List assets

The Assets, variants and deployments the workspace can trade.

GET /api/v1/assets

List tradable assets

cURL

curl --request GET \
  --url https://api.tetrafi.io/api/v1/assets \
  --header 'X-API-Key: <api-key>'

200

{
  "eligibility": {
    "complete": true,
    "reason": "<string>"
  },
  "items": [
    {
      "assetId": "<string>",
      "kind": "stablecoin",
      "symbol": "<string>",
      "variants": [
        {
          "deployments": [
            {
              "chain": "<string>",
              "decimals": 1
            }
          ],
          "kind": "native",
          "name": "<string>",
          "offChainVenues": [
            "<string>"
          ]
        }
      ],
      "name": "<string>"
    }
  ],
  "registry": {
    "snapshotHash": "<string>",
    "version": 123
  },
  "nextCursor": "<string>"
}

Authorizations

api_keybearer_auth

X-API-Key · string · header · required

Send the API key in X-API-Key.

Request signing. A key with signing enabled (enabled for the key in its workspace's credential settings, which return the signing secret once; see Sign requests) must also sign every request:

• X-Timestamp: the current Unix time in seconds, within 300 seconds of the server clock (at most 10 seconds ahead of it on a request that sends X-Nonce).
• X-Nonce: a fresh random value for each request, 16 to 128 characters of A-Z, a-z, 0-9, - and _ (a UUID fits). Required on a write (POST, PUT, PATCH, DELETE); optional on a read (GET, HEAD).
• X-Signature: lower-case hex HMAC-SHA256 of the canonical string, keyed with the signing secret's 32 bytes (the secret is 64 hex characters; decode it first).

The canonical string is joined by \n, with no trailing newline: the X-Timestamp value, the X-Nonce value, the upper-case method, the path with its query exactly as sent (/api/v1/orders?limit=1), and the lower-case hex SHA-256 of the exact body bytes (the SHA-256 of an empty body when there is none). A request without X-Nonce (a read) omits the nonce line and signs four lines.

A nonce is accepted once per key: the same nonce again inside the window is refused, whatever the body, so two identical writes in one second each carry their own nonce and both succeed, and a retry signs again with a new nonce. Every API server shares one nonce record, so a nonce accepted by one server is refused by all of them. Rate admission runs first: a rate-limited write (429) does not consume its nonce, and a replay sent while the key is rate limited is answered 429; otherwise a replay spends a rate token and is refused. A read without a nonce changes nothing, so an identical signed read inside the window is admitted again. A write whose window has already passed on the nonce record's clock when its nonce is recorded is refused as TIMESTAMP_OUT_OF_RANGE. If the nonce record cannot be read or written the request is refused with 503 API_KEY_UNAVAILABLE; the nonce may have been consumed, so sign again with a new X-Timestamp and X-Nonce before retrying.

A signing refusal is a 401 AUTH_REQUIRED whose details.reason names the cause: SIGNATURE_REQUIRED (a header is missing), SIGNATURE_INVALID (a malformed header or a wrong signature), TIMESTAMP_OUT_OF_RANGE, NONCE_REQUIRED (a write without X-Nonce), NONCE_INVALID (a malformed or repeated X-Nonce header), SIGNATURE_REPLAYED (the nonce was already accepted). SIGNATURE_PREDATES_RESTART and 429 REPLAY_WINDOW_FULL are reserved and not answered today.

Scopes

prices_read · api_key

prices_read · bearer_auth

Headers

X-Workspace-Id · string<uuid>

The workspace the request acts in. An API key bound to a workspace implies it: omit the header, or send that same id (another id answers 403 WORKSPACE_SCOPE_MISMATCH). A member session must send it (400 MISSING_WORKSPACE without it).

Query Parameters

limit · integer<int32>

Assets per page, 1 to 200. May change between pages; omit it to keep the cursor's page size.

Required range: x >= 0

cursor · string

The previous page's nextCursor. Valid while the workspace and ordered asset ids are unchanged; otherwise answers 409 CURSOR_STALE. Asset metadata may change.

Response

200

application/json

Workspace-eligible Assets with variants and CAIP-2 deployments. API keys require the prices_read scope.

Assets available to the current workspace, with registry provenance and listing completeness.

eligibility · object · required

Whether the listing is complete for the workspace.

Show child attributes

items · object[] · required

Show child attributes

registry · object · required

The registry snapshot a response was built from.

Show child attributes

nextCursor · string | null

On a paged request (limit or cursor), the cursor of the next page; null on the last page and on an unpaged request.