API reference

The vault universe, filterable.

A vault absent here is one we do not observe, not one that does not exist. Free.

One vault: metrics, value series, positions, execution quality, and what evidence exists for it.

The `available` block is free at every tier and states what this platform HOLDS for the vault, fills, positions, funding accrual, liquidation prices, whether or not the key may read it. An absence and a paywall are different facts: a 402 from /v1/funding or /v1/stress means the data exists and the tier does not carry it. `performance.execution` carries turnover, taker share and fee basis points where the vault has traded enough for them to mean anything, and null where it has not. Free.

Operator cohorts, survivors and failures kept in.

Free.

One operator and its whole book.

Free.

Instruments and who holds them.

Free.

The machine-managed capital index, with its constituents.

Requires `index.read` — PUBLIC or PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

A benchmark series to compare against.

Free.

Counts, capabilities your key holds, and the standing limitations.

Free.

What the capital is denominated in, and whether that thing is worth what its name claims.

Only a dollar claim can be checked here: there is no ether or bitcoin reference price, so those are unpriced rather than sound. A dollar-named token priced far from a dollar is a ticker collision rather than a depeg, and its price is refused. Free.

Gross to net, and whether it was earned by being right or by being paid to wait.

Measured over the window funding can be measured over, not the vault’s lifetime. Requires `waterfall.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Taker share, fee rate and how it gets filled.

Requires `fills.read` — ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Hit rate, payoff and holding period, rebuilt from the venue’s own open and close labels.

A high win rate beside a payoff below one is the signature of selling optionality. Requires `trades.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

What the venue did against a book’s will, and when several went at once.

Observed, not modelled, the only thing here that can contradict the stress ladder. Requires `forced.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Price a holding you already have: look-through exposure and what a move costs you.

Losses are pro rata on vault equity; a waterfall or first-loss tranche will not lose pro rata. Requires `risk.read` — ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

"{ holdings: [{ vault, usd }], instruments?: string[], shocks?: number[] }"

Who is liquidated as one instrument moves, and at what named price.

Only the named instrument moves, so every figure is a floor. Requires `stress.read` — ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

The forced selling that follows a first round, and where it lands.

Impact from quoted depth reads about four times below the volatility model; the response says which was used. Requires `cascade.read` — ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Whether vaults are the same trade once the market is removed.

Every figure carries its overlapping days and an interval; an indistinguishable pair says so. Requires `correlation.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

What a withdrawal does to the strategy behind it, and whether it could be paid at all.

The venue returns at most a hundred depositors, so holder counts are floors. For a lending vault the binding constraint is liquidity rather than margin: scenarios carry exceedsLiquidity and unmetUsd, and a null withdrawableUsd means unread rather than unlimited. Requires `redemption.read` — ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

What changed: which vault stopped being exitable, which died, which raised a new observation.

The feed began when it began, nothing before that was missed, it was not yet running. A change on a vault holding under $50,000 is not announced. Free.

Which lending vaults cannot be withdrawn from today, and how long that has been true.

Read for Euler, Morpho and Lista. A vault absent here is one whose liquidity we do not read, never one with none locked, and the history begins the day we started keeping it, because a market’s past free liquidity needs an archive node nobody offers free on BNB. Free.

How long each book has sat fully lent, and whether anybody acted.

Times the consequence, not the control: we do not hold LTV or caps, so this measures how long a depositor could not leave rather than when a parameter was changed. A duration marked "atLeast" began before our readings did, and the register starts the day we started keeping it. Requires `reactivity.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Where longs and shorts cancel, and where they only appear to.

Requires `positions.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

One operator’s book across every vault it runs.

Requires `positions.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

How much of the capital we track we can watch being used, by kind of vault.

Knowing how much a vault holds and knowing what it does with it are different readings. Every dollar counted sits in a contract anybody can check; what is missing is our reading. And where positions ARE read, a hedge on a centralised venue is invisible to us, so a one-sided book may be flat. Free.

Who is in the same trade, and what share of the venue that is.

Requires `crowding.summary` — PUBLIC or PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Whether a crowd is building or dispersing.

Requires `crowding.timeseries` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

What holding a perpetual costs or pays, and who is on each side.

Annualised simple. A vault collecting today can be paying tomorrow. Requires `funding.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Whether an instrument is still a market, and how much notional is marked in ones that are not.

Requires `markets.read` — PUBLIC or PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Pairs whose trades follow one another sooner than chance accounts for.

It does not say copying. A shared vendor, one operator, or the same obvious level all look identical from a timestamp. Requires `leadfollow.read` — ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Daily measured capital, split by who decides.

Days rebuilt from stored value history are marked. A rebuilt day carries today’s cohort and classification, so it is survivorship-biased backwards. Requires `crowding.summary` — PUBLIC or PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Settle a condition about a vault from our records, or decline to.

Deterministic and recomputable. A window we do not fully span is refused rather than answered on the part we hold. No collateral backs it. Free.

"{ kind, vault, from, to, threshold?, instrument? }"

A hash-committed assessment, in the shape ERC-8004’s Reputation Registry points at.

ASPERN does not publish on chain; the call arguments are returned for whoever does. Free.

Pre-register a strategy before it runs. Free.

Free.

"A signed declaration; see /register for the exact text."

Declarations already signed.

Free.

Commit to a decision before executing it.

Free.

"{ digest, seq, leaf }"

Reveal it afterwards; we match it against the chain.

Free.

"{ digest, seq, nonce, intent }"

Whether a sequence is intact. A gap voids the grade permanently.

Free.

Your alerts, where they deliver, and what has fired.

With no webhook registered a firing is recorded and readable but reaches nothing. Requires `crowding.members` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Arm an alert, or change its threshold.

The threshold is a fraction, not a percentage: 0.9 means 90%. Changing it re-arms, so the next crossing fires. Requires `crowding.members` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

"{ kind: crowding|consistency|drawdown|version|proximity, target: instrument or vault slug, threshold: fraction between 0 and 1 }"

Disarm an alert.

Requires `crowding.members` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

This document. Free, so it can be read before deciding whether to buy a key.

Free.

Prices and quotas. No key needed.

Free.

What every lineage block on this API means, field by field, and why several of them are null.

A vault read from a venue HTTP API has no block number and a document assembled from four readers has no single source event id. Those fields are null with a reason rather than filled with something plausible. Free.

The capital and payments a reader can re-derive themselves, and the gaps, weighted by capital.

Nothing is corrected from these checks: a disagreement has more than one possible owner. Hyperliquid is absent by nature — an order book has no contract holding the capital to be asked. Free.

Where our figures disagree with a public source, and the stated reason.

The ratio is not an error rate: most pairs are different units over different windows. A row with state=open is a difference we have not explained, published rather than left out. Free.

What is withheld from an unkeyed caller, per surface, and what a plan opens.

A short list is not necessarily all of the data. This says how many rows come whole, how many follow with one field withheld and which field that is, so a caller never has to infer a limit by hitting it. Free.

Your balance, quota and deposit address.

Free.

Collection health. Admin only.

Requires `ops.read` — . Without it the call answers 402 with the amount and a deposit address.

How many registered agent identities ever appear on a rail that moves money.

A floor: the registry side is the identity token’s holder and the rail side is whoever paid, so an operator using two keys reads as absent. Three rails are read — ACP, the Olas mech marketplace, x402. Free.

What agent cards claim about the other registries they are in, and whether the claim holds.

Three states and they never merge: found, absent on a registry we read over its whole life, and unread — which is our coverage gap rather than their claim. A self-claim, naming the registry the card is already in, is counted separately and is not a link. Free.

Every rail this platform reads, counted from each rail’s own table.

The units differ per rail and are named rather than added together: a channel is not a payment, a job is not a payment, and a registration is not either. A rail with no span carries no event time we can trust — the Solana registries are read by scanning the program, so the only date on a row is when we read it. Free.

Who delivered and who did not, provider by provider, on the ACP job book.

Rates are over jobs that REACHED an outcome. A job still in negotiation has not failed, and one we never saw a phase for is a gap in our reading rather than an event in the market; both are reported beside the rate rather than folded into it. Requires `delivery.read` — PRO or ENTERPRISE. Without it the call answers 402 with the amount and a deposit address.

Who pays on x402, separated by observable behaviour rather than by label.

No class claims “agent”. They separate behaves-like-a-program from we-cannot-tell. Payments are counted, never summed across tokens. Free.

A watch you armed has crossed its threshold.

Sent to every active endpoint registered for this event, at most once per watch per crossing. **Verifying.** Each request carries `x-aspern-signature: t=<unix-seconds>,v1=<hex>`, where the hex is HMAC-SHA256 over the exact string `<t>.<raw request body>` keyed by your webhook secret. Sign the BYTES you received: re-serialising the parsed JSON produces a different signature and the delivery becomes unverifiable. **Replay.** Reject a timestamp more than 300 seconds from your own clock. Compare the digest with a constant-time comparison. **Retries.** A non-2xx is retried with exponential backoff from one minute, doubling, capped at six hours, with up to 20% jitter added, never subtracted, so a retry is never earlier than its backoff. A 4xx other than 408 and 429 is treated as permanent and not retried: you understood and refused. **Ordering and duplicates.** Delivery is at-least-once and not ordered. Use the `id` to make your handler idempotent.

{
  "id": "whd_2f8a1c",
  "event": "watch.fired",
  "createdAt": "2026-08-27T09:14:02.117Z",
  "watch": {
    "id": "wch_91b2",
    "kind": "drawdown",
    "target": "morpho-steakhouse-usdc",
    "threshold": 0.05
  },
  "observed": {
    "value": 0.062,
    "at": "2026-08-27T09:12:00.000Z"
  },
  "subject": {
    "slug": "morpho-steakhouse-usdc",
    "name": "Steakhouse USDC",
    "chain": "ethereum"
  }
}

A test delivery, sent when you ask for one.

Identical in shape and signing to a real event, so a receiver that verifies this one verifies all of them. Sent on demand from the account page, the only way to find out your endpoint rejects our signature before a real alert depends on it.

{
  "id": "whd_test_01",
  "event": "webhook.test",
  "createdAt": "2026-08-27T09:00:00.000Z"
}