​
Addresses

Hosted environments are reachable only through the team’s Tailscale network. Application routes are under /v1; /health (readiness, 200 or 503) and /health/live (process liveness) are not. The API base has no /api prefix; the browser application uses /api on its own origin. SIWE messages name the APP_ORIGIN, even when requests go to the API host.

​
Conventions

  • JSON is snake_case. Request bodies are limited to 64 KiB and reject unknown fields.
  • Amounts are decimal strings of token base units; "1000000" is one token of either six-decimal asset. Hyperliquid’s signed SendAsset.amount is in whole tokens instead.
  • Response times are RFC 3339 UTC; request deadlines are Unix seconds; x-server-time is Unix milliseconds.
  • Order IDs are 32-byte hex; other resource IDs are UUIDs. Event cursors, revisions, generations and cancellation epochs are decimal strings: keep them lossless.
  • Every response carries x-request-id and x-server-time. CORS exposes them and Retry-After to the configured app origins.

​
Authentication

Public market data needs no token. A master session comes from the SIWE challenge and verify routes. Private calls send Authorization: Bearer TOKEN. Financial operations need a master session: linking accounts, funding orders, taking, withdrawing, closing capital and managing credentials. The session authenticates the request; the linked account owner still signs the financial typed data. During the beta, an account needs access granted from the app; until then, new commitments answer ACCESS_REQUIRED. A maker credential is an mk_ bearer bound to one quote identity and its immutable signing key: A credential never moves capital, links accounts, takes or closes funded orders, and never sees balances, withdrawals or other identities. Rotation keeps the signing key and identity, replaces the bearer and deactivates current quotes. A new quote signer needs a new identity and newly funded orders.

​
Retries and recovery

Persist client_order_id, client_take_id or client_transfer_id before the first request. Repeating an ID with the same parameters returns the existing resource with 200 instead of 201; other parameters return STATE_CONFLICT. There is no Idempotency-Key header. Recover signing intents with GET /v1/orders?client_order_id=…, GET /v1/orders/{id}/preparation and GET /v1/takes/{id}. Check state and deadlines before signing a recovered intent. A venue withdrawal is deduplicated by its exact signed operation. relayed means the venue acknowledged it, not that funds arrived. unknown means it may have reached the venue: never sign a new transfer to work around it; the operator reconciles it against venue evidence. For a withdrawal followed by a take, create a transfer intent first. After a lost response, recover the transfer and its take before computing a funding shortfall: a payment may have spent the wallet balance. Only a confirmed refusal permits a new funding attempt. For live state, take a snapshot, then replay after its cursor: see Streaming and recovery.

​
Errors

Every error except /health readiness has this shape:
Branch on code, never on message. retryable is a transport hint, not permission to create a new economic intent. On 429, wait Retry-After seconds and retry the same request.

​
Limits

GET /v1/info returns the deployment’s limits and settlement timings. Defaults: Public data routes are not charged to a per-user budget.