> ## Documentation Index > Fetch the complete documentation index at: https://docs.0xinsider.com/llms.txt > Use this file to discover all available pages before exploring further. # Prepare a staged webhook secret > Create the next signing secret for one webhook endpoint and read it once, while the current secret keeps signing every delivery. This is step 1 of a rotation with no rejected deliveries. Deploy the returned `signing_secret` to your receiver, then call [Activate a staged webhook secret](/api-reference/endpoint/activate-webhook-secret) to switch to it. Nothing about the current secret or the delivery headers changes until you do. If the response is lost, send the request again with the same `Idempotency-Key`. While the secret is still `pending`, this route returns the same secret rather than making another one. ## Parameters | Parameter | Description | | ------------------------ | -------------------------------------------------------------------------------------------------------------- | | `id` | The endpoint you are preparing a secret for. | | `Idempotency-Key` header | Optional, and up to 255 characters. Reuse it only when you are retrying this exact request, on this same `id`. | ## Key response fields | Field | Value after this call | | ------------------------------------ | -------------------------------------------------------------------------------------------- | | `signing_secret` | The prepared secret, shown in this response and nowhere else. Nothing is signed with it yet. | | `secret_rotation.status` | `pending`. | | `secret_rotation.overlap_expires_at` | `null`. The overlap starts at activation, not here. | ## Example ```bash theme={null} curl -X POST \ -H "Authorization: Bearer $OXINSIDER_API_KEY" \ -H "Idempotency-Key: webhook-prepare-2026-09-22" \ "https://api.0xinsider.com/api/v1/webhooks/42/rotate-secret/prepare" ``` ## Handle a 409 or a 422 | Answer | What it means | What to do | | -------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `409`, `error.reason` `webhook_secret_rotation_overlap_active` | An earlier rotation is still in its 1-hour overlap, so a second one cannot start. | Call [Retire a staged webhook secret](/api-reference/endpoint/retire-webhook-secret), or wait for `secret_rotation.overlap_expires_at` to pass. | | `409`, `error.reason` `idempotency_in_progress` | Your first request with this `Idempotency-Key` is still running. | Wait a few seconds, then send the same key again. | | `422`, `error.param` `Idempotency-Key` | The key was already used for a different request, such as a different endpoint `id`. | Pick a new key. One key belongs to one request. | ## What it does not do * Switch to the new secret. Deliveries keep carrying one signature, from the current secret, until you call [Activate a staged webhook secret](/api-reference/endpoint/activate-webhook-secret). * Change the endpoint's `url`, `status`, `event_types`, or `failure_count`. * Survive a URL change. Sending a new `url` to [Update a webhook](/api-reference/endpoint/update-webhook) drops the prepared secret, and you start again from here. * Return the secret later. No read carries `signing_secret`, so store this response somewhere safe. ## OpenAPI ````yaml POST /api/v1/webhooks/{id}/rotate-secret/prepare openapi: 3.1.0 info: x-generated-rate-limit-policy-from: web/src/lib/rate-limit-facts.ts via web/scripts/generate-api-policy.ts title: 0xinsider API description: >- Follow provider-exposed large-trade activity from Polymarket. Polymarket wallet-attributed trades can add grades, P&L, strategy, and diagnostic-score context when sufficient source data exists. Fields can be null or unavailable. Normal API requests use a 30-second server timeout that returns HTTP 408 Request Timeout with the standard error envelope (error.code request_timeout) when exceeded. Every /api/v1 failure answers that envelope, including a body that is not JSON or does not fit the request schema (400 invalid_body), a query or path value that does not parse (400 invalid_query, invalid_path), a missing Content-Type: application/json (415 unsupported_media_type), a body over 1048576 bytes (413 payload_too_large) and a method the path does not serve (405 method_not_allowed), each with error.param naming the field where one is known and meta.request_id equal to X-Request-Id. Unknown query names are ignored by default and reported in X-Query-Ignored, while X-Effective-Query lists the normalized names and values applied using form-urlencoded decoding, where + is a space; strict mode returns 400 bad_request with error.reason unknown_query_parameter before the handler runs, including for an unknown name with an incomplete percent escape. Public REST /api/v1/* endpoints, excluding /api/v1/mcp, use Bearer-token based non-credentialed browser CORS: any Origin may call with Authorization, Content-Type, If-None-Match, Idempotency-Key, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-Id, and X-Query-Validation request headers. X-Query-Validation: strict opts into rejecting unknown query names; the default remains compatible. Remote MCP at /api/v1/mcp is non-credentialed, but still validates Origin against the 0xinsider/localhost allowlist per MCP Streamable HTTP DNS-rebinding guidance. Successful browser CORS preflight responses advertise Access-Control-Max-Age: 86400. Browser JavaScript may read RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, the legacy X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After, ETag, X-Request-Id, X-Request-Cost, X-Usage-Accounting, X-Batch-RateLimit-Limit, X-Batch-RateLimit-Remaining, X-Batch-RateLimit-Reset, Mcp-Session-Id, X-Mcp-Error-Code, X-Query-Ignored, and X-Effective-Query response headers. Rate-limit headers describe the budget a request was counted against: the API key's per-minute window on an authenticated call, and the per-IP budget on a public route or on a refused credential (401, 402, 403, 423), so a client looping on a bad or lapsed key still sees how much room it has. Conditional GET: these operations return a weak ETag and answer If-None-Match with 304 Not Modified and an empty body: GET /api/v1/health, GET /api/v1/insider-radar, GET /api/v1/insider-radar/{id}, GET /api/v1/large-positions, GET /api/v1/leaderboard, GET /api/v1/leaderboard/trending, GET /api/v1/market/{condition_id}/candles, GET /api/v1/market/{condition_id}/intel, GET /api/v1/market/{condition_id}/snapshot, GET /api/v1/markets/explore, GET /api/v1/markets/sharp-money-flows, GET /api/v1/markets/smart-money-flows, GET /api/v1/pick-of-the-day, GET /api/v1/pick-of-the-day/archive, GET /api/v1/positions, GET /api/v1/sports-edge-observations, GET /api/v1/sports-edge-signals, GET /api/v1/trader/{address}, GET /api/v1/trader/{address}/context, GET /api/v1/trader/{address}/pnl, GET /api/v1/trader/{address}/position-timeline, GET /api/v1/traders/{trader}/position-timeline, GET /api/v1/whale-trades, GET /api/v1/whale-trades/history, GET /api/v1/whale-trades/{id}, GET /api/v1/whale-trades/{id}/counterparties/executions, GET /api/v1/whale-trades/{id}/counterparties/executions/{execution_id}/makers. Credentialed first-party routes such as /api/keys, /api/billing, and auth endpoints remain restricted to configured 0xinsider origins. Protected V1 responses, except the zero-cost /api/v1/usage route, after handler execution carry X-Usage-Accounting: persisted, failed, or unknown. This reports the usage-record write; it does not change the handler result. Do not replay a successful mutation to repair an unknown usage record. Before execution, unavailable accounting capacity returns HTTP 503 with error.reason=request_accounting_unavailable; honor Retry-After. Public API responses add the browser-readable Server-Timing header: Processing time in milliseconds, for example api;dur=12.345. Includes API authentication, quota admission, handler work and response construction. Excludes network transit and streamed body or export-file transfer. The engineering budget is strictly below 250 ms; this header reports observations, not a latency guarantee or a new timeout. version: 1.0.0 contact: name: 0xinsider email: support@0xinsider.com url: https://0xinsider.com servers: - url: https://api.0xinsider.com description: >- Production (live data). Authenticate with a live key (oxi_sk_live_...); requires an active Pro subscription. A sandbox key (oxi_sk_test_...) is answered with 401 invalid_api_key and error.reason sandbox_api_key. - url: https://0xinsider.com/sandbox description: >- Sandbox. No credential required and no production data: every documented operation answers with its documented example or a deterministic sample of its response schema. GET /api/v1/stream is the one exclusion and answers 400 there, because a Server-Sent Events stream is a live connection rather than a body. Add ?sandbox_status= to receive one of the error responses the operation documents (for example 429 with Retry-After). Documented query parameters and JSON request bodies are checked against this document, the two context.md routes answer 200 text/markdown, GET /api/v1/trader/{address}/export/download answers its 302 with a Location the sandbox serves itself rather than an object store, and nothing is stored between requests. A sandbox key (oxi_sk_test_..., issued with no account by POST https://api.0xinsider.com/api/v1/agents/register) is optional: on an operation that requires a credential, a well-formed key is answered with X-Oxi-Sandbox-Key: valid and a malformed one with 401 invalid_api_key. security: - bearerAuth: [] - oauth2: - read tags: - name: Traders description: Trader intelligence, batch lookups, timelines, and export readiness. - name: Positions description: Current prediction-market position snapshots from backend-owned mirrors. - name: Large Positions description: Largest current open positions from graded traders (Polymarket-only). - name: Large trades description: Recent and historical large trade intelligence. - name: Leaderboard description: Ranked trader discovery and category/strategy leaderboards. - name: Pick of the Day description: >- One sourced sharp-money call a day: the side profitable wallets are backing, with pre-game odds, the holders, and the track record. - name: Games description: >- Sports and esports games: both sides, schedules, provider status and the Polymarket markets linked to each game. - name: Markets description: Market search, discovery, snapshots, and sharp-money flow. - name: Content description: Search across 0xinsider editorial content. - name: Suspicious trades description: Trades whose recorded suspicion score meets the live flag threshold. - name: Insider Radar description: >- Deprecated spelling of Suspicious trades; both operations stay live as aliases. - name: Events description: Durable public event replay streams. - name: Streaming description: Resumable real-time Server-Sent Events stream of live feed envelopes. - name: Webhooks description: Signed builder webhook destinations and delivery controls. - name: Usage description: Developer API budget and usage introspection. - name: Onboarding description: >- Self-serve agent registration: a sandbox key with no account, and the path to live access. - name: System description: Health and operational status checks. - name: MCP description: Remote Model Context Protocol transport. - name: Reports description: Daily, weekly, monthly, and trader export report snapshots. - name: Account description: Identify the account and credential authenticated for a paid API request. externalDocs: description: 0xinsider API docs url: https://docs.0xinsider.com paths: /api/v1/webhooks/{id}/rotate-secret/prepare: post: tags: - Webhooks summary: Prepare a staged builder webhook signing secret description: >- Creates a pending signing secret while the current secret remains active. Deploy the returned one-time signing_secret to the receiver before calling activate. The response exposes secret_rotation.status=pending; an existing pending secret is returned again so a lost response can be recovered safely. operationId: prepareWebhookSecret parameters: - name: id in: path required: true description: Webhook endpoint id owned by the authenticated API key user. schema: type: integer format: int64 - name: Idempotency-Key in: header required: false description: >- Optional safe-retry key. Reuse the same value only when retrying the exact same mutation request body; a different body returns 422 and an in-flight matching request returns 409. schema: type: string minLength: 1 maxLength: 255 example: wh_idem_01HX7Y9ZQ4K7Z0Q2E4N6A8C1BF responses: '200': description: Webhook destination with the prepared signing secret content: application/json: schema: type: object required: - object - data - meta properties: object: type: string const: webhook data: $ref: '#/components/schemas/WebhookEndpoint' meta: $ref: '#/components/schemas/ResponseMeta' '400': description: Invalid request parameter content: application/json: schema: $ref: '#/components/schemas/ApiError' '401': description: Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/ApiError' '402': description: Active Pro subscription required content: application/json: schema: $ref: '#/components/schemas/ApiError' '403': description: Account access denied content: application/json: schema: $ref: '#/components/schemas/ApiError' '404': description: Webhook endpoint not found content: application/json: schema: $ref: '#/components/schemas/ApiError' '408': description: >- The request timed out; reuse the same Idempotency-Key to learn whether it completed content: application/json: schema: $ref: '#/components/schemas/ApiError' '409': description: >- The previous signing secret is still in its bounded overlap window; retire it before preparing another staged secret. A keyed request can also return idempotency_in_progress while the same request is running. content: application/json: schema: $ref: '#/components/schemas/ApiError' '422': description: The Idempotency-Key was already used with a different request body content: application/json: schema: $ref: '#/components/schemas/ApiError' '423': description: Account is locked content: application/json: schema: $ref: '#/components/schemas/ApiError' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/ApiError' '500': description: Unexpected server error content: application/json: schema: $ref: '#/components/schemas/ApiError' '503': description: Redis-backed authenticated rate limiter unavailable content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - bearerAuth: [] - oauth2: - webhooks x-codeSamples: - lang: curl label: cURL source: >- curl -sS \ + -X POST \ + -H "Authorization: Bearer $OXINSIDER_API_KEY" \ + -H 'Content-Type: application/json' \ + -d '{}' \ + 'https://api.0xinsider.com/api/v1/webhooks/{id}/rotate-secret/prepare' components: schemas: WebhookEndpoint: type: object required: - id - object - name - url - event_types - status - verified_at - verification_token_expires_at - failure_count - created_at - updated_at - retry_policy - secret_rotation properties: id: type: integer format: int64 object: type: string const: webhook name: type: string url: type: string format: uri event_types: type: array items: $ref: '#/components/schemas/WebhookEventType' status: $ref: '#/components/schemas/WebhookStatus' verified_at: type: string format: date-time nullable: true verification_token_expires_at: type: string format: date-time failure_count: type: integer created_at: type: string format: date-time updated_at: type: string format: date-time retry_policy: $ref: '#/components/schemas/WebhookRetryPolicy' secret_rotation: $ref: '#/components/schemas/WebhookSecretRotation' signing_secret: type: string description: >- Returned only on create, immediate rotate-secret, staged rotate-secret/prepare, or staged rotate-secret/activate. Never returned by list, get, update, delete, verify, or retire. verification: $ref: '#/components/schemas/WebhookVerification' ResponseMeta: type: object required: - request_id - cached - cost properties: request_id: type: string description: >- Unique request ID (req_ prefix). The same value as the X-Request-Id response header, the request's usage accounting row and its log lines. cached: type: boolean cache_age_s: type: integer description: >- Cache age in seconds. Omitted when the response was not cached, and also when it was cached but its age cannot be established (an entry stored before its cache carried a computed instant). Never a placeholder: an unknown age is reported as no value rather than as the cache TTL. cost: type: integer description: >- Advisory request weight (relative compute cost). 1 for simple reads; higher for heavier endpoints. Not a credit/price. ranking_generation: type: integer description: >- Committed PostgreSQL-owned leaderboard generation for the returned rows and cursor. Present on GET /api/v1/leaderboard; omitted on endpoints that do not read this ranking. ranking_as_of: type: string format: date-time description: >- Authoritative RFC3339 timestamp from cache_generations.updated_at for ranking_generation. It is read in the same repeatable-read snapshot as the leaderboard rows and is not request time, cache write time, or row insertion order. directional_source: type: string enum: - live - degraded description: >- Which path produced the team-directional read on this response. Only present on endpoints that compute one (today: GET /api/v1/sports-edge-signals). "live" means the read RAN. "degraded" means it FAILED, so nothing was measured and the ranking fell back to raw conviction. The flag describes the READ, not its consequence: a read that ran and found nothing groupable also leaves the directional fields null, and that is honestly "live" -- the per-signal nulls already say "nothing to enrich here", so this snapshot-level flag carries only what they cannot, namely whether the read ran at all. A degraded response is cached on the shorter degraded TTL so it self-heals. Reported SEPARATELY from ranking_source because the two degradations are independent -- a sharp-money DB miss weakens the ranking DATA, a directional failure removes a ranking WEIGHT -- and a consumer down-weighting a degraded response needs to know which input it lost. Omitted on endpoints that compute no directional read. ranking_source: type: string enum: - live - db_only description: >- Which ranking-data path produced this response. Only present on endpoints that can degrade a ranking (today: GET /api/v1/sports-edge-signals). "live" is the normal path (the current holder pile from the provider batch); "db_only" is the degraded fallback (a truthful but weaker trader_markets ranking) served when the live sharp-money ranking batch is unavailable (a sharp-money DB read failure, not a Polymarket outage) and cached on a shorter TTL, so a consumer can down-weight or skip it. Omitted on endpoints that never degrade. category_skill_source: type: string enum: - live - partial - degraded - unavailable description: >- Whole filtered snapshot category-evidence status before pagination. Operational live always remains partial source coverage. category_skill_model_version: type: string category_skill_taxonomy_version: type: string category_skill_platform: type: string const: polymarket category_skill_scope: type: string const: observed_goldsky_primary_taker_fill category_skill_source_coverage: type: string enum: - partial_whale_threshold_fills - graded_wallet_fills category_skill_observation_started_at: type: string format: date-time category_skill_model_operationally_degraded: type: boolean description: >- Whole-model operational readiness captured with the category model snapshot. Present on category-enriched responses even when the filtered signal list is empty. When true, category_skill_source is degraded and sports-edge-signals uses the shorter degraded cache TTL. category_skill_status_counts: type: object required: - live - insufficient - stale - unknown - degraded properties: live: type: integer minimum: 0 insufficient: type: integer minimum: 0 stale: type: integer minimum: 0 unknown: type: integer minimum: 0 degraded: type: integer minimum: 0 category_skill_base_payload_hash: type: string pattern: ^[0-9a-f]{64}$ description: >- SHA-256 of the funded signal membership/order/rank/cursor vector immediately before category-skill enrichment. Sports-edge-signals only. category_skill_enriched_base_payload_hash: type: string pattern: ^[0-9a-f]{64}$ description: >- Independent SHA-256 recomputation over the same base fields immediately after category-skill enrichment. Equality with category_skill_base_payload_hash proves shadow enrichment did not change funded inputs. Sports-edge-signals only. ApiError: type: object required: - object - error - meta properties: object: type: string const: error error: type: object required: - code - message properties: code: type: string description: >- FROZEN: an existing value never changes meaning. request_timeout (408, #16146) was added the way insufficient_scope was: the handler did not answer inside the server's 30-second timeout. Retry-After and retry_at ride on it only for a safe method (GET, HEAD); a timed-out mutation may have completed, so check its state and reuse its Idempotency-Key. enum: - bad_request - invalid_api_key - subscription_required - forbidden - insufficient_scope - not_found - account_locked - rate_limited - rate_limit_unavailable - internal_error - request_timeout message: type: string doc_url: type: string param: type: string retry_at: type: string format: date-time description: >- The recommended next request instant (RFC3339), always in the future. Present on every retryable error: `pick_not_released`, `rate_limited`, `rate_limit_unavailable`, and `read_model_warming`. Omitted otherwise. The absolute twin of `Retry-After`; prefer the header for the sleep duration. For `pick_not_released`, the earliest of the next scheduled release, the next automatic selector attempt, the operating-window start, or about 60 seconds. See that response. freshness: $ref: '#/components/schemas/FreshnessFailure' reason: type: string enum: - cursor_expired - unknown_endpoint - pick_not_released - trader_not_tracked - read_model_warming - database_unavailable - request_accounting_unavailable - idempotency_in_progress - webhook_delivery_in_progress - webhook_secret_rotation_not_prepared - webhook_secret_rotation_overlap_active - sandbox_api_key - api_key_in_query - subscription_inactive - monthly_quota_exceeded - invalid_query - unknown_query_parameter - invalid_path - invalid_body - unsupported_media_type - payload_too_large - method_not_allowed - ip_rate_limited - ip_throttled - export_expired - freshness_ceiling_unsatisfied description: >- ADDITIVE (#7209). The specific, actionable cause behind `code`, when there is one more specific than the code itself. `code` keeps its published values, so existing clients are unaffected; new clients branch on `reason`. Omitted when the code already says everything we know. pick_not_released: no Pick of the Day is published for the current product day; schedule one request against retry_at instead of polling. unknown_endpoint: the PATH is not a route on this API -- read GET /api/v1, do not retry. trader_not_tracked: the wallet is real and the URL is right, but the trader is outside the HOT/WARM sync tiers -- stop asking for this wallet. cursor_expired: pagination went stale mid-walk -- re-request the first page and continue. read_model_warming: the requested endpoint cannot serve its read model yet; exact causes are endpoint-specific and can include a cold or contended refresh or a dependency that prevented refresh. database_unavailable: the API's database or its connection pool is temporarily unreachable (a connection-class failure, not a query fault); code stays rate_limit_unavailable, nothing is rate-limited, retry after Retry-After / retry_at. idempotency_in_progress: retain the exact Idempotency-Key and request body, then retry shortly. webhook_delivery_in_progress: retry the URL or signing-secret configuration change after the destination's active request completes. request_accounting_unavailable: accounting capacity is unavailable before the handler executes; retry after Retry-After / retry_at. sandbox_api_key: the credential is a sandbox key (oxi_sk_test_) from POST /api/v1/agents/register, which only the sandbox server accepts -- call the sandbox base URL with it, or get a live key or OAuth access token; do not retry it here. api_key_in_query: the key was sent as a ?token= query parameter, which no route reads because URLs land in logs and history; the key itself was not checked -- resend it as Authorization: Bearer. subscription_inactive: the key is valid but the account's Pro subscription has lapsed (402 subscription_required); permanent until a person reactivates at https://0xinsider.com/billing, which the message names -- stop retrying on a schedule and surface the link. The key owner is emailed once per lapse. monthly_quota_exceeded: the account has used the requests Pro includes for the UTC calendar month (429 rate_limited); retry_at and Retry-After name the first of next month, the only retry that can succeed, and the message names https://0xinsider.com/developers, where pay as you go for requests over the quota is turned on. The X-Monthly-Quota-Limit, X-Monthly-Quota-Remaining and X-Monthly-Quota-Reset headers on every authenticated response say how close the account is. invalid_query, invalid_path, invalid_body (400 bad_request, #16146): a query parameter, a path segment or the JSON body did not parse or does not fit the route's schema, so no handler ran; param names the field when the parser named one (a query key, a path segment, a JSON path such as traders[0], or body); fix the request, never retry it as sent. unsupported_media_type (415 bad_request, param content-type): send the body with Content-Type: application/json. payload_too_large (413 bad_request, param body): the body is over 1048576 bytes. method_not_allowed (405 bad_request): the path is a route but not with this method; the Allow header names the methods it serves. ip_rate_limited (429 rate_limited, #16380): the per-address budget every caller behind one IP shares, counted before authentication, is spent; not the key's own window, and the RateLimit-* headers describe that bucket. ip_throttled (429 rate_limited): the address is in a cooldown after sustained over-limit traffic; Retry-After is minutes to days, and a request before it does not shorten the cooldown. meta: $ref: '#/components/schemas/ResponseMeta' WebhookEventType: type: string enum: - large_trades_inserted - whale_trades_inserted - live_sports_updated - trader_synced - whale_trader_synced - large_positions_updated - wallet_grade_changed - suspicious_trade_flagged - insider_radar_flag_raised - sharp_money_flow_detected - smart_money_flow_detected - export_job_ready - export_job_failed - export_job_expired - export_job_cancelled WebhookStatus: type: string enum: - pending_verification - active - disabled WebhookRetryPolicy: type: object required: - max_attempts - terminal_status - retry_horizon_seconds - disable_after_consecutive_failures properties: max_attempts: type: integer const: 8 terminal_status: type: string const: dead_letter retry_horizon_seconds: type: integer const: 7380 description: >- Total wait from a delivery's first failed attempt to its last retry: 60, 120, 240, 480, 960, 1920 and 3600 seconds. A delivery still failing after that is dead_letter. disable_after_consecutive_failures: type: integer const: 8 description: >- Consecutive failed attempts, across all of this endpoint's deliveries, after which the endpoint is disabled and its queued deliveries are dead-lettered. Any successful attempt resets the count. WebhookSecretRotation: type: object required: - status - overlap_expires_at properties: status: type: string enum: - idle - pending - overlap description: >- idle when no staged rotation exists, pending after prepare, and overlap after activate while both signing secrets are accepted. overlap_expires_at: type: string format: date-time nullable: true description: >- When the previous signing secret stops being emitted and accepted. null outside the overlap phase. WebhookVerification: type: object required: - token - expires_at properties: token: type: string description: >- One-time verification token returned only on create or URL change. Pass it to POST /api/v1/webhooks/{id}/verify, which activates the endpoint only when the destination also answers the signed webhook.verification challenge with a 2xx. expires_at: type: string format: date-time FreshnessFailure: type: object required: - max_age_s - data_quality_status properties: max_age_s: type: integer format: int64 minimum: 0 description: The caller's requested whole-response freshness ceiling in seconds. actual_age_s: type: integer format: int64 minimum: 0 description: >- Age in seconds of the oldest stored data_quality.as_of clock, when one is available. as_of: type: string format: date-time description: >- The oldest stored data-quality clock used to calculate actual_age_s, when one is available. data_quality_status: type: string enum: - fresh - partial - unknown - untracked - unavailable description: >- The trader body's whole-response data-quality status. Only fresh can satisfy max_age_s. securitySchemes: bearerAuth: type: http scheme: bearer description: >- API key or OAuth 2.1 access token in the Authorization header as `Bearer oxi_sk_live_...` or `Bearer oxi_at_...`. Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728). oauth2: type: oauth2 description: >- OAuth 2.1 authorization code flow with PKCE S256 for apps and MCP clients acting for a user. Public clients only (no client secret): register with RFC 7591 at https://api.0xinsider.com/oauth/register or present an https client ID metadata document URL as client_id. Authorization server metadata: https://api.0xinsider.com/.well-known/oauth-authorization-server. The access token (oxi_at_..., one hour) is sent as `Authorization: Bearer`; refresh tokens rotate on every use. A route outside the token's scopes answers 403 insufficient_scope. Walkthrough: https://0xinsider.com/auth.md. flows: authorizationCode: authorizationUrl: https://0xinsider.com/oauth/authorize tokenUrl: https://api.0xinsider.com/oauth/token refreshUrl: https://api.0xinsider.com/oauth/token scopes: read: >- Read markets, traders, large trades, positions, reports, search, the event stream and every MCP tool webhooks: Create, list, verify, rotate and delete webhook endpoints export: Start, poll and download trader exports usage: Read the caller's API usage counters ````