API overview

One base URL, plain JSON, public reads with no key at all.

Everything the app draws from is a public HTTP endpoint under https://win-trader.com/api. There is no key to request and no plan to sign up for. Reads are GET and public, writes act only on the caller's own account, and no endpoint here can open a position or move money.

The data is on chain, and this API is an index of it that answers faster than a node would. The base URL, which every path below hangs off:

https://win-trader.com/api

The shape of it

Every response is JSON. Reads are GET, and every read is public.
Writes are POST or DELETE, and every write acts on the caller's own account. They need either a session token or a wallet signature over the request; see Authentication.
Nothing here places a trade. Trades are transactions signed by your wallet and submitted to the chain, and no endpoint on this host can open or close a position or move money.

Numbers

Amounts and prices are integers scaled by 1e7 and sent as decimal strings, not JSON numbers: "1000000000" is 100 USDC. Borrow and funding indices are scaled by 1e14. Rates and margins are basis points, so 500 is 5%. Timestamps are ISO strings. All of it is the contracts' own convention, which is why it is also the API's.

Parse the scaled strings as BigInt, not Number. At this scale a position's size or a funding index can pass Number.MAX_SAFE_INTEGER.

Caching

The hot public reads are cached at the edge for as long as the app itself polls them: prices for 1s, a market for 2s, all markets for 5s, the leaderboard's first page and a rank lookup for 5s, later leaderboard pages for 15s, and the Vault's two series for 5s, 15s or 60s by bucket width. Polling faster than that returns the same answer. Everything else is served no-store.

Errors

The body of an error is { "error": "..." }. The codes you will meet:

400 bad_interval: A candle interval that is not one of the six allowed widths.
400 bad_request: A body or query that is missing a field or has the wrong shape.
401 unauthorized: A write without a valid session bearer, or with a token minted for another purpose.
402 payment_required: A name change that is no longer free and has no paid credit behind it.
404 not_found: A market, the vault or the config row that is not there.
404 not_ranked: A rank lookup for an address that has never traded, or for the Vault.
409 name_taken: Somebody else holds that name.
410 expired: A signed message whose timestamp is outside its window.

A profile is never a 404: an address nobody has used resolves to null fields.

Realtime

There is no socket and no event stream on this host. The app polls: prices every second, markets every five, positions every two, and it leans on the edge cache to make that cheap. If you are building on this, do the same.