> ## Documentation Index > Fetch the complete documentation index at: https://docs.0xinsider.com/llms.txt > Use this file to discover all available pages before exploring further. # Register an agent for a sandbox key > Self-serve agent onboarding: no account, no request body, no human step. Returns a sandbox API key (oxi_sk_test_...) and the path to live access. The key works only on the sandbox server (https://0xinsider.com/sandbox/api/v1), where it is optional: send it as Authorization: Bearer to exercise the credential path, and the sandbox answers a malformed key with the production 401. Nothing is stored, so the key cannot be listed or revoked and does not expire; register again for a new one. The live API answers a sandbox key with 401 invalid_api_key and error.reason sandbox_api_key. Live data needs an account with an active Pro subscription, and either an oxi_sk_live_ key from https://0xinsider.com/developers or an OAuth access token (https://0xinsider.com/auth.md). The request body is not read. Get a sandbox API key with no account, no request body and no human step. Use it to exercise the credential path against the sandbox server before you have live access. ## What you get * A `201` with a new `oxi_sk_test_...` key on every call. Nothing is stored, so the key cannot be listed or revoked and does not expire. Register again for a new one. * The key works only on the sandbox server, `https://0xinsider.com/sandbox/api/v1`, where it is optional. Send it as `Authorization: Bearer` to exercise the credential path; a malformed key is answered with the production `401`. * The live API answers a sandbox key with `401 invalid_api_key` and `error.reason` set to `sandbox_api_key`. ## Going live Live data needs an account with an active Pro subscription and either an `oxi_sk_live_` key from [the developers page](https://0xinsider.com/developers) or an OAuth access token ([auth.md](https://0xinsider.com/auth.md)). ## OpenAPI ````yaml POST /api/v1/agents/register openapi: 3.1.0 info: x-generated-rate-limit-policy-from: web/src/lib/rate-limit-facts.ts via web/scripts/generate-api-policy.ts title: 0xinsider API description: >- Follow provider-exposed large-trade activity from Polymarket. Polymarket wallet-attributed trades can add grades, P&L, strategy, and diagnostic-score context when sufficient source data exists. Fields can be null or unavailable. Normal API requests use a 30-second server timeout that returns HTTP 408 Request Timeout with an empty body when exceeded. Public REST /api/v1/* endpoints, excluding /api/v1/mcp, use Bearer-token based non-credentialed browser CORS: any Origin may call with Authorization, Content-Type, If-None-Match, Idempotency-Key, and Mcp-Session-Id request headers. Remote MCP at /api/v1/mcp is non-credentialed, but still validates Origin against the 0xinsider/localhost allowlist per MCP Streamable HTTP DNS-rebinding guidance. Successful browser CORS preflight responses advertise Access-Control-Max-Age: 86400. Browser JavaScript may read RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, the legacy X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After, ETag, X-Request-Id, X-Request-Cost, X-Usage-Accounting, X-Batch-RateLimit-Limit, X-Batch-RateLimit-Remaining, X-Batch-RateLimit-Reset, Mcp-Session-Id, and X-Mcp-Error-Code response headers. Credentialed first-party routes such as /api/keys, /api/billing, and auth endpoints remain restricted to configured 0xinsider origins. Protected V1 responses, except the zero-cost /api/v1/usage route, after handler execution carry X-Usage-Accounting: persisted, failed, or unknown. This reports the usage-record write; it does not change the handler result. Do not replay a successful mutation to repair an unknown usage record. Before execution, unavailable accounting capacity returns HTTP 503 with error.reason=request_accounting_unavailable; honor Retry-After. version: 1.0.0 contact: name: 0xinsider email: support@0xinsider.com url: https://0xinsider.com servers: - url: https://api.0xinsider.com description: >- Production (live data). Authenticate with a live key (oxi_sk_live_...); requires an active Pro subscription. A sandbox key (oxi_sk_test_...) is answered with 401 invalid_api_key and error.reason sandbox_api_key. - url: https://0xinsider.com/sandbox description: >- Sandbox. No credential required and no production data: every documented operation answers with its documented example or a deterministic sample of its response schema. Add ?sandbox_status= to receive one of the error responses the operation documents (for example 429 with Retry-After). Request bodies and parameters are not validated, streams and file downloads are not simulated, and nothing is stored. A sandbox key (oxi_sk_test_..., issued with no account by POST https://api.0xinsider.com/api/v1/agents/register) is optional: on an operation that requires a credential, a well-formed key is answered with X-Oxi-Sandbox-Key: valid and a malformed one with 401 invalid_api_key. security: - bearerAuth: [] - oauth2: - read tags: - name: Traders description: Trader intelligence, batch lookups, timelines, and export readiness. - name: Positions description: Current prediction-market position snapshots from backend-owned mirrors. - name: Large Positions description: Largest current open positions from graded traders (Polymarket-only). - name: Whale Trades description: Recent and historical large trade intelligence. - name: Leaderboard description: Ranked trader discovery and category/strategy leaderboards. - name: Pick of the Day description: >- One sourced sharp-money call a day: the side profitable wallets are backing, with pre-game odds, the holders, and the track record. - name: Markets description: Market search, discovery, snapshots, and smart-score flow. - name: Content description: Search across 0xinsider editorial content. - name: Insider Radar description: Suspicious trading pattern flags. - name: Events description: Durable public event replay streams. - name: Streaming description: Resumable real-time Server-Sent Events stream of live feed envelopes. - name: Webhooks description: Signed builder webhook destinations and delivery controls. - name: Usage description: Developer API budget and usage introspection. - name: Onboarding description: >- Self-serve agent registration: a sandbox key with no account, and the path to live access. - name: System description: Health and operational status checks. - name: MCP description: Remote Model Context Protocol transport. - name: Reports description: Daily, weekly, monthly, and trader export report snapshots. externalDocs: description: 0xinsider API docs url: https://docs.0xinsider.com paths: /api/v1/agents/register: post: tags: - Onboarding summary: Register an agent for a sandbox key description: >- Self-serve agent onboarding: no account, no request body, no human step. Returns a sandbox API key (oxi_sk_test_...) and the path to live access. The key works only on the sandbox server (https://0xinsider.com/sandbox/api/v1), where it is optional: send it as Authorization: Bearer to exercise the credential path, and the sandbox answers a malformed key with the production 401. Nothing is stored, so the key cannot be listed or revoked and does not expire; register again for a new one. The live API answers a sandbox key with 401 invalid_api_key and error.reason sandbox_api_key. Live data needs an account with an active Pro subscription, and either an oxi_sk_live_ key from https://0xinsider.com/developers or an OAuth access token (https://0xinsider.com/auth.md). The request body is not read. operationId: registerAgent responses: '201': description: >- A new sandbox key. Every call returns a different key, with Cache-Control: private, no-store. content: application/json: schema: type: object required: - object - data - meta properties: object: type: string const: agent_registration data: $ref: '#/components/schemas/AgentRegistration' meta: $ref: '#/components/schemas/ResponseMeta' examples: success: summary: Successful response value: object: agent_registration data: api_key: >- oxi_sk_test_7c1e9a4b2d6f0835e1a7c9b4d2f60e83a5c17b9d4e2f6a0c8b3d5e715853be48 livemode: false environment: sandbox created_at: '2026-09-14T12:00:00Z' sandbox: api_base_url: https://0xinsider.com/sandbox/api/v1 first_request_url: https://0xinsider.com/sandbox/api/v1/leaderboard openapi_url: https://0xinsider.com/sandbox/api/v1/openapi.json live_access: api_base_url: https://api.0xinsider.com/api/v1 requirement: >- An 0xinsider account with an active Pro subscription. A person creates a live key (oxi_sk_live_) at api_keys_url, or approves an OAuth grant for a client registered at oauth_registration_endpoint. api_keys_url: https://0xinsider.com/developers oauth_authorization_server_metadata_url: >- https://api.0xinsider.com/.well-known/oauth-authorization-server oauth_registration_endpoint: https://api.0xinsider.com/oauth/register pricing_url: https://0xinsider.com/pricing auth_guide_url: https://0xinsider.com/auth.md meta: request_id: req_example cached: false cost: 1 '408': description: >- Request exceeded the server's 30-second transport timeout. The timeout response has an empty body because it is generated before handler-level JSON error shaping. x-empty-body: true '429': description: >- Rate limit exceeded. Two independent budgets. (1) 100 requests/minute per user (sliding window), on every authenticated route. (2) On the BATCH routes only: 2500 batch item units/minute per user, reserved before any item is executed. A batch with N requested items costs N item units, including duplicate and invalid items. 2500 = 100 requests x 25 items per batch, which is the most item work a key can buy through the request limiter at all: a caller may spend their entire 100-request minute on full 25-item batches without the item budget being what stops them. The REQUEST budget is the effective ceiling, and batching is never the more expensive choice. The item budget can still deny at a sliding-window boundary (both counters carry the previous window forward with a floor, and the item counter runs 25x the request counter), so honor a 429 from either. Over-quota batches return 429 with Retry-After plus RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset before any item work is done. headers: Retry-After: description: Seconds until rate limit resets. schema: type: integer RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-RateLimit-Limit: schema: type: integer X-RateLimit-Remaining: schema: type: integer X-RateLimit-Reset: schema: type: integer X-Request-Id: schema: type: string content: application/json: schema: $ref: '#/components/schemas/ApiError' '500': description: Unexpected server error content: application/json: schema: $ref: '#/components/schemas/ApiError' security: [] x-codeSamples: - lang: curl label: cURL source: curl -sS -X POST 'https://api.0xinsider.com/api/v1/agents/register' components: schemas: AgentRegistration: type: object description: >- A sandbox key and the path to live access (#13959). Nothing is stored: the key cannot be listed or revoked and does not expire. Register again for a new one. required: - api_key - livemode - environment - created_at - sandbox - live_access properties: api_key: type: string pattern: ^oxi_sk_test_[0-9a-f]{64}$ description: >- The sandbox key. Send it as Authorization: Bearer to the sandbox. The last 8 hex characters are a checksum (the first 4 bytes of SHA-256 over the rest of the key), so the sandbox can tell a mistyped key from a real one. It is not a secret and unlocks no production data. livemode: type: boolean const: false description: 'Always false: this key never reaches live data.' environment: type: string const: sandbox created_at: type: string format: date-time sandbox: type: object required: - api_base_url - first_request_url - openapi_url properties: api_base_url: type: string format: uri description: >- The sandbox V1 base URL. Every documented operation answers here with example data. first_request_url: type: string format: uri description: A read to send with the key. openapi_url: type: string format: uri description: The OpenAPI document, served by the sandbox. live_access: type: object description: >- What live data needs, and where each credential comes from. Both need a person: an account with an active Pro subscription. required: - api_base_url - requirement - api_keys_url - oauth_authorization_server_metadata_url - oauth_registration_endpoint - pricing_url - auth_guide_url properties: api_base_url: type: string format: uri description: The production V1 base URL. requirement: type: string description: What a live credential needs, in one sentence. api_keys_url: type: string format: uri description: Where a signed-in Pro user creates a live key (oxi_sk_live_). oauth_authorization_server_metadata_url: type: string format: uri description: >- RFC 8414 authorization server metadata, for an OAuth 2.1 grant the user approves. oauth_registration_endpoint: type: string format: uri description: RFC 7591 dynamic client registration for public OAuth clients. pricing_url: type: string format: uri description: The Pro plan. auth_guide_url: type: string format: uri description: The authentication walkthrough for agents. ResponseMeta: type: object required: - request_id - cached - cost properties: request_id: type: string description: Unique request ID (req_ prefix). cached: type: boolean cache_age_s: type: integer nullable: true description: >- Cache age in seconds. Omitted when the response was not cached, and also when it was cached but its age cannot be established (an entry stored before its cache carried a computed instant). Never a placeholder: an unknown age is reported as no value rather than as the cache TTL. cost: type: integer description: >- Advisory request weight (relative compute cost). 1 for simple reads; higher for heavier endpoints. Not a credit/price. ranking_generation: type: integer nullable: true description: >- Committed PostgreSQL-owned leaderboard generation for the returned rows and cursor. Present on GET /api/v1/leaderboard; omitted on endpoints that do not read this ranking. ranking_as_of: type: string format: date-time nullable: true description: >- Authoritative RFC3339 timestamp from cache_generations.updated_at for ranking_generation. It is read in the same repeatable-read snapshot as the leaderboard rows and is not request time, cache write time, or row insertion order. directional_source: type: string enum: - live - degraded description: >- Which path produced the team-directional read on this response. Only present on endpoints that compute one (today: GET /api/v1/sports-edge-signals). "live" means the read RAN. "degraded" means it FAILED, so nothing was measured and the ranking fell back to raw conviction. The flag describes the READ, not its consequence: a read that ran and found nothing groupable also leaves the directional fields null, and that is honestly "live" -- the per-signal nulls already say "nothing to enrich here", so this snapshot-level flag carries only what they cannot, namely whether the read ran at all. A degraded response is cached on the shorter degraded TTL so it self-heals. Reported SEPARATELY from ranking_source because the two degradations are independent -- a smart-money DB miss weakens the ranking DATA, a directional failure removes a ranking WEIGHT -- and a consumer down-weighting a degraded response needs to know which input it lost. Omitted on endpoints that compute no directional read. ranking_source: type: string enum: - live - db_only description: >- Which ranking-data path produced this response. Only present on endpoints that can degrade a ranking (today: GET /api/v1/sports-edge-signals). "live" is the normal path (the current holder pile from the provider batch); "db_only" is the degraded fallback (a truthful but weaker trader_markets ranking) served when the live sharp-money ranking batch is unavailable (a smart-money DB read failure, not a Polymarket outage) and cached on a shorter TTL, so a consumer can down-weight or skip it. Omitted on endpoints that never degrade. category_skill_source: type: string enum: - live - partial - degraded - unavailable description: >- Whole filtered snapshot category-evidence status before pagination. Operational live always remains partial source coverage. category_skill_model_version: type: string category_skill_taxonomy_version: type: string category_skill_platform: type: string const: polymarket category_skill_scope: type: string const: observed_goldsky_primary_taker_fill category_skill_source_coverage: type: string enum: - partial_whale_threshold_fills - graded_wallet_fills category_skill_observation_started_at: type: string format: date-time category_skill_model_operationally_degraded: type: boolean description: >- Whole-model operational readiness captured with the category model snapshot. Present on category-enriched responses even when the filtered signal list is empty. When true, category_skill_source is degraded and sports-edge-signals uses the shorter degraded cache TTL. category_skill_status_counts: type: object required: - live - insufficient - stale - unknown - degraded properties: live: type: integer minimum: 0 insufficient: type: integer minimum: 0 stale: type: integer minimum: 0 unknown: type: integer minimum: 0 degraded: type: integer minimum: 0 category_skill_base_payload_hash: type: string pattern: ^[0-9a-f]{64}$ description: >- SHA-256 of the funded signal membership/order/rank/cursor vector immediately before category-skill enrichment. Sports-edge-signals only. category_skill_enriched_base_payload_hash: type: string pattern: ^[0-9a-f]{64}$ description: >- Independent SHA-256 recomputation over the same base fields immediately after category-skill enrichment. Equality with category_skill_base_payload_hash proves shadow enrichment did not change funded inputs. Sports-edge-signals only. ApiError: type: object required: - object - error - meta properties: object: type: string const: error error: type: object required: - code - message properties: code: type: string enum: - bad_request - invalid_api_key - subscription_required - forbidden - not_found - account_locked - rate_limited - rate_limit_unavailable - internal_error message: type: string doc_url: type: string nullable: true param: type: string nullable: true retry_at: type: string format: date-time nullable: true description: >- The recommended next request instant (RFC3339), always in the future. Present on every retryable error: `pick_not_released`, `rate_limited`, `rate_limit_unavailable`, and `read_model_warming`. Omitted otherwise. The absolute twin of `Retry-After`; prefer the header for the sleep duration. For `pick_not_released`, the earliest of the next scheduled release, the next automatic selector attempt, the operating-window start, or about 60 seconds. See that response. reason: type: string enum: - cursor_expired - unknown_endpoint - pick_not_released - trader_not_tracked - read_model_warming - database_unavailable - request_accounting_unavailable - idempotency_in_progress - webhook_delivery_in_progress - sandbox_api_key - subscription_inactive nullable: true description: >- ADDITIVE (#7209). The specific, actionable cause behind `code`, when there is one more specific than the code itself. `code` keeps its published values, so existing clients are unaffected; new clients branch on `reason`. Omitted when the code already says everything we know. pick_not_released: no Pick of the Day is published for the current product day; schedule one request against retry_at instead of polling. unknown_endpoint: the PATH is not a route on this API -- read GET /api/v1, do not retry. trader_not_tracked: the wallet is real and the URL is right, but the trader is outside the HOT/WARM sync tiers -- stop asking for this wallet. cursor_expired: pagination went stale mid-walk -- re-request the first page and continue. read_model_warming: the requested endpoint cannot serve its read model yet; exact causes are endpoint-specific and can include a cold or contended refresh or a dependency that prevented refresh. database_unavailable: the API's database or its connection pool is temporarily unreachable (a connection-class failure, not a query fault); code stays rate_limit_unavailable, nothing is rate-limited, retry after Retry-After / retry_at. idempotency_in_progress: retain the exact Idempotency-Key and request body, then retry shortly. webhook_delivery_in_progress: retry the URL or signing-secret configuration change after the destination's active request completes. request_accounting_unavailable: accounting capacity is unavailable before the handler executes; retry after Retry-After / retry_at. sandbox_api_key: the credential is a sandbox key (oxi_sk_test_) from POST /api/v1/agents/register, which only the sandbox server accepts -- call the sandbox base URL with it, or get a live key or OAuth access token; do not retry it here. subscription_inactive: the key is valid but the account's Pro subscription has lapsed (402 subscription_required); permanent until a person reactivates at https://0xinsider.com/billing, which the message names -- stop retrying on a schedule and surface the link. The key owner is emailed once per lapse. meta: $ref: '#/components/schemas/ResponseMeta' headers: RateLimit-Limit: description: >- Authenticated V1 per-user request limit for the current sliding window. Standard RateLimit header spelling. schema: type: integer example: 100 RateLimit-Remaining: description: >- Authenticated V1 requests remaining in the current sliding window after this response. Standard RateLimit header spelling. schema: type: integer example: 84 RateLimit-Reset: description: >- Number of seconds until the authenticated V1 request window resets. Standard RateLimit header spelling. schema: type: integer example: 42 securitySchemes: bearerAuth: type: http scheme: bearer description: >- API key or OAuth 2.1 access token in the Authorization header as `Bearer oxi_sk_live_...` or `Bearer oxi_at_...`. Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728). oauth2: type: oauth2 description: >- OAuth 2.1 authorization code flow with PKCE S256 for apps and MCP clients acting for a user. Public clients only (no client secret): register with RFC 7591 at https://api.0xinsider.com/oauth/register or present an https client ID metadata document URL as client_id. Authorization server metadata: https://api.0xinsider.com/.well-known/oauth-authorization-server. The access token (oxi_at_..., one hour) is sent as `Authorization: Bearer`; refresh tokens rotate on every use. A route outside the token's scopes answers 403 insufficient_scope. Walkthrough: https://0xinsider.com/auth.md. flows: authorizationCode: authorizationUrl: https://0xinsider.com/oauth/authorize tokenUrl: https://api.0xinsider.com/oauth/token refreshUrl: https://api.0xinsider.com/oauth/token scopes: read: >- Read markets, traders, large trades, positions, reports, search, the event stream and every MCP tool webhooks: Create, list, verify, rotate and delete webhook endpoints export: Start, poll and download trader exports usage: Read the caller's API usage counters ````