> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inkyswap.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Policies

> Chain selection, CORS, rate limits, precision, errors, and compatibility rules.

Base URL: `https://inkypump.com`

## Chain selection

Send `chainId` on every request.

| Network   | `chainId` |
| --------- | --------: |
| Ink       |   `57073` |
| Robinhood |    `4663` |

Some older routes still default to Ink, while newer routes reject missing chain context. A partner must not rely on either behavior.

## Browser access

Use the InkyPump read API from your server. The public read routes do not promise cross-origin browser headers for third-party sites.

InkyPump's transaction-building quote routes, captcha signing, and image upload are first-party services with stricter origin, proof, and rate checks. They are not a generic unauthenticated partner API. Contact InkyPump before using them from a third-party product.

Wallet-provider requests avoid InkyPump API CORS because they go through the connected provider. Direct browser HTTP reads still require the chosen RPC endpoint to allow that site's origin; a backend RPC avoids that browser policy.

## Authentication

Core read endpoints do not require an API key. Signature-based referral endpoints require a fresh challenge and wallet signature. Image upload requires Turnstile proof and wallet context.

Never place a private key, service-role key, or provider API key in a browser request.

## Rate limits

Limits differ by route and can change. Current examples include:

| Route                              |           Current limit basis |
| ---------------------------------- | ----------------------------: |
| Single token and batch token reads |            30 requests/minute |
| Recent V2 launches                 |            60 requests/minute |
| Tokens by owner                    |            20 requests/minute |
| xStocks quote assets               |           120 requests/minute |
| Image upload                       | Stricter IP and wallet limits |

These are abuse controls, not a guaranteed partner quota. Cache stable data, coalesce duplicate requests, and handle `429` with backoff.

## Numbers and precision

* Contract amounts are integer strings or integers in smallest units.
* Native ETH uses 18 decimals.
* Token decimals come from the token contract or asset record.
* Keep fields ending in `_exact` as decimal strings.
* Do not pass JSON numbers through floating-point arithmetic before a contract call.
* `null` means unavailable or not applicable; it does not mean zero.

## Errors

Most errors use:

```json theme={null}
{ "error": "Human-readable message" }
```

| Status | Meaning                                                |
| -----: | ------------------------------------------------------ |
|  `400` | Invalid request or unsupported chain                   |
|  `401` | Signature did not verify                               |
|  `403` | Capability, origin, or policy denied the request       |
|  `404` | Resource not indexed on that chain                     |
|  `409` | A signed state change conflicts with current state     |
|  `429` | Rate limited                                           |
|  `500` | Unexpected application error                           |
|  `503` | Required indexed evidence or dependency is unavailable |

Do not retry an unchanged `400`, `401`, `403`, or `409`. Retry safe reads after `429`, `500`, or `503` with capped exponential backoff and jitter.

## Compatibility

API objects may gain fields. Clients must ignore unknown fields and validate the fields they use. Route methods, required parameters, units, and response envelopes documented here are the current contract.

Use `/api/capabilities` to detect application releases and active deployments. Save `releaseCommit` with integration diagnostics.

## Write idempotency

On-chain creation has no HTTP idempotency key. Save the transaction hash before waiting for a receipt. After a timeout, look up that hash. Do not submit a replacement creation call unless the original transaction is known not to exist and the user confirms a new attempt.

## Verification date

The partner-facing API and contract pages were checked against production and source on September 21, 2026. Runtime capability discovery remains authoritative for deployment addresses and feature flags.