes return JSON. Markdown, streaming, redirect, and MCP routes describe their response formats on their own pages.

Base URL

https://api.0xinsider.com/api/v1/

For example data, use https://0xinsider.com/sandbox/api/v1/. The sandbox needs no key and returns no production data.

Authentication

Send your credential in the Authorization header:

Authorization: Bearer oxi_sk_live_...

Credential	Access
Default API key, starting with `oxi_sk_live_`	It can access all API routes while the account has active Pro or Max access.
Integration API key, starting with `oxi_sk_live_`	It can access routes allowed by its `read`, `webhooks`, `export`, and `usage` scopes while the account has active Pro or Max access.
OAuth access token, starting with `oxi_at_`	It can access routes allowed by its granted scopes.
Sandbox key, starting with `oxi_sk_test_`	It works only in the sandbox. The live API returns `401` with `error.reason: "sandbox_api_key"`.
Key sent in `?token=`	Authenticated routes return `401` with `error.reason: "api_key_in_query"`. Public routes ignore it. Use the header instead.

These routes need no credential:

GET /api/v1
GET /api/v1/openapi.json
GET /api/v1/coverage and its deprecated alias GET /api/v1/platforms
GET /api/v1/health
GET /api/v1/pick-of-the-day/ledger
POST /api/v1/agents/register

Public routes ignore credentials you send. Authentication explains how to create and manage credentials.

The envelope

A JSON object response contains its type, data, and request metadata:

{
  "object": "trader",
  "data": { ... },
  "meta": { "request_id": "req_example", "cached": false, "cost": 1 }
}

A paginated list also includes the information needed for the next page:

{
  "object": "list",
  "data": [ ... ],
  "has_more": true,
  "next_cursor": "<opaque cursor>",
  "meta": { "request_id": "req_example", "cached": false, "cost": 1 }
}

Field	Meaning
`object`	It names the response type, such as `trader`, `usage`, `list`, or `error`.
`data`	It contains the object or list you requested.
`has_more`	It tells you whether more matching rows are available.
`next_cursor`	Send this value as `cursor` to continue. Ordinary lists omit it on the last page; event replay returns a cursor for later reads too. See Pagination.
`meta.request_id`	Include this ID when reporting a problem.
`meta.cached`	It says whether this response came from a cache. `meta.cache_age_s` reports the cache age when known.
`meta.cost`	It is an advisory request weight, not a price.

Errors use object: "error" and an error object. Errors explains the codes, reasons, and recovery actions.

Prefixed IDs

Use the IDs returned by the API. Prefixes identify what each ID refers to.

Entity	Prefix	Other accepted identifiers
Trader	`trd_`	Trader paths also accept a wallet address or Polymarket username.
Market	`mkt_`	The `/market/{condition_id}/...` paths also accept a raw Polymarket `condition_id`.
Large trade	`wt_`	Trade detail paths also accept the raw integer ID.
Suspicious-trade flag	`rf_`	Flag detail paths also accept the raw integer ID.
Request	`req_`	Use it to identify a request in support or logs.

The batch market routes, POST /markets/flow/batch and deprecated POST /markets/intel/batch, accept raw condition_id values only.

Query parameters

By default, an endpoint ignores query parameter names it does not recognize. On 200 and 304 responses, these headers tell you which parameters it used:

Header	Meaning
`X-Query-Ignored`	It lists ignored names, sorted, percent-encoded, and separated by commas. It is absent when every name was recognized.
`X-Effective-Query`	It lists applied names and values, sorted by name and percent-encoded. A clamped `limit` appears as its effective value. It is absent when no names were recognized.

During development, send X-Query-Validation: strict to catch misspelled filters. An unknown name then returns 400 with error.code: "bad_request", error.reason: "unknown_query_parameter", and the name in error.param.

Rate limits

Budget	Limit
Authenticated requests	100 per minute per account, measured in a sliding window.
Batch items	2,500 per minute per account, counting each requested item.
Monthly requests	Pro includes 500,000 and Max includes 2,000,000 per UTC calendar month. Pay as you go allows up to 4 times the included allowance; otherwise requests above the included quota return `429` from October 1, 2026.
`GET /usage` and `GET /me`	These share a separate allowance of 100 reads per minute per account. They spend none of the regular request budgets.
Requests from one IP address	1,200 per minute across callers, counted before authentication.
`GET /health`	This public route also has a limit of 120 per minute per IP address.

Authenticated responses carry RateLimit-*, X-RateLimit-*, and X-Monthly-Quota-* headers. Every API response carries X-Request-Id; when a JSON envelope is present, it matches meta.request_id. Read Retry-After on a 429 or 503, a 404 with pick_not_released, or a 408 from a GET or HEAD. A timed-out write request has no retry time because it may have completed. Rate limits explains headers, monthly quota, and retry behavior.

Timeout

A request that takes more than 30 seconds returns 408 Request Timeout with error.code: "request_timeout". For GET or HEAD, wait according to Retry-After before retrying. For a write request, check the resource’s state before repeating it because the original request may have completed on the server.

Browser CORS

Browser clients can call the REST API from any origin using the Authorization header. Send no cookies or credentials: "include". The browser can cache a successful preflight for 24 hours.

Direction	Headers
Allowed on the request	`Authorization`, `Content-Type`, `If-None-Match`, `Idempotency-Key`, `Mcp-Session-Id`, `Mcp-Protocol-Version`, `Last-Event-ID`, `X-Query-Validation`
Readable in JavaScript	`RateLimit-`, `X-RateLimit-`, `X-Monthly-Quota-`, `Retry-After`, `ETag`, `X-Request-Id`, `X-Request-Cost`, `X-Batch-RateLimit-`, `X-Usage-Accounting`, `X-Query-Ignored`, `X-Effective-Query`, `Mcp-Session-Id`, `X-Mcp-Error-Code`, `Deprecation`, `Link`, `Server-Timing`

Remote MCP has an additional Origin check. The live server accepts only its listed 0xinsider origins; loopback origins are accepted only outside production. Requests without an Origin header can use the normal MCP credential flow.

Trust metadata

Request expand=trust on trader, batch trader, or market snapshot routes to get source, freshness, reconciliation, and completeness information for supported values. Read these fields before an automated action depends on a number. Keep unavailable values unavailable. Converting them to 0, [], or {} would change “unknown” into a claim that the value is zero or empty. Trust metadata explains each state.

What the reference does not cover

Internal /api/* routes used by 0xinsider.com. They use session cookies and can change without notice.
Full order-book depth. Market snapshots include only the best bid and ask.
Exchanges other than Polymarket. Polymarket is the only provider.

Overview

Objects

Discovery

Traders

Positions

Games

Markets

Content

Pick of the Day

Whale trades

Suspicious trades

Events

Streaming

Usage

Webhooks

Reports

System

Base URL

Authentication

The envelope

Prefixed IDs

Query parameters

Rate limits

Timeout

Browser CORS

Trust metadata

What the reference does not cover

​Base URL

​Authentication

​The envelope

​Prefixed IDs

​Query parameters

​Rate limits

​Timeout

​Browser CORS

​Trust metadata

​What the reference does not cover

Base URL

Authentication

The envelope

Prefixed IDs

Query parameters

Rate limits

Timeout

Browser CORS

Trust metadata

What the reference does not cover