Developers · REST + GraphQL · 5 resource groups · OpenAPI 3.1

The EquiFlow API · one base URL

Everything the dashboard reads is exposed here. Markets, positions, liquidations, oracle, account abstraction — same indexer, same numbers, no auth dance. Keys ship signed in a single header.

BASE URLhttps://api.equiflow.io/v1

Resources

5

markets · positions · liquidations · oracle · aa

Endpoints

15

documented · OpenAPI 3.1 spec

Webhooks

4 events

HMAC-SHA256 signed

First call · 60 seconds

# Get every listed asset
curl -s https://api.equiflow.io/v1/markets \
  -H "X-EquiFlow-Key: $EF_KEY" | jq '.data[].symbol'

# → "TSLA"
# → "NVDA"
# → "AAPL"
# → "MSFT"
# → "GOOGL"
# → "AMZN"
# → "META"
# → "SPY"

>> 8 assets · 142 ms · cached at edge · no rate-limit hit

Authentication · one header

An API key in the X-EquiFlow-Key header.

Generate a key from the developer dashboard. Keys are scoped — a read-only key cannot hit /aa/userop. Rotate them anytime; old keys keep working for 5 minutes after rotation.

Header nameX-EquiFlow-Key
Key formatef_live_… (live) · ef_test_… (testnet)
Scopesread · simulate · sponsor · webhook
Rotationinstant · 5min grace on prev key

>> EXAMPLES / auth.shNEVER COMMIT KEYS

# 1 · export the key once per shell
export EF_KEY="ef_live_a09b3c4d2…"

# 2 · authenticated GET
curl -s https://api.equiflow.io/v1/portfolio/0xA73d…2cC1 \
  -H "X-EquiFlow-Key: $EF_KEY"

# 3 · scope check — 403 if your key is read-only
curl -s -X POST https://api.equiflow.io/v1/aa/userop \
  -H "X-EquiFlow-Key: $EF_KEY" \
  -H "Content-Type: application/json" \
  -d @userop.json

# missing / invalid key
# → HTTP/2 401
# → { "code":"unauthorized","message":"missing X-EquiFlow-Key" }

# scope mismatch
# → HTTP/2 403
# → { "code":"forbidden","required":"sponsor","have":["read"] }

Endpoint catalogue · 15 entries · grouped by resource

Every route, documented.

LISTED ASSETS · ORACLE METADATA

/markets

3 ENDPOINTS · OPENAPI ↗

Read-only catalogue of every collateral asset the vault supports — LTV bands, oracle binding, listing status. Cached at the edge for 15 s.

GET/marketsList every asset listed by the vault. Returns LTV, liquidation threshold, stale window, current price.

Query / path params · 3

Name	Type	Required	Description
status	string	optional	filter by 'listed' \| 'paused' \| 'delisted'
limit	int	optional	1–200 · default 50
cursor	string	optional	opaque pagination cursor from prev response

>> REQUEST

curl -s https://api.equiflow.io/v1/markets?status=listed \
  -H "X-EquiFlow-Key: $EF_KEY"

>> RESPONSE · 200 OKapplication/json

{
  "data": [
    {
      "symbol": "TSLA",
      "token": "0x91f2…b4Ae",
      "feedId": "0x16d…a92c",
      "priceUsd": "256.4180",
      "ltvBps": 6500,
      "liqThresholdBps": 7500,
      "staleAfterSec": 60,
      "totalCollateralUsd": "4218904.55",
      "status": "listed"
    },
    {
      "symbol": "NVDA",
      "token": "0xD81e…F022",
      "priceUsd": "118.9100",
      "ltvBps": 6500,
      "liqThresholdBps": 7500,
      "totalCollateralUsd": "7194028.10",
      "status": "listed"
    }
  ],
  "cursor": null,
  "fetchedAt": "2026-05-20T14:02:11Z"
}

GET/markets/:symbolSingle market detail. Includes 24h price open / high / low / close and per-asset utilisation.

Query / path params · 2

Name	Type	Required	Description
symbol	string	REQUIRED	ticker — TSLA, NVDA, AAPL, …
window	string	optional	'24h' \| '7d' \| '30d' for the OHLC block

>> REQUEST

curl -s https://api.equiflow.io/v1/markets/TSLA?window=24h \
  -H "X-EquiFlow-Key: $EF_KEY"

>> RESPONSE · 200 OKapplication/json

{
  "symbol": "TSLA",
  "token": "0x91f2…b4Ae",
  "priceUsd": "256.4180",
  "ohlc24h": {
    "open": "253.91",
    "high": "258.20",
    "low":  "251.07",
    "close":"256.42"
  },
  "ltvBps": 6500,
  "liqThresholdBps": 7500,
  "borrowedAgainstUsd": "812044.20",
  "collateralLockedUsd":"4218904.55",
  "utilizationBps": 1925
}

GET/markets/:symbol/historyHourly price + utilisation series. Up to 30 days. Use for charts that don't need WebSocket.

Query / path params · 4

Name	Type	Required	Description
symbol	string	REQUIRED	asset ticker
from	iso8601	optional	inclusive start — defaults to 24h ago
to	iso8601	optional	exclusive end — defaults to now
resolution	string	optional	'1m' \| '5m' \| '1h' \| '1d'

>> REQUEST

curl -s "https://api.equiflow.io/v1/markets/TSLA/history?resolution=1h&from=2026-05-19T00:00Z" \
  -H "X-EquiFlow-Key: $EF_KEY"

>> RESPONSE · 200 OKapplication/json

{
  "symbol": "TSLA",
  "resolution": "1h",
  "candles": [
    { "ts": "2026-05-19T00:00Z", "o":"251.10","h":"252.40","l":"250.88","c":"252.01","utilBps":1844 },
    { "ts": "2026-05-19T01:00Z", "o":"252.01","h":"253.55","l":"251.94","c":"253.22","utilBps":1851 }
  ],
  "truncated": false
}

Rate limits · 3 tiers · token-bucket with burst

Pick a tier. Watch the headers.

X-RATELIMIT-* ON EVERY RESPONSE

Free

$0 / mo

Per minute60 req

Per day50,000 req

Burst100 req

WebSockets1 concurrent

All read endpoints · public testnet · 1 webhook

MOST DEVS

Pro

$199 / mo

Per minute600 req

Per day1,000,000 req

Burst1,200 req

WebSockets8 concurrent

/portfolio/simulate · /aa/userop · 25 webhooks · email support

Enterprise

custom

Per minute10,000 req

Per day25,000,000 req

Burst30,000 req

WebSockets64 concurrent

Dedicated paymaster · uptime SLA 99.99% · solidity team on call

How the headers work

Every response carries three headers describing the bucket. When the bucket drains, the API returns 429 Too Many Requests with a Retry-After in seconds. Burst recharges at the per-minute rate.

X-RateLimit-Limitceiling for this tier
X-RateLimit-Remainingtokens left in the bucket
X-RateLimit-Resetepoch when full ceiling returns
Retry-Afterset on 429 · seconds to wait

# 1 · normal response
HTTP/2 200
X-RateLimit-Limit:     600
X-RateLimit-Remaining: 593
X-RateLimit-Reset:     1747746541
Content-Type:          application/json

# 2 · 429 once the bucket drains
HTTP/2 429
X-RateLimit-Limit:     600
X-RateLimit-Remaining: 0
X-RateLimit-Reset:     1747746601
Retry-After:           14

{
  "code":"rate_limited",
  "message":"bucket exhausted",
  "tier":"pro",
  "retryAfterSec":14
}

Webhooks · 4 events · HMAC-SHA256 signed

Push, don't poll.

DELIVERED AT-LEAST-ONCE · 6 RETRIES OVER 24H

Event	When it fires	Suggested handler	Payload preview
position.opened	Fires when pledgeAndBorrow seals on-chain.	Light up notifications, mark CRM stage, kick off a welcome flow.	{ "event":"position.opened", "id":"evt_01HXX9YA…", "data":{ "user":"0xA73d…2cC1", "borrowedUsd":"3200.00", "collateralUsd":"12840.50", "hf":1.087 }, "createdAt":"2026-05-20T14:02:11Z" }
position.liquidated	Fires once the Liquidated log is indexed (1 block confirm).	Pause user-facing flows, notify support, trigger autopilot reload.	{ "event":"position.liquidated", "data":{ "user":"0xCC42…4488", "liquidator":"0x9b…0a4f", "debtRepaidUsd":"2805.00", "bonusUsd":"140.25", "txHash":"0x88a4…f201" } }
oracle.divergence	Fires when on-chain cached price drifts ≥ 75 bps from Pyth.	Pause new borrows for the asset · alert risk channel.	{ "event":"oracle.divergence", "data":{ "symbol":"NVDA", "onchainUsd":"117.18", "pythUsd":"118.91", "deltaBps":146 } }
gov.proposal	Fires for every state change on the governor (queued, executed, vetoed).	Mirror to Discord · auto-update treasury dashboards.	{ "event":"gov.proposal", "data":{ "id":"EIP-EF-014", "state":"queued", "eta":"2026-05-23T14:02:11Z", "title":"Lower liquidation bonus to 4.5%" } }

Signing · X-EquiFlow-Signature

Every delivery includes a header of the form t=…,v1=… — concatenate the timestamp + body, HMAC-SHA256 with your endpoint secret, compare in constant time. Reject deliveries older than 5 minutes to defeat replay.

AlgorithmHMAC-SHA256
HeaderX-EquiFlow-Signature
Timestamp tolerance±300 s
Replay protectionid (idempotent · 24h dedup)

// Express handler — verify, then dispatch
import crypto from "node:crypto";

app.post("/wh/equiflow", express.raw({ type: "*/*" }), (req, res) => {
  const sig = req.header("X-EquiFlow-Signature") ?? "";
  const [tPart, v1Part] = sig.split(",");
  const ts = Number(tPart.split("=")[1]);
  const v1 = v1Part.split("=")[1];

  if (Math.abs(Date.now() / 1000 - ts) > 300) return res.sendStatus(408);

  const signed = `${ts}.${req.body.toString("utf8")}`;
  const expected = crypto
    .createHmac("sha256", process.env.EF_WH_SECRET!)
    .update(signed)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) {
    return res.sendStatus(401);
  }

  const { event, data } = JSON.parse(req.body.toString("utf8"));
  // dispatch …
  res.sendStatus(200);
});

Status · 30 day window

Operational. No active incidents.

status.equiflow.io ↗

ABOVE 99.95% SLA

Daily health · 30 days

28 nominal · 2 degraded · 0 outage

nominaldegradedoutage

−21dDEGRADED

Degraded · oracle update latency

Pyth attestations stalled for 7 min. No reads failed. Mitigated by adapter fallback cache.

−7dDEGRADED

Degraded · /aa/userop queue depth

Bundler queue spiked to 380 ops. 4 ops dropped + retried. Capacity increased post-incident.