The OpenAPI spec is assembled from utoipa annotations on the axum handlers.
Coverage is incremental; use the guides for endpoints that are not yet
annotated.
Base URL
Authentication
Most endpoints are public — noAuthorization header required. The user-scoped
routes (anything under /v1/me/*, plus /v1/auth/logout) require a JWT obtained via
Telegram Login. See authentication.
Rate limit
Soft sliding window: 300 req/min per IP on REST. WebSocket allows 5 concurrent connections per IP. Liveness / readiness probes are exempt. Hit the limit? Emailraffxweb3@gmail.com.
Cross-origin
CORS allowed frompegana.xyz, www.pegana.xyz, localhost:3000 by default.
Self-hosted instances can extend via CORS_EXTRA_ORIGINS.
Errors
Standard HTTP codes. Error bodies are{"error": "...", "message": "..."} — short,
machine-readable.
SDKs
There are no official SDKs yet — the API is small enough that direct HTTP calls are recommended. For typed access in TypeScript, the OpenAPI spec drives codegen via your favorite tool (orval, openapi-typescript, etc.).Quick links
Read one state
GET /v1/state/:asset — the canonical read.Stream live
wss://api.pegana.xyz/v1/ws — sub-second push.