request limits
write endpoints (mutating
POST/DELETE) require a SIWE session cookie.
see reference/api#auth.
when you hit a limit:
Retry-After in seconds and X-RateLimit-*
headers. back off until the window resets. do not retry hot.
indexer freshness
each data surface has its own update latency:
if you need stronger real-time guarantees than these, subscribe to the
launch.<id> or agent.<token-address> WebSocket channel, or read
directly from chain via your own RPC.
data retention
we do not store user IPs alongside session identifiers beyond the
30-day access log window. SIWE sessions live as a single signed cookie
on the client side. invalidating a session is a server-side allowlist
flip with no underlying secret material to revoke.
error codes
all error responses follow:
{ "error": "<code>" } without the
envelope. treat both as errors and read the error field.
CORS
the API serves browser callers from any origin (Access-Control-Allow-Origin: *)
for GET endpoints. write endpoints require a SIWE session and credentialed
requests, so the response includes the explicit origin and
Access-Control-Allow-Credentials: true.
if you are calling the API from a browser, attach credentials: 'include'
on fetch for write endpoints.
caching
read endpoints are CDN-friendly. responses includeCache-Control headers
sized to the underlying data’s update rate (5s for live chart data, 60s
for holders aggregates, 5 min for twitter stats). conditional requests
(If-None-Match) are supported and return 304 when the underlying row
hasn’t changed.