Bloxwap API

Bloxwap publishes a small public read API describing its markets, its token and its treasury. Every operation is unauthenticated and read-only: there is no key to request, no token to mint and no account to create. An agent can call all of it directly.

The machine-readable description lives at /openapi.json as OpenAPI 3.1, with a unique operationId, a description and a typed response schema on every operation.

Endpoints

MCP server

If you are pointing an agent at Bloxwap rather than writing HTTP calls, there is a Model Context Protocol server at https://bloxwap.com/mcp — unauthenticated Streamable HTTP, with search_docs, get_doc and quote_fees. See the MCP page for the connection config.

There is no trading API

This is a deliberate absence, not a gap. Bloxwap is non-custodial: it never holds funds, and every position is signed by the user’s own embedded wallet and settles on-chain on Hyperliquid. There is no server that could place an order on your behalf, so there is no server-side order endpoint to document.

To trade programmatically, talk to Hyperliquid directly — that is the exchange Bloxwap itself submits to. Live prices and per-market leverage caps come from the same place, which is why this API deliberately omits them: they change per second and Hyperliquid is their source of truth.

Trying it without risking money

The app ships a demo mode that simulates positions against live prices without signing an order or moving funds. It needs no account and no deposit, so it doubles as a sandbox for anyone evaluating how the product behaves before touching the real thing. Open any market and switch the mode toggle to demo.

Every read endpoint above is already safe to call against production: none of them writes anything, and none of them is metered.

Versioning

Integrate against /api/v1/…. The unversioned /api/… paths serve the identical handlers and keep working indefinitely — they are what the app itself calls — but they carry no version guarantee.

Within a version, changes are additive: new endpoints, new optional parameters and new response fields can appear at any time, so parse defensively and ignore what you don’t recognise. Anything that would break a correct v1 client ships as v2 instead.

If an operation is ever retired, its responses carry Deprecation and Sunset headers for at least 90 days before it stops answering. Nothing disappears without those headers having been served first.

Calling it from a browser

Every operation answers cross-origin. Responses carry Access-Control-Allow-Origin: *, preflight is answered for GET, HEAD and OPTIONS, and no credentials are read or accepted. A browser-based agent can call this API directly — no proxy, no server in between.

Access-Control-Expose-Headers names the rate-limit headers, so client script can actually read them. A cross-origin response only surfaces the safelisted headers otherwise, which would leave the published limit invisible to the callers it exists for.

Rate limits

/api/v1/… is limited to 600 requests per minute per client — far above any plausible integration. Responses carry RateLimit-Policy (RFC 9331) and RateLimit-Limit; a throttled request answers 429 with Retry-After and code: "rate_limited".

RateLimit-Remaining and RateLimit-Reset are deliberately not sent. The limiter reports only whether a request was allowed, so a remaining count would be an estimate — and pacing against a guessed number is the exact failure these headers exist to prevent. Pace against the published quota and window.

Errors

Errors are JSON, never an HTML page. The body carries a human-readable error, a stable machine-readable code to match on, and a hint describing how to fix the request when the caller can fix it. Match on code; the prose may be reworded.

More

• Documentation — fees, assets, how the product works.
• /llms.txt — the whole documentation corpus as plain markdown, in one fetch.
• About Bloxwap and contact.
• Questions the docs don’t answer: support@bloxwap.com.