> ## Documentation Index > Fetch the complete documentation index at: https://docs.0xinsider.com/llms.txt > Use this file to discover all available pages before exploring further. # Redirect OpenAPI Spec > Unauthenticated API-origin compatibility redirect to the canonical web-origin OpenAPI JSON document at https://0xinsider.com/api/v1/openapi.json. Resolve the canonical OpenAPI document from the API origin. Returns a temporary redirect to the web-origin spec at `https://0xinsider.com/api/v1/openapi.json`. One spec, one owner, still discoverable from the API origin. ```bash theme={null} curl -I "https://api.0xinsider.com/api/v1/openapi.json" ``` Use the `Location` header as the canonical OpenAPI URL for code generation and docs tooling. ## OpenAPI ````yaml GET /api/v1/openapi.json openapi: 3.1.0 info: x-generated-rate-limit-policy-from: web/src/lib/rate-limit-facts.ts via web/scripts/generate-api-policy.ts title: 0xinsider API description: >- Follow provider-exposed large-trade activity from Polymarket and Kalshi. Polymarket wallet-attributed trades can add grades, P&L, strategy, and diagnostic-score context when sufficient source data exists; Kalshi public prints remain anonymous, and fields can be null or unavailable. Normal API requests use a 30-second server timeout that returns HTTP 408 Request Timeout with an empty body when exceeded. Public REST /api/v1/* endpoints, excluding /api/v1/mcp, use Bearer-token based non-credentialed browser CORS: any Origin may call with Authorization, Content-Type, If-None-Match, Idempotency-Key, and Mcp-Session-Id request headers. Remote MCP at /api/v1/mcp is non-credentialed, but still validates Origin against the 0xinsider/localhost allowlist per MCP Streamable HTTP DNS-rebinding guidance. Successful browser CORS preflight responses advertise Access-Control-Max-Age: 86400. Browser JavaScript may read X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After, ETag, X-Request-Id, X-Request-Cost, X-Batch-RateLimit-Limit, X-Batch-RateLimit-Remaining, X-Batch-RateLimit-Reset, Mcp-Session-Id, and X-Mcp-Error-Code response headers. Credentialed first-party routes such as /api/keys, /api/billing, and auth endpoints remain restricted to configured 0xinsider origins. version: 1.0.0 contact: name: 0xinsider email: support@0xinsider.com url: https://0xinsider.com servers: - url: https://api.0xinsider.com description: >- Production (live data). Authenticate with a live key (oxi_sk_live_...); requires an active Pro subscription. security: - bearerAuth: [] tags: - name: Traders description: Trader intelligence, batch lookups, timelines, and export readiness. - name: Positions description: Current prediction-market position snapshots from backend-owned mirrors. - name: Large Positions description: Largest current open positions from graded traders (Polymarket-only). - name: Whale Trades description: Recent and historical large trade intelligence. - name: Leaderboard description: Ranked trader discovery and category/strategy leaderboards. - name: Pick of the Day description: >- One sourced sharp-money call a day: the side proven smart money is backing, with pre-game odds, the proven holders, and the track record. - name: Markets description: Market search, discovery, snapshots, and smart-score flow. - name: Insider Radar description: Suspicious trading pattern detection. - name: Events description: Durable public event replay streams. - name: Streaming description: Resumable real-time Server-Sent Events stream of live feed envelopes. - name: Webhooks description: Signed builder webhook destinations and delivery controls. - name: Usage description: Developer API budget and usage introspection. - name: System description: Health and operational status checks. - name: MCP description: Remote Model Context Protocol transport. - name: Reports description: Daily, weekly, monthly, and trader export report snapshots. paths: /api/v1/openapi.json: get: tags: - System summary: Redirect to the canonical OpenAPI spec description: >- Unauthenticated API-origin compatibility redirect to the canonical web-origin OpenAPI JSON document at https://0xinsider.com/api/v1/openapi.json. operationId: redirectApiOpenapiSpec responses: '307': description: Temporary redirect to the canonical web-origin OpenAPI spec. headers: Location: description: Canonical OpenAPI spec URL. schema: type: string format: uri const: https://0xinsider.com/api/v1/openapi.json example: https://0xinsider.com/api/v1/openapi.json '408': $ref: '#/components/responses/RequestTimeout' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/InternalError' security: [] x-codeSamples: - lang: Shell label: cURL source: curl -I 'https://api.0xinsider.com/api/v1/openapi.json' components: responses: RequestTimeout: description: >- Request exceeded the server's 30-second transport timeout. The timeout response has an empty body because it is generated before handler-level JSON error shaping. RateLimited: description: >- Rate limit exceeded. Two independent budgets. (1) 100 requests/minute per user (sliding window), on every authenticated route. (2) On the BATCH routes only: 2500 batch item units/minute per user, reserved before any item is executed. A batch with N requested items costs N item units, including duplicate and invalid items. 2500 = 100 requests x 25 items per batch, which is the most item work a key can buy through the request limiter at all: a caller may spend their entire 100-request minute on full 25-item batches without the item budget being what stops them. The REQUEST budget is the effective ceiling, and batching is never the more expensive choice. The item budget can still deny at a sliding-window boundary (both counters carry the previous window forward with a floor, and the item counter runs 25x the request counter), so honor a 429 from either. Over-quota batches return 429 with Retry-After before any item work is done. headers: Retry-After: description: Seconds until rate limit resets. schema: type: integer X-RateLimit-Limit: schema: type: integer X-RateLimit-Remaining: schema: type: integer X-RateLimit-Reset: schema: type: integer X-Request-Id: schema: type: string content: application/json: schema: $ref: '#/components/schemas/ApiError' InternalError: description: Unexpected server error content: application/json: schema: $ref: '#/components/schemas/ApiError' schemas: ApiError: type: object required: - object - error - meta properties: object: type: string const: error error: type: object required: - code - message properties: code: type: string enum: - bad_request - invalid_api_key - subscription_required - forbidden - not_found - account_locked - rate_limited - rate_limit_unavailable - internal_error message: type: string doc_url: type: string nullable: true param: type: string nullable: true retry_at: type: string format: date-time nullable: true description: >- The recommended next retry instant (RFC3339). Present on every retryable error (reason=pick_not_released, code=rate_limited, code=rate_limit_unavailable, reason=read_model_warming) and omitted otherwise. Always in the future. For pick_not_released: before the 11:00 UTC operating-window start, before a selected pick's stored release, or after a skipped day, it names the automatic system's next boundary. While no candidate exists in the live window it normally names the persisted next automatic selector attempt (~15m). Every value is advisory under supported operator actions: manual publication, release-time override, or admin generation can make a pick available first. When the automatic schedule is absent/due or a pick is overdue it degrades to ~60s. Schedule one request and do not poll. Prefer Retry-After for the duration because it is immune to client clock skew. reason: type: string enum: - cursor_expired - unknown_endpoint - pick_not_released - trader_not_tracked - read_model_warming - idempotency_in_progress - webhook_delivery_in_progress nullable: true description: >- ADDITIVE (#7209). The specific, actionable cause behind `code`, when there is one more specific than the code itself. `code` keeps its published values, so existing clients are unaffected; new clients branch on `reason`. Omitted when the code already says everything we know. pick_not_released: no Pick of the Day is published for the current product day; schedule one request against retry_at instead of polling. unknown_endpoint: the PATH is not a route on this API -- read GET /api/v1, do not retry. trader_not_tracked: the wallet is real and the URL is right, but the trader is outside the HOT/WARM sync tiers -- stop asking for this wallet. cursor_expired: pagination went stale mid-walk -- re-request the first page and continue. read_model_warming: the requested endpoint cannot serve its read model yet; exact causes are endpoint-specific and can include a cold or contended refresh or a dependency that prevented refresh. idempotency_in_progress: retain the exact Idempotency-Key and request body, then retry shortly. webhook_delivery_in_progress: retry the URL or signing-secret configuration change after the destination's active request completes. meta: $ref: '#/components/schemas/ResponseMeta' ResponseMeta: type: object required: - request_id - cached - cost properties: request_id: type: string description: Unique request ID (req_ prefix). cached: type: boolean cache_age_s: type: integer nullable: true description: Cache age in seconds, null if not cached. cost: type: integer description: >- Advisory request weight (relative compute cost). 1 for simple reads; higher for heavier endpoints. Not a credit/price. directional_source: type: string enum: - live - degraded description: >- Which path produced the team-directional read on this response. Only present on endpoints that compute one (today: GET /api/v1/sports-edge-signals). "live" means the read RAN. "degraded" means it FAILED, so nothing was measured and the ranking fell back to raw conviction. The flag describes the READ, not its consequence: a read that ran and found nothing groupable also leaves the directional fields null, and that is honestly "live" -- the per-signal nulls already say "nothing to enrich here", so this snapshot-level flag carries only what they cannot, namely whether the read ran at all. A degraded response is cached on the shorter degraded TTL so it self-heals. Reported SEPARATELY from ranking_source because the two degradations are independent -- a smart-money DB miss weakens the ranking DATA, a directional failure removes a ranking WEIGHT -- and a consumer down-weighting a degraded response needs to know which input it lost. Omitted on endpoints that compute no directional read. ranking_source: type: string enum: - live - db_only description: >- Which ranking-data path produced this response. Only present on endpoints that can degrade a ranking (today: GET /api/v1/sports-edge-signals). "live" is the normal path (the current holder pile from the provider batch); "db_only" is the degraded fallback (a truthful but weaker trader_markets ranking) served when the live sharp-money ranking batch is unavailable (a smart-money DB read failure, not a Polymarket outage) and cached on a shorter TTL, so a consumer can down-weight or skip it. Omitted on endpoints that never degrade. category_skill_source: type: string enum: - live - partial - degraded - unavailable description: >- Whole filtered snapshot category-evidence status before pagination. Operational live always remains partial source coverage. category_skill_model_version: type: string category_skill_taxonomy_version: type: string category_skill_platform: type: string const: polymarket category_skill_scope: type: string const: observed_goldsky_primary_taker_fill category_skill_source_coverage: type: string const: partial_whale_threshold_fills category_skill_observation_started_at: type: string format: date-time category_skill_model_operationally_degraded: type: boolean description: >- Whole-model operational readiness captured with the category model snapshot. Present on category-enriched responses even when the filtered signal slate is empty. When true, category_skill_source is degraded and sports-edge-signals uses the shorter degraded cache TTL. category_skill_status_counts: type: object required: - live - insufficient - stale - unknown - degraded properties: live: type: integer minimum: 0 insufficient: type: integer minimum: 0 stale: type: integer minimum: 0 unknown: type: integer minimum: 0 degraded: type: integer minimum: 0 category_skill_base_payload_hash: type: string pattern: ^[0-9a-f]{64}$ description: >- SHA-256 of the funded signal membership/order/rank/cursor vector immediately before category-skill enrichment. Sports-edge-signals only. category_skill_enriched_base_payload_hash: type: string pattern: ^[0-9a-f]{64}$ description: >- Independent SHA-256 recomputation over the same base fields immediately after category-skill enrichment. Equality with category_skill_base_payload_hash proves shadow enrichment did not change funded inputs. Sports-edge-signals only. securitySchemes: bearerAuth: type: http scheme: bearer description: >- API key authentication. Send your key in the Authorization header as `Bearer oxi_sk_live_...`. Live keys require an active Pro subscription and return live data. ````