API reference

Every /api/v1/* endpoint shares one base URL, one authentication header, one response envelope, one set of rate limits, and one timeout. An endpoint page states only what differs on that endpoint.

Base URL

https://api.0xinsider.com/api/v1/

The sandbox is https://0xinsider.com/sandbox/api/v1/. It needs no key and serves no production data.

Authentication

Authorization: Bearer oxi_sk_live_...

Credential	Works where
`oxi_sk_live_` default API key	Every route, on an account with an active Pro subscription.
`oxi_sk_live_` integration API key	The routes inside its `read`, `webhooks`, `export`, or `usage` scopes, on an account with active Pro.
`oxi_at_` OAuth access token	The routes inside its scopes
`oxi_sk_test_` sandbox key	The sandbox only. The live API answers `401` with `error.reason` `sandbox_api_key`.
A key in `?token=`	Nowhere. Every route that needs a key answers `401` with `error.reason` `api_key_in_query`, and the public routes ignore it.

Six routes need no credential: GET /api/v1, /openapi.json, /coverage (and its deprecated alias /platforms), /health, /pick-of-the-day/ledger, and POST /agents/register. A key sent to one of them is ignored rather than refused. Authentication covers the rest.

The envelope

Every single object comes back in the same shape:

{
  "object": "trader",
  "data": { ... },
  "meta": { "request_id": "req_example", "cached": false, "cost": 1 }
}

A list adds the cursor:

{
  "object": "list",
  "data": [ ... ],
  "has_more": true,
  "next_cursor": "<opaque cursor>",
  "meta": { "request_id": "req_example", "cached": false, "cost": 1 }
}

Field	Meaning
`object`	The shape of `data`: `trader`, `usage`, `list`, `error`, and so on.
`has_more`	Another page exists. Lists only.
`next_cursor`	Send it back as `cursor` to get the next page. It is absent on the last page. See Pagination.
`meta.request_id`	Quote it in a support request.
`meta.cached`	The response came from a cache. `meta.cache_age_s` says how old it is, when that is known.
`meta.cost`	An advisory weight for the call. It is not a price.

An error uses the same envelope with "object": "error". Errors lists all 11 codes and 24 reasons.

Prefixed IDs

Entity	Prefix	The path also takes
Trader	`trd_`	A raw address or a Polymarket username
Market	`mkt_`	A raw `condition_id`, on every `/market/{condition_id}/...` route
Whale trade	`wt_`	The raw integer
Radar flag	`rf_`	The raw integer
Request	`req_`

POST /markets/flow/batch (and its deprecated alias POST /markets/intel/batch) takes raw condition_id values only.

Query parameters

By default a query parameter the endpoint does not publish is ignored, and the request runs with the names that are left. A 200 or a 304 then reports what happened in two headers.

Header	What it carries
`X-Query-Ignored`	The names the endpoint does not publish, comma separated, sorted, and percent encoded. Absent when every name was recognized.
`X-Effective-Query`	The query string the endpoint applied: recognized names and values only, sorted by name and percent encoded. A `limit` outside the route’s bounds appears as the clamped value the page used. Absent when nothing was recognized.

Send X-Query-Validation: strict to turn a misspelled parameter into an error instead. An unrecognized name then answers 400 bad_request with error.reason unknown_query_parameter before the handler runs, and error.param names it. Send the header while you are building, so a filter that silently did nothing shows up as an error rather than as a wrong result.

Rate limits

Budget	Size
Requests	100 a minute per account, sliding window
Batch items	2,500 a minute, one per requested item
Monthly	250,000 requests a UTC calendar month. Over that: pay as you go up to 1,000,000 a month, or `429` with `error.reason` `monthly_quota_exceeded` from October 1, 2026.
`GET /usage` and `GET /me`	A separate budget of 100 reads a minute per account, shared by the two. Neither spends anything else.
`GET /health`	Public, and 120 a minute per IP address

Every authenticated response carries RateLimit-*, X-RateLimit-*, X-Monthly-Quota-*, and X-Request-Id. X-Request-Id is on every /api/v1 response, authenticated or not, and it equals meta.request_id in the body. Retry-After comes on 4 errors: every 429, every 503, a 404 with pick_not_released, and a 408 on a GET or HEAD. A timed-out mutation carries none. Rate limits has the full header list and the retry code.

Timeout

The server gives a request 30 seconds. Past that you get 408 Request Timeout in the standard envelope, with error.code set to request_timeout. A GET or HEAD carries Retry-After. A mutation does not, because it may have completed on the server: check its state before you repeat it.

Browser CORS

Any origin may call /api/v1/* with the Authorization header. Do not send cookies or credentials: "include". The preflight is cached for 24 hours.

Direction	Headers
Allowed on the request	`Authorization`, `Content-Type`, `If-None-Match`, `Idempotency-Key`, `Mcp-Session-Id`, `Mcp-Protocol-Version`, `Last-Event-ID`, `X-Query-Validation`
Readable in JavaScript	`RateLimit-`, `X-RateLimit-`, `X-Monthly-Quota-`, `Retry-After`, `ETag`, `X-Request-Id`, `X-Request-Cost`, `X-Batch-RateLimit-`, `X-Usage-Accounting`, `X-Query-Ignored`, `X-Effective-Query`, `Mcp-Session-Id`, `X-Mcp-Error-Code`, `Deprecation`, `Link`, `Server-Timing`

Remote MCP at /api/v1/mcp is also non-credentialed, and it checks the Origin header against the 0xinsider and localhost allowlist.

Trust metadata

expand=trust on the trader, batch trader, and market snapshot routes attaches 4 objects to each value Polymarket owns: source, freshness, reconciliation, and completeness. Read them before an automated action depends on a number. Never turn an unavailable value into 0, [], or {}. The API does not substitute a default for a value Polymarket did not return, and neither should you. Trust metadata has the vocabulary.

What the reference does not cover

The internal /api/* routes behind 0xinsider.com. They use a session cookie and change without notice.
The order book. A market snapshot’s top of book is all the depth you get.
Any exchange other than Polymarket. Every row comes from Polymarket.

Overview

Objects

Discovery

Traders

Positions

Games

Markets

Content

Pick of the Day

Whale trades

Suspicious trades

Events

Streaming

Usage

Webhooks

Reports

System

Base URL

Authentication

The envelope

Prefixed IDs

Query parameters

Rate limits

Timeout

Browser CORS

Trust metadata

What the reference does not cover

​Base URL

​Authentication

​The envelope

​Prefixed IDs

​Query parameters

​Rate limits

​Timeout

​Browser CORS

​Trust metadata

​What the reference does not cover

Base URL

Authentication

The envelope

Prefixed IDs

Query parameters

Rate limits

Timeout

Browser CORS

Trust metadata

What the reference does not cover