> ## Documentation Index > Fetch the complete documentation index at: https://docs.0xinsider.com/llms.txt > Use this file to discover all available pages before exploring further. # API reference > Learn how to authenticate, read responses, use IDs, and handle limits across the API. Use this page for the rules shared by the public API. Each endpoint page explains what it returns, its parameters, and the limits that affect your client. Most data routes return JSON. Markdown, streaming, redirect, and MCP routes describe their response formats on their own pages. ## Base URL ``` https://api.0xinsider.com/api/v1/ ``` For example data, use `https://0xinsider.com/sandbox/api/v1/`. The [sandbox](/sandbox) needs no key and returns no production data. ## Authentication Send your credential in the `Authorization` header: ``` Authorization: Bearer oxi_sk_live_... ``` | Credential | Access | | - | - | | Default API key, starting with `oxi_sk_live_` | It can access all API routes while the account has active Pro or Max access. | | Integration API key, starting with `oxi_sk_live_` | It can access routes allowed by its `read`, `webhooks`, `export`, and `usage` scopes while the account has active Pro or Max access. | | OAuth access token, starting with `oxi_at_` | It can access routes allowed by its granted scopes. | | Sandbox key, starting with `oxi_sk_test_` | It works only in the sandbox. The live API returns `401` with `error.reason: "sandbox_api_key"`. | | Key sent in `?token=` | Authenticated routes return `401` with `error.reason: "api_key_in_query"`. Public routes ignore it. Use the header instead. | These routes need no credential: * `GET /api/v1` * `GET /api/v1/openapi.json` * `GET /api/v1/coverage` and its deprecated alias `GET /api/v1/platforms` * `GET /api/v1/health` * `GET /api/v1/pick-of-the-day/ledger` * `POST /api/v1/agents/register` Public routes ignore credentials you send. [Authentication](/authentication) explains how to create and manage credentials. ## The envelope A JSON object response contains its type, data, and request metadata: ```json theme={null} { "object": "trader", "data": { ... }, "meta": { "request_id": "req_example", "cached": false, "cost": 1 } } ``` A paginated list also includes the information needed for the next page: ```json theme={null} { "object": "list", "data": [ ... ], "has_more": true, "next_cursor": "", "meta": { "request_id": "req_example", "cached": false, "cost": 1 } } ``` | Field | Meaning | | - | - | | `object` | It names the response type, such as `trader`, `usage`, `list`, or `error`. | | `data` | It contains the object or list you requested. | | `has_more` | It tells you whether more matching rows are available. | | `next_cursor` | Send this value as `cursor` to continue. Ordinary lists omit it on the last page; event replay returns a cursor for later reads too. See [Pagination](/concepts/pagination). | | `meta.request_id` | Include this ID when reporting a problem. | | `meta.cached` | It says whether this response came from a cache. `meta.cache_age_s` reports the cache age when known. | | `meta.cost` | It is an advisory request weight, not a price. | Errors use `object: "error"` and an `error` object. [Errors](/errors) explains the codes, reasons, and recovery actions. ## Prefixed IDs Use the IDs returned by the API. Prefixes identify what each ID refers to. | Entity | Prefix | Other accepted identifiers | | - | - | - | | Trader | `trd_` | Trader paths also accept a wallet address or Polymarket username. | | Market | `mkt_` | The `/market/{condition_id}/...` paths also accept a raw Polymarket `condition_id`. | | Large trade | `wt_` | Trade detail paths also accept the raw integer ID. | | Suspicious-trade flag | `rf_` | Flag detail paths also accept the raw integer ID. | | Request | `req_` | Use it to identify a request in support or logs. | The batch market routes, `POST /markets/flow/batch` and deprecated `POST /markets/intel/batch`, accept raw `condition_id` values only. ## Query parameters By default, an endpoint ignores query parameter names it does not recognize. On `200` and `304` responses, these headers tell you which parameters it used: | Header | Meaning | | - | - | | `X-Query-Ignored` | It lists ignored names, sorted, percent-encoded, and separated by commas. It is absent when every name was recognized. | | `X-Effective-Query` | It lists applied names and values, sorted by name and percent-encoded. A clamped `limit` appears as its effective value. It is absent when no names were recognized. | During development, send `X-Query-Validation: strict` to catch misspelled filters. An unknown name then returns `400` with `error.code: "bad_request"`, `error.reason: "unknown_query_parameter"`, and the name in `error.param`. ## Rate limits | Budget | Limit | | - | - | | Authenticated requests | 100 per minute per account, measured in a sliding window. | | Batch items | 2,500 per minute per account, counting each requested item. | | Monthly requests | Pro includes 500,000 and Max includes 2,000,000 per UTC calendar month. Pay as you go allows up to 4 times the included allowance; otherwise requests above the included quota return `429` from October 1, 2026. | | `GET /usage` and `GET /me` | These share a separate allowance of 100 reads per minute per account. They spend none of the regular request budgets. | | Requests from one IP address | 1,200 per minute across callers, counted before authentication. | | `GET /health` | This public route also has a limit of 120 per minute per IP address. | Authenticated responses carry `RateLimit-*`, `X-RateLimit-*`, and `X-Monthly-Quota-*` headers. Every API response carries `X-Request-Id`; when a JSON envelope is present, it matches `meta.request_id`. Read `Retry-After` on a `429` or `503`, a `404` with `pick_not_released`, or a `408` from a `GET` or `HEAD`. A timed-out write request has no retry time because it may have completed. [Rate limits](/rate-limits) explains headers, monthly quota, and retry behavior. ## Timeout A request that takes more than 30 seconds returns `408 Request Timeout` with `error.code: "request_timeout"`. For `GET` or `HEAD`, wait according to `Retry-After` before retrying. For a write request, check the resource's state before repeating it because the original request may have completed on the server. ## Browser CORS Browser clients can call the REST API from any origin using the `Authorization` header. Send no cookies or `credentials: "include"`. The browser can cache a successful preflight for 24 hours. | Direction | Headers | | - | - | | Allowed on the request | `Authorization`, `Content-Type`, `If-None-Match`, `Idempotency-Key`, `Mcp-Session-Id`, `Mcp-Protocol-Version`, `Last-Event-ID`, `X-Query-Validation` | | Readable in JavaScript | `RateLimit-*`, `X-RateLimit-*`, `X-Monthly-Quota-*`, `Retry-After`, `ETag`, `X-Request-Id`, `X-Request-Cost`, `X-Batch-RateLimit-*`, `X-Usage-Accounting`, `X-Query-Ignored`, `X-Effective-Query`, `Mcp-Session-Id`, `X-Mcp-Error-Code`, `Deprecation`, `Link`, `Server-Timing` | [Remote MCP](/api-reference/endpoint/remote-mcp) has an additional `Origin` check. The live server accepts only its listed 0xinsider origins; loopback origins are accepted only outside production. Requests without an `Origin` header can use the normal MCP credential flow. ## Trust metadata Request `expand=trust` on trader, batch trader, or market snapshot routes to get `source`, `freshness`, `reconciliation`, and `completeness` information for supported values. Read these fields before an automated action depends on a number. Keep unavailable values unavailable. Converting them to `0`, `[]`, or `{}` would change "unknown" into a claim that the value is zero or empty. [Trust metadata](/concepts/trust-metadata) explains each state. ## What the reference does not cover * Internal `/api/*` routes used by `0xinsider.com`. They use session cookies and can change without notice. * Full order-book depth. Market snapshots include only the best bid and ask. * Exchanges other than Polymarket. Polymarket is the only provider. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.