Skip to main content
GET
cURL
A flag is a review target, not proof of insider trading. It means one recorded trade scored 60 or more on a heuristic. That heuristic reads how new the wallet is, how large the trade is, how far its price sits from the crowd, and how many new wallets bought the same side of a quiet market. Use this route to build a review queue. To open one row, use Suspicious trade. To get a push the moment a trade crosses the floor, subscribe to the suspicious_trade_flagged webhook event. This is the canonical route since September 23, 2026. Insider Radar is its deprecated alias and returns the same rows, the same rf_ ids, and the same cursors.

Parameters

Stable paging

Trades are rescored and the scores are republished, so paging in live mode can show you a row twice or skip one. mode=stable fixes that: the cursor it returns carries one published scoring run along with limit, min_suspicion, and severity. Send mode=stable on the first request, then send each next_cursor back with the same mode and the same filters. If the scores are republished while you are paging, or you change a filter, you get 400 with error.reason cursor_expired. Request page 1 again with the same filters, because waiting does not revive the cursor.

Key response fields

The row schema is named SuspiciousTrade in the OpenAPI document. It was named RadarFlag before September 23, 2026, and not one field changed with the name.

Example

What it does not return

  • Proof of insider trading. A flag says one trade matched a heuristic worth a human look, and nothing more.
  • A row under 60. Even min_suspicion=0 returns only trades that crossed the flag floor.
  • A watch row. The filter is accepted for compatibility and always comes back empty.
  • The trade itself. size_usd, price, side, and the wallets on the other side are on Whale trade. Both routes key on the same raw whale_alerts.id, so the integer inside an rf_ id opens the trade.
  • A Deprecation header. This is the canonical route. The deprecated alias sends one.

Caching

Send the ETag from a response back in an If-None-Match header. If the list has not changed, you get 304 Not Modified with an empty body.

Authorizations

Authorization
string
header
required

Legacy default or named integration API key, or OAuth 2.1 access token, in the Authorization header as Bearer oxi_sk_live_... or Bearer oxi_at_.... Default keys retain full access; integration keys are limited to their approved read, webhooks, export and usage scopes and expire within 90 days. All credentials share the owner's account limits. Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728).

Headers

X-Query-Validation
enum<string>

Opt into strict query-name validation. The default is compatible: unknown names are ignored and reported in X-Query-Ignored. With strict, an unknown name returns 400 bad_request with error.reason unknown_query_parameter before the handler runs.

Available options:
strict
If-None-Match
string

Conditional GET validator from a previous ETag. Matching values return 304 Not Modified with an empty body.

Query Parameters

limit
integer
default:20

Maximum number of suspicious trades to return.

Required range: 1 <= x <= 100
cursor
string

Pagination cursor from previous response.

min_suspicion
number
default:0

Minimum suspicion score (0-100). The live flag floor of 60 also applies.

severity
enum<string>

Compatible filter. flag selects live threshold crossings. watch returns no rows because no live watch policy exists.

Available options:
flag,
watch
mode
enum<string>
default:live

Pagination mode. live (default) keeps the 120-second response cache; stable pins the walk to one published scoring generation and binds the cursor to the limit and filters.

Available options:
live,
stable

Response

Suspicious trades list

object
string
required
Allowed value: "list"
data
object[]
required
has_more
boolean
required
meta
object
required
next_cursor
string
total
integer

Total matching rows when the read model exposes a count; the key is absent when it does not.