Developer API

Availability and authentication#

Base path: https://<deployment>/api/developer/v1. Send Authorization: Bearer <sandbox key> from a server secret store. Requests carrying Origin or Sec-Fetch-Site are refused; there are no browser API credentials or CORS shortcuts.

curl "https://<deployment>/api/developer/v1/capabilities" \
  -H "Authorization: Bearer $FLOFI_API_KEY"

Implemented endpoints#

Paths in this table are relative to the base path. Download the verified OpenAPI contract. No execution, signing, submission or Manifest-approval endpoint exists.

Create, validate, hand off#

const strategy = await flofi.strategies.create({
  strategy: {
    action: "bridge",
    sourceNetwork: "base-sepolia",
    destinationNetwork: "arbitrum-sepolia",
    asset: "USDC", amount: "5",
  },
});
const check = await flofi.strategies.validate(strategy.id);
if (!check.availability.approvable) {
  throw new Error(check.availability.reason ?? "NOT_APPROVABLE");
}
const approval = await flofi.approvals.create({ strategy });
// Give approval.approvalUrl to the user.

This is a documented example, not a claim that bridge approval is enabled on every deployment. The user proves wallet ownership, re-simulates, reviews and signs in FloFi. Read Wallet Authorization.

Errors, idempotency and limits#

Amounts are decimal strings. Strategies are immutable; create a new one for a changed intent. Creating POSTs use an Idempotency-Key scoped to project, environment and operation for 24 hours. Same key with a changed body yields IDEMPOTENCY_CONFLICT.

{
  "error": {
    "code": "STRATEGY_CHANGED",
    "reason": "WORKFLOW_HASH_MISMATCH",
    "message": "…",
    "requestId": "req_…"
  }
}

The documented free plan permits 300 requests/minute, 30 simulations/hour, 60 approval creations/hour, 100 open approvals and five active webhook endpoints. Respect Retry-After. Listing strategies, GET /me, live keys and general arbitrary multi-step execution are not part of v1.