Most public endpoints do not require authentication. Admin and internal endpoints use bearer token auth.
The following endpoints are publicly accessible without any authentication:
GET /api/rates/[corridor]POST /api/intent/offrampGET /api/reputation/[anchor]GET /api/reputation/leaderboardGET /api/publisher/healthGET /api/snapshotGET /v1/public/scoresAdmin endpoints require the X-Admin-Key header set to the ADMIN_SECRET_KEY environment variable.
curl -s https://stellar-intel.vercel.app/api/admin/disputes \
-H 'x-admin-key: YOUR_ADMIN_SECRET_KEY'GET /api/admin/disputesPOST /api/admin/disputesPOST /api/admin/cache/invalidateInternal cron-triggered endpoints require an Authorization: Bearer CRON_SECRET header.
curl -s https://stellar-intel.vercel.app/api/publisher/tick \
-H 'authorization: Bearer YOUR_CRON_SECRET'POST /api/publisher/tickPOST /api/reputation/reconcilePOST /api/reputation/refreshThe dispute endpoint uses Ed25519 cryptographic signature verification. The request body includes a signature over the intentHash that the server verifies before accepting the dispute.
curl -sX POST https://stellar-intel.vercel.app/api/reputation/dispute \
-H 'content-type: application/json' \
-d '{
"intentHash": "abc123...",
"publicKey": "GABC...",
"signature": "base64-signature...",
"anchorId": "cowrie",
"reason": "Rate did not match quoted amount"
}'Rate limiting is applied on a per-IP basis using a fixed window algorithm. The following limits are currently enforced:
| Endpoint | Limit | Window |
|---|---|---|
| GET /api/rates/[corridor] | 90 requests | 60 seconds |
| POST /api/intent/offramp | 20 requests | 60 seconds |
| POST /api/reputation/dispute | 10 requests | 24 hours (per publicKey) |
| GET /api/publisher/health | 120 requests | 60 seconds |
| GET /v1/public/scores | 60 requests | 60 seconds |
| Other endpoints | 60 requests | 60 seconds (default) |
When a rate limit is exceeded, the API returns a 429 Too Many Requests response:
{
"code": "RATE_LIMITED",
"message": "Too many requests",
"retryAfter": 45
}The response includes a Retry-After header with the number of seconds to wait. Every rate-limited endpoint also sets X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers on both successful and 429 responses.
Cache-Control headers returned by the API