Build on the den.
Third-party product API: markets, signals, wallets and order books on Polymarket and Kalshi, over JSON with an API key. Insydr web, iOS, and Android use a signed-in user session instead — never put an Insydr API key in a mobile binary.
Getting started
Grab a key from Dashboard → Settings → API keys, send it as x-api-key, then ping a shared market route. Service availability and incident updates live at /status and GET /v1/app/status.
Authentication
Commercial API traffic uses x-api-key. Issued keys look like insydr_<prefix>.<secret>. A user session Authorization: Bearer is the first-party web/mobile app — it is not billed as API-key usage.
Rate limits
These buckets apply to API-key traffic. Signed-in Insydr apps use a separate first-party limit and never consume your commercial monthly quota. Over the line you'll get 429 with a Retry-After header. Current usage rides on every response in X-RateLimit-Remaining.
Signals
The core resource. Every signal ships with its full evidence trail — the wallets, the timing, the size. The fox points; your code decides.
Markets
Search and fetch prediction markets across Polymarket and Kalshi — questions, prices, volume, and resolution status the den already tracks.
Wallets
Profiled wallets the fox has sniffed — age, PnL heuristics, concentration, and recent market activity. Use this when a signal points at a wallet and you want the full trail.
Watchlists
Your saved markets and price/alert thresholds. Watchlists are first-party: they require a signed-in Insydr user (web or mobile session), not a customer API key. Pair with in-app alerts rather than treating this as the sold API product.
Webhooks
User-configured webhook endpoints live on the signed-in account (dashboard / native app). An API key cannot create or mutate another user's webhooks. Failed deliveries retry with exponential backoff.
Event types
Subscribe to the events you care about. Filter further with severity or market scope when you create the webhook.
Signatures
Every delivery is signed. Compute an HMAC-SHA256 of "{timestamp}.{body}" with your endpoint secret whsec_… and compare against the header. The recipe is public on purpose (same class as Stripe signing). A stranger still cannot mint a valid v1 without your endpoint secret, which never appears on this page — keep whsec_… only on your server.
Errors
Conventional HTTP status codes, with a machine-readable body: { "error": { "code", "message" } }.