Access Matrix
Every public route with the credential it needs, the plan that unlocks it, the rate bucket it is metered on, and the outcome per plan. Generated from the API route policy.
Generated by pnpm --filter @philidor/api access:matrix -- --mdx from apps/api/src/lib/route-policy.ts, the same table that drives the OpenAPI security declarations and the cache invariant. Do not hand-edit; regenerate.
What each plan gets
| Plan | API key tier | Default rate limit | Capabilities |
|---|---|---|---|
| Data | data | 100/min | Data API |
| Decisioning | decisioning | 600/min | overhang, risk_graph_signed_decisions |
| Embedded | embedded | 10000/min | overhang, risk_graph_signed_decisions, webhooks |
A key is issued with its plan's default rate limit unless a different limit was agreed (recorded on the key as contracted_rpm); GET /v1/me reports the effective limit.
Routes
ok means the call is served; 401 means a key is required; 403 means the plan is too low. Anonymous callers are metered per address on the bucket shown; keyed callers on the key's own budget.
| Method | Path | Plan | Anonymous | Data | Decisioning | Embedded | Rate bucket (anonymous) | Keyed |
|---|---|---|---|---|---|---|---|---|
| GET | /v1/address/:address/positions | — | ok | ok | ok | ok | portfolio (10/60s per IP) | max(key rpm, 10)/min per key |
| GET | /v1/assets | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/assets/:chain_id/:address | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/assets/:symbol/history | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/assets/enriched | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/assets/enriched/facets | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/baskets | Data | 403 | ok | ok | ok | basketsRead (60/60s per IP) | max(key rpm, 60)/min per key |
| GET | /v1/baskets/:id | Data | 403 | ok | ok | ok | basketsRead (60/60s per IP) | max(key rpm, 60)/min per key |
| GET | /v1/baskets/:id/changes | Data | 403 | ok | ok | ok | basketsRead (60/60s per IP) | max(key rpm, 60)/min per key |
| GET | /v1/baskets/:id/methodology/versions | Data | 403 | ok | ok | ok | basketsRead (60/60s per IP) | max(key rpm, 60)/min per key |
| GET | /v1/baskets/:id/version/:versionId | Data | 403 | ok | ok | ok | basketsRead (60/60s per IP) | max(key rpm, 60)/min per key |
| GET | /v1/baskets/:id/versions | Data | 403 | ok | ok | ok | basketsRead (60/60s per IP) | max(key rpm, 60)/min per key |
| POST | /v1/baskets/:id/webhooks | Decisioning | 403 | 403 | ok | ok | basketsWebhookWrite (30/60s per IP) | family cap 30/min per key |
| DELETE | /v1/baskets/:id/webhooks/:whId | Decisioning | 403 | 403 | ok | ok | basketsWebhookWrite (30/60s per IP) | family cap 30/min per key |
| POST | /v1/baskets/:id/webhooks/:whId/enable | Decisioning | 403 | 403 | ok | ok | basketsWebhookWrite (30/60s per IP) | family cap 30/min per key |
| POST | /v1/baskets/:id/webhooks/:whId/replay | Decisioning | 403 | 403 | ok | ok | basketsWebhookWrite (30/60s per IP) | family cap 30/min per key |
| GET | /v1/chains | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| POST | /v1/chat | — | ok | ok | ok | ok | userChat (2/60s per IP) | 2/60s per IP |
| GET | /v1/curators | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/curators/:id | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/curators/:id/events | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/docs | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/events | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/events/:id | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/events/group/:groupKey | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/events/stream | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/evidence/signers | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/graph/breach | Decisioning | 401 | 403 | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| POST | /v1/graph/check | Decisioning | 401 | 403 | ok | ok | graphCheck (60/60s per IP) | family cap 60/min per key |
| GET | /v1/graph/curator-exposure | Decisioning | 401 | 403 | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/graph/decision/:id/verify | — | ok | ok | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/graph/expected-dependency-loss | Decisioning | 401 | 403 | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/graph/expected-dependency-loss/summary | Decisioning | 401 | 403 | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/graph/incident-exposure | Decisioning | 401 | 403 | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/graph/incident-exposure/summary | Decisioning | 401 | 403 | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/graph/look-through | Decisioning | 401 | 403 | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/graph/snapshot/:id | — | ok | ok | ok | ok | graph (600/60s per IP) | max(key rpm, 600)/min per key |
| GET | /v1/health | — | ok | ok | ok | ok | health (120/60s per IP) | 120/60s per IP |
| GET | /v1/indices | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/census | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/constituents | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/levels | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/methodology | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/notices | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/quality | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/reconciliations | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/indices/:id/runs/:valueDate | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/integrations/royco/markets/:slug | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/markets | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/markets/:id | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/markets/:id/events | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/me | — | 401 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/methodology | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/methodology/vault | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/newsletter/confirm | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| POST | /v1/newsletter/subscribe | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/openapi.json | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/oracle-vector/freshness | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/por | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/por/:issuer | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/por/:issuer/history | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| POST | /v1/portfolio/overlap | Decisioning | 401 | 403 | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/protocols | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/protocols/:id | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/rates/:slug | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/rates/:slug/history | — | ok | ok | ok | ok | internal (120/60s per IP) | max(key rpm, 120)/min per key |
| GET | /v1/research/backtests | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/research/claims | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/research/model-health | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/research/predictions | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/research/sources | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/research/validation-reports | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/reviewers | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/rwa | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/rwa/:asset_id | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/rwa/coverage | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/rwa/facets | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/rwa/stats/history | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/security-events | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/security-events/losses | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/signals | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/signals/:id | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/stablecoins/backing | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/stats | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/stats/history | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/stats/rating-dynamics | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/status | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/users/:address/agents | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| PUT | /v1/users/:address/agents | — | ok | ok | ok | ok | userWrite (10/60s per IP) | 10/60s per IP |
| GET | /v1/users/:address/agents/auth-message | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/events | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/holders | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/holders/history | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/markets | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/score-history | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/snapshots | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/strategies | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vault/:network/:address/strategy | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vaults | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vaults/:id | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| POST | /v1/vaults/batch | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vaults/changes | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vaults/scores | Data | 403 | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |
| GET | /v1/vaults/with-critical-incidents | — | ok | ok | ok | ok | public (10/60s per IP) | the key rpm (X-RateLimit-Limit) |