Build on ApeCover

Start here

Keys are issued from your account page: sign in, register your integration, and the key is shown once. Go to your account — then the two calls below are enough to confirm everything is wired up.

# 1. Get a key at apecover.io/app, then check it works
curl -H "Authorization: Bearer $APECOVER_KEY" \
     https://apecover.io/api/v1/whoami

# 2. Price a policy before you commit to anything
curl -X POST https://apecover.io/api/quote \
     -H 'content-type: application/json' \
     -d '{"pool":"'"$POOL"'","tokenMint":"'"$TOKEN_MINT"'","tradeSize":"300000000","tier":1,"packSize":10}'

A key authenticates as soon as it is issued, before your application is reviewed, so you can build against the API while you wait. What it cannot do until an operator registers you on chain is earn — see what approval does and does not mean.

The SDK

@apecover/sdk collapses buy-a-policy-if-needed and register-the-trade into one call. It reuses a prepaid pack while it has credits and buys a new one when it runs out, so your code never handles a policy.

npm install @apecover/sdk @apecover/core @apecover/common

import { ApeCover } from '@apecover/sdk';
import { Connection, Keypair } from '@solana/web3.js';

const ape = new ApeCover({
  apiKey: process.env.APECOVER_API_KEY,   // issued at /app, shown once
  pool: process.env.APECOVER_POOL,        // required — which pool you insure against
  connection: new Connection(process.env.RPC_URL, 'confirmed'),
  signer: Keypair.fromSecretKey(secret),  // never transmitted
});

// After your swap confirms, before you reply to the user.
const result = await ape.insureTrade({
  swapSignature,           // base58, exactly as your swap returned it
  tokenMint,
  tradeSize: fill.lamportsSpent, // pass it: a policy bought without one is refused
  tier: 'standard',
});

if (result.status === 'insured') console.log('covered', result.trade);
else if (result.status === 'declined') console.log('no cover:', result.reason);
else console.log('sent, outcome pending', result.signature);

The API key authenticates to ApeCover, never to a chain. It cannot move funds and is not a wallet — your own key signs, locally, and the SDK never transmits it. What the key buys is the attestation: registering a trade needs the pool attestor to co-sign, because entry price and market cap are not computable on chain and a self-reported entry price is the fraud that co-signature exists to prevent. The client refuses to construct in a browser, where a key would be readable by every visitor.

Amounts are bigint throughout. A JavaScript number silently rounds past 2⁵³, and sizing is the one thing a bot must not get wrong.

Approved is not the same as earning

Two things have to be true before a revenue share accrues, and it is worth knowing which is which, because the first happens in seconds and the second involves a human.

1. Your application is accepted. Your key already worked before this; acceptance is a decision, not a capability.
2. An operator runs register_partner. That instruction is admin-signed, so it cannot be self-served. Until the transaction lands there is no Partner account for policy.partner to point at, and nothing accrues.

/v1/whoami answers both questions in one field: earning is true only when the on-chain account exists. Your account page reads “Approved — not yet on chain” for the state in between rather than rounding it up.

Webhooks

We POST trade.insured, claim.paid and claim.rejected to your endpoint, signed with your API secret. Verify the signature and the replay guard: a signature proves a delivery came from us, not that it is new, and a replayed claim.paid is worth money to anyone whose handler credits an account on receipt.

import { createHmac, timingSafeEqual } from 'node:crypto';

const REPLAY_WINDOW_SECONDS = 300;

/** rawBody must be the bytes as delivered — a re-serialised object hashes differently. */
export function verifyDelivery(rawBody, signatureHeader, secret, seen) {
  const parts = new Map(
    signatureHeader.split(',').map((p) => p.split('=').map((s) => s.trim())),
  );
  const timestamp = Number(parts.get('t'));
  const provided = parts.get('v1');
  if (!Number.isFinite(timestamp) || provided === undefined) return 'malformed-signature';

  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`, 'utf8')
    .digest('hex');
  const a = Buffer.from(provided);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !timingSafeEqual(a, b)) return 'bad-signature';

  // Freshness, then replay. Both are required: a signature stays valid forever without them.
  const age = Math.floor(Date.now() / 1000) - timestamp;
  if (age > REPLAY_WINDOW_SECONDS) return 'too-old';
  if (seen.has(provided)) return 'replayed';
  seen.add(provided); // back this with Redis, and expire after the window
  return 'ok';
}

Integrating a trading bot

Custodial trading bots — the bot holds a per-user wallet, builds and sends the swap from it, and replies in chat — integrate the same way, and it is one call.insureTrade slots in after the swap confirms and before you reply. Everything below follows from that position.

• The user’s wallet is the signer. The trade’s owner is the wallet that made the swap, and so is the payout address. You already hold it; the SDK countersigns locally and never transmits a key.
• The attestation is not your problem. insureTrade obtains the platform-signed registration transaction. You cannot build one yourself — the attestor’s signature is what the program checks.
• Declines are outcomes, not errors. insured / declined / unknown are three different chat replies. Keep partner-exposure-cap and partner-rate-limit distinct from insufficient-pool-capacity: the first two mean “not right now, your traffic”, the last means the pool is busy. A bot that conflates them reports an outage while the protocol is serving everyone else.
• The claim path is chain-only and survives us. Protocol.submitClaim needs the proof digest from GET /trades/:address/proof; everything after that is a program instruction you sign yourself.
• Your revenue share is on chain. It accrues against your Partner account on every policy your key originates, and you claim it whenever you like — see what approval does and does not mean.

That loop is a working program, not a sketch: the reference adapter is executed against a live validator and a real API server on every CI run. An integration is that file with your own names in it. Ask us for it — and for the bot-specific specification, which pins the hook point, the key model and the decline mapping against your surface — and we will send both.

The screens

Six destinations in the header. Two of them — Stats and this page — are readable without an account. The rest are about your integration, so they ask you to sign in rather than showing you an empty version of themselves.

1 · Signing in

An account holds your keys and your partner registration. It is not what holds your cover — cover belongs to the wallet that bought it, and the protocol has never heard of your email address. Nothing you do here can move money.

There is no password. Enter your email, and a six-digit code arrives; the code signs you in and the session is a cookie on this site. That is the whole of it, and it is the reason an account is safe to make before you have decided anything: it can be thrown away and it holds nothing you cannot re-issue.

2 · Registering as a partner

A partner is an integration that routes trades to the pool — a bot, a terminal, a wallet — and earns a share of the premium on every policy its key originates. Registering is a form on your account, and it is the only step in this walkthrough that somebody else has to act on.

The share itself is partner_fee_bps on the pool, and the form reads it from the pool account and prints it rather than quoting a number this page decided. If the chain cannot be read the sentence loses the figure instead of inventing one — a rate in a document that the program does not pay is worse than no rate at all.

The two addresses are not the same thing, and the difference is the one part of this form worth slowing down for. The payout address is where your revenue share is paid, and it can be changed. The signing wallet is the wallet that will claim those fees, and your on-chain partner account is derived from it — so it cannot be changed later, and an address with no private key behind it would leave everything you earn unclaimable for ever. Both forms that collect it check the shape before it is stored; neither can check that you hold the key.

Keeping them apart is worth doing even though they may be the same address: it means the wallet holding the money never signs anything.

What happens next, in three states

Submitting gives you a working API key immediately. It does not give you a revenue share, and the account page is careful about the difference because it is the one thing here that looks live and is not.

Approved is not the same as earning is the same distinction from the integrator’s side, with the API responses that go with it.

Registration belongs to one chain

Your keys do not. A key authenticates the SDK to this deployment and works wherever the deployment serves; a registration lives on one chain’s registry, and the account page says which rather than guessing.

The application above is a Solana registration — both of its addresses are Solana addresses. Every other chain keeps its own registry on its own pool contract, keyed by an address there, and nothing links the two: your Solana authority does not derive an EVM address and no amount of configuration makes it. So switch the chain selector and tell us two things: the address you trade from on that chain, and where its pool should pay your share. Both are stored as a declaration — it does not register you, which is a transaction on the pool contract sent by its admin — and between them they do three things: this page can look you up in that registry without being asked, an operator can see that you are waiting, and the operator has the two arguments the pool’s registerPartner takes. Your Solana payout address is not one of them and cannot be made into one, which is why it is asked for here rather than derived.

The payout address may be left empty, and then the card says so plainly: the address alone is enough for the lookup, and not enough for anybody to register you. That row shows in the operator’s queue as waiting on you rather than on them.

3 · Keys and webhooks

Registering issues your first key. The account page issues the rest, up to the limit it prints, and the secret is shown once — this service stores a hash of it and cannot serve it again. Losing one is not a disaster; revoke it and make another.

A key never signs on a chain. Your own key does that, locally, and the SDK never transmits it. What the API key buys is the attestor’s co-signature on an entry price, which is what makes a self-reported one impossible — so a leaked API key can spend your rate limit and attribute trades to you, and cannot move your money. Send it as Authorization: Bearer <key>, from your server.

The webhook is the other half of the same card, and it is how you find out about a trade without polling. We POST to your URL on trade.insured, claim.paid and claim.rejected, signed with a secret shown once when you save it. Replacing the URL rotates that secret. HTTPS only.

4 · Getting cover on a trade

Not from this site. Your bot calls the SDK, which prices a policy, buys one if the prepaid pack has run out of credits, and registers the trade — in a single call, from wherever your trading code already runs. Nothing here needs a wallet, because the wallet is wherever that code is.

Two consequences are worth holding on to. Cover runs from registration, not from purchase — a pack bought in advance insures nothing until a trade is registered against it. And the API key never signs on a chain: your own key does, locally, and the SDK never transmits it. What the key buys is the attestor’s co-signature, which is what makes a self-reported entry price impossible.

If you would rather watch the sequence happen once before wiring it in, ask us — the same quote, attest and register calls can be driven a single trade at a time against your own pool, and watching one go through is the fastest way to see where your integration should hook in.

5 · Following a position

Positions takes a wallet address — paste the one your bot trades from. The data is public, so you do not have to own an address to look one up, and the page answers for whichever chain the toggle shows.

Three things on that screen are easy to misread.

• Size is not cover. The Cover column is what the pool set aside for the trade — the size times the tier’s ratio, capped at the pool’s per-trade ceiling. A column that printed the size instead overstated a Standard trader’s cover by exactly two times, which is why the share is printed beside it.
• Credits left is not cover available later. A policy has a lifetime on chain that these events do not carry, so a pack with credits remaining may still be past it. Reading the account is what the SDK is for.
• The stamp is the point of the badge. Every figure comes from the indexed projection rather than from the chain, and the slot beside the heading says exactly how fresh it is. Read it before concluding a trade is missing.

6 · When a rug happens

A claim is filed by the wallet that owns the trade. On chain nothing else can, and the program accepts it only until a short grace period after cover ends — so it is filed with the keys the trade was made from, through the SDK or the bot that placed it. There is no form on the claims page and nothing there signs.

So it is somewhere to look rather than somewhere to act: which trades were judged rugs, the proof each judgement rests on, and where each claim has got to.

A claim that has not appeared is not one you forgot to file. Either the rug has not been confirmed, or the trade was not covered when it happened — and Window is the column to check first, because cover that had already ended is the common answer. Where no rug check could run at all, the page says so above the table rather than leaving a row blank: nothing there has been examined and found clean, it has not been examined.

7 · Staking capital, and what it earns

The other side of the product. An underwriter puts capital behind the pool so it can carry cover, and earns a share of the premiums that cover pays. It is a different thing from a partner’s revenue share — that is paid for routing trades and is covered in approved is not the same as earning. Staking is paid for bearing the risk, and needs no approval from anyone.

The panel is on Stats and on Positions, and what it offers depends on how the deployment is configured. By default it hands you the SDK calls against this deployment’s own program and pool, because the standing direction is that nobody signs from a browser here. Where an operator has turned wallet writes on, the same three actions are buttons instead. Either way it publishes the two numbers the program refuses on, which no client could read until it did — the first-stake floor and the lockup.

There are exactly three writes, and one position per wallet per pool — the stake account is derived from the two, so staking a second time tops up what you already have rather than opening anything new.

• underwrite(amount) — opens or tops up. Only the first stake is held to the floor; a top-up of any size is accepted.
• withdrawStake(amount) — refused for the published lockup after every deposit, not just the first, so a top-up restarts the clock on the whole position. Refused at any time for an amount that would leave open cover unbacked or drop the pool below its reserve floor.
• claimRewards() — pays the premium share the position has earned. Never gated on the lockup, and not gated on a pause either: yield was never part of what backs cover, so withholding it would protect nothing.

Position value is not what you deposited. It is your shares times the pool’s capital, so it moves with the book: it rises as premiums arrive and falls when a claim is paid out of capital, and the P&L beside it is that difference stated rather than floored at zero. Underwriting risk is exactly this number being negative, and a panel that hid it would be hiding the product.

A refusal here is a stated fact, not an error. Locked capital comes back with a countdown; an exit that would unback live cover says so and names the amount that would not. The SDK renders all three as answers rather than throwing, so your own code can branch on them — and a pause, when one is on, stops the exit alone.

8 · Your dashboard

Positions answers about an address. Dashboard answers about your account: what your keys have insured, what it has earned, and what you have staked.

It draws on three sources and labels each one where it is used, which is the only reason nothing here can quietly disagree with the protocol. Per-key attribution comes from this service, because the chain does not hold it — on chain, every key a partner owns shares one account. Revenue share, exposure and stake are read from the chain directly, because they are money. When the two disagree, the chain is the one that is true.

Two of the tiles are the limits that decline a trade, and both free up rather than run out. Exposure headroom is a share of the pool’s ceiling, not of the capacity left in it — so you can be full while the pool is quiet — and it frees as open cover settles. Rate limit is a fixed window, so the whole allowance returns when it rolls. The right response to either is to retry, not to disable the integration.

The Staked card reads the position held by your payout address, and says so. This site has no wallet, so that is the only Solana address it knows you control — if you underwrite from a different one, look that address up on Positions instead. Its stake will not appear here, and the card saying “none” is not the same claim as “you have not staked”.

Two chains, one protocol

The same contracts, deployed twice. Tiers, premiums, the fee split, the claim rules and the entry gate are one implementation — @apecover/common’s arithmetic, which the Solana program and the Solidity pool both mirror — so the same economic trade prices identically on either. What differs is everything about acting on that price, and the next section is the list.

Every chain-scoped endpoint takes ?chain=, and the reference below badges the ones that do. Three answers, not two:

The table below is read from CHAIN_REGISTRY — the same value the chain switcher offers and the API refuses on — rather than written out here.

• Absent means solana. That is a compatibility promise, not a convention — every link and every integration written before there was a second chain keeps working unchanged.
• A value no chain answers to is a 400. It is not defaulted, because a typo silently answered from Solana is worse than a refusal.
• A real chain this deployment does not serve is a 503 chain_not_served — a statement about this deployment, not about the chain. /health publishes which surfaces each served chain can answer, so a client can ask before it requests.

The row that matters most is the one that is off. robinhood is mainnet 4663 and robinhood-testnet is 46630, and they are different chains rather than two names for one. A sample naming the first is a sample a reader cannot run.

What differs, and what does not

Every row below is read from the constants the code computes with, so this table cannot disagree with the client you install.

The settlement asset is a property of the pool, not of the chain. This is the single most likely integration mistake, because the chain’s native unit is the obvious thing to reach for and it is right only some of the time. A pool may settle natively — 18 decimals of the chain’s own unit, paid as value on the call — or in an ERC-20, whose decimals are the token’s and are commonly six. POST /quote answers with evm.settlementAsset, evm.settlementSymbol and evm.settlementDecimals; read the width from there rather than assuming one. A client that assumes 9, as it would on Solana, is out by a factor of a billion.

The other consequence of that field is procedural. A native pool takes the premium with the call, so buying is one signature. An ERC-20 pool cannot, so it is two: an approval, then the purchase. evm.approvalRequired says which before you build anything — a bot that discovers it afterwards has already lost the race it was in.

And what does not differ is worth stating plainly, because it is most of the product: the three tiers and their percentages, the premium and payout arithmetic, the fee split between reserves, protocol, partner and underwriter, the per-trade cap, the entry market-cap gate, the utilisation ceiling, what counts as a rug, and the rule that cover runs from registration rather than from purchase. None of those is chain-specific, and none of them is implemented twice.

Robinhood Chain, today

Deployed and readable on testnet 46630; nothing on mainnet 4663. What follows is what this deployment can do there right now, split into the half that works and the half that does not, because the difference is not a matter of degree.

What works

Every read: positions and exposure, policies, claims, the partner registry, protocol statistics and an owner’s own figures, all served from the indexed projection of the pool’s logs. POST /quote answers the evm block — chain id, settlement asset, whether an approval is needed, measured gas ceilings and a live gas price — every field of it read from the pool contract. And a pack can be bought: createPolicy takes no attestation, so a wallet and a price are the whole of what it needs.

/quote prices the pool too, from the contract’s terms. The API reads the configured pool’s tier table and limits from the contract, so quote carries the premium, the cover and the fee split, computed by @apecover/core — the same basis-point arithmetic the contract runs and the same code the Solana path prices with — and issues carries the same eligibility checks a Solana quote runs: a paused pool, a size outside the pool’s bounds, too little capacity, a flat premium below the floor. This page’s own trading panel computes its preview in the browser with the same code, from terms it reads off the pool. Two answers carry no price. A deployment that does not read this chain returns quote: null with a chain-not-priced issue, a statement about the deployment rather than about your pool. One that does read it answers unknown-pool for any pool but the one it is configured for, and for a read of that pool that failed; a failed read is held for a second at most, so ask again.

What does not, and exactly why

Registering a trade needs the pool’s trade attestor. registerTrade(uint256, TradeAttestation, bytes) takes the trade attestor’s signature as its last argument; the pool recovers it and compares the recovered address against its own tradeAttestor. That is ADR-0003’s rule in EVM form and it is not optional — an entry price the client chose is precisely the fraud a co-signature exists to prevent, so a self-signed attestation is refused by the contract rather than by us.

The service side exists. POST /v1/attest/evm measures the swap from the chain rather than taking the caller’s word for it, reads the entry price from the v4 pool bound to the token, and returns the EIP-712 attestation with a secp256k1 signature; the SDK’s insureTrade turns that into registerTrade calldata. A deployment mounts the route only when it holds an EVM attestor key and the settings beside it. Its Solana attestor’s ed25519 key cannot stand in: that is a different curve, not the same key in another encoding.

What is left is on the pool. Its admin points tradeAttestor at this deployment’s address with updatePoolParams and setTradeAttestor, which is an on-chain transaction and somebody’s decision; a pool that has adopted its attestor registry takes registerTradeQuorum co-signatures instead, which this deployment does not produce. /health says where a deployment stands: evmAttestor.status reads attestor only when the pool names its key. The trading page has no registration flow of its own on this chain.

The consequence is worth stating in the buyer’s terms rather than the protocol’s: cover runs from registration, so a pack bought on 46630 insures nothing until a trade is registered against it. The trading surface says the same thing above its own buy form, before the purchase rather than after it.

Claims, and the same distinction

submitClaim is on the pool and the SDK builds it, so the shape of a claim is there. Whether one can be filed is a question about the watcher and the proof pipeline rather than about the chain, and /health answers it per link: claimPath collapses it to a word, and proofChain names each link and the environment variable that fixes it. Read that before concluding a claim is missing.

SDK reference

34 functions across the client, the platform half and the pure helpers. Every example below is code to copy into your own project — nothing on this page executes, and nothing on it will ever ask you for a private key.

import { ApeCover } from '@apecover/sdk';
import { Connection, Keypair } from '@solana/web3.js';

const ape = new ApeCover({
  apiKey: process.env.APECOVER_API_KEY!,   // dgn_….dgnsk_…, issued at /app
  pool: '3J31LrGG5Ko7iECH4o4QCdh7vXfShUHc2Npww2pCQPaH',                  // required: there is no "the" pool to default to
  connection: new Connection(process.env.RPC_URL!, 'confirmed'),
  signer: Keypair.fromSecretKey(secret),   // never transmitted
});

// Omitting `pool` throws here, at construction, rather than 404-ing on
// GET /pool/undefined one round trip later. A deployment may index more than
// one pool, and only you know which one you are insuring against.

import { ApeCover } from '@apecover/sdk';

const ape = new ApeCover({
  chain: 'robinhood-testnet',              // omit for solana — that is the default
  apiKey: process.env.APECOVER_API_KEY!,
  pool: '0x932e54A4929f156154dABa61d30abe5172542370',
  signer: wallet,                          // { address, sendTransaction } — any library
  evmAccess,                               // allowance / send / confirmed / registration
});

// Ask what the chain can do rather than catching an error that says it cannot.
if (ape.capabilities.approvals) {
  // ERC-20 pools need one; insureTrade tops it up only when the standing
  // allowance does not already cover the premium.
}
console.log(ape.capabilities.settlementLagSeconds);  // 843 here, 0 on Solana

const ape = new ApeCover({ chain: 'robinhood', apiKey, pool, signer, evmAccess });

console.log(ape.chainName);                          // 'robinhood'
console.log(ape.capabilities.approvals);             // true  — false on Solana
console.log(ape.capabilities.rent);                  // false — true on Solana
console.log(ape.capabilities.settlementLagSeconds);  // 843 — ADR-0013's measured peak

// Budget on the peak rather than an average: the safe tag steps rather than lags,
// so a client that waits the average waits too little half the time.

const me = await ape.whoami();

if (!me.partner.earning) {
  // Approved is not the same as earning: an operator still has to run
  // register_partner before policy.partner has anything to point at.
  console.log('no revenue share yet:', me.partner.status);
}

const pool = await ape.pool();

console.log(pool.paused, pool.totalLiabilities, pool.expiryBacklog);
// Amounts are base units of pool.settlementMint. Scale by that, not by 1e9.

const quote = await ape.quote({
  tier: 'standard',
  tradeSize: 300_000_000n,        // lamports per covered trade
  tokenMint,                      // required: the entry gate is priced against it
  packSize: 10,                   // optional, defaults to a single trade
});

console.log(quote.eligible, quote.quote?.premium);

// marketCapMicroUsd is optional and is micro-USD, not lamports (1_000_000 = $1).
// Omit it and the deployment looks it up; if it cannot, the gate does not run and
// marketCap comes back null rather than silently passing.

// After your swap confirms, before you reply to the user.
const result = await ape.insureTrade({
  swapSignature,            // base58, exactly as your swap returned it
  tokenMint,
  tradeSize: fill.lamportsSpent,  // pass it: a policy bought without one is refused
  tier: 'standard',
});

if (result.status === 'insured') console.log('covered', result.trade);
else if (result.status === 'declined') console.log('no cover:', result.reason);
else console.log('sent, outcome pending', result.signature);

const result = await ape.buyPolicy('standard', 300_000_000n);

if (result.status === 'bought') console.log('pack bought', result.policy, result.index);
else if (result.status === 'declined') console.log('no pack:', result.reason);
else console.log('sent, outcome pending', result.signature);

const chain = await ape.chain();
const vault = chain.vaultAddress();

const protocol = await ape.protocol();

// Crank an expired trade's reservation back into the pool — permissionless.
const result = await protocol.expireTrade({ trade, policy, owner });
console.log(result.signature);

const protocol = await ape.protocol();

// 0.5 SOL, in lamports. Refused under the minimum with UnderwriterStakeTooSmall.
const result = await protocol.underwrite(500_000_000n);
if (result.status !== 'confirmed') throw new Error(result.detail);

const protocol = await ape.protocol();

const result = await protocol.withdrawStake(100_000_000n);
// 'failed' with UnderwriterLocked means the lockup, not an error to retry blindly.
console.log(result.status, result.status === 'failed' ? result.detail : '');

const protocol = await ape.protocol();

// Everything owed. There is no partial claim.
const result = await protocol.claimRewards();
console.log(result.status);

const protocol = await ape.protocol();

// The signer's own position by default; pass a public key for anybody else's.
console.log(protocol.underwriterAddress().toBase58());

import { PlatformClient } from '@apecover/sdk';

const platform = new PlatformClient({ apiKey: process.env.APECOVER_API_KEY! });
const me = await platform.whoami();

const pool = await platform.pool('3J31LrGG5Ko7iECH4o4QCdh7vXfShUHc2Npww2pCQPaH');

const result = await platform.attest({
  owner, pool, policyIndex: 0n, tradeIndex: 3n, tokenMint, swapSignature,
});

if (result.status === 'refused') return result.reason;   // 200, not an error
// Deserialise, sign, send. Do not rebuild it — any change voids the attestor's signature.

import { findPool } from '@apecover/core/solana';
import { PublicKey } from '@solana/web3.js';

const [pool] = findPool(new PublicKey(programId));

const [vault] = findVault(new PublicKey(programId), new PublicKey(pool));

const [policy] = findPolicy(
  new PublicKey(programId), new PublicKey(pool), owner.publicKey, 0n,
);

const [trade] = findTrade(new PublicKey(programId), policy, 3n);

const [exposure] = findWalletExposure(
  new PublicKey(programId), new PublicKey(pool), owner.publicKey,
);

import { findSwapCover } from '@apecover/core/solana';
import { swapSignatureBytes } from '@apecover/common';

// swapSignatureBytes, not a bare base58 decode: it is the same decoder the program's seeds
// are derived from, and two implementations of "is this a signature" is how one swap ended
// up with two cover markers (DEG-155).
const [cover] = findSwapCover(
  new PublicKey(programId),
  new PublicKey(pool),
  swapSignatureBytes(swapSignature),
);

const [claim] = findClaim(new PublicKey(programId), trade);

import { quoteSingleTrade } from '@apecover/core';
import { fetchPool } from '@apecover/core/solana';

const pool = await fetchPool(connection, programId);
if (pool === null) throw new Error('no pool on this cluster');

const tier = pool.tiers[1]!;                 // 0 basic, 1 standard, 2 degen-max
const ctx = {
  premiumBps: BigInt(tier.premiumBps),
  payoutRatioBps: BigInt(tier.payoutRatioBps),
  maxEntryMarketCap: BigInt(tier.maxEntryMarketCap),
  perTradeCap: BigInt(pool.perTradeCap),
  minTradeSize: BigInt(pool.minTradeSize),
  maxTradeSize: BigInt(pool.maxTradeSize),
  protocolFeeBps: BigInt(pool.protocolFeeBps),
  partnerFeeBps: BigInt(pool.partnerFeeBps),
  underwriterFeeBps: BigInt(pool.underwriterFeeBps),
  maxUtilizationBps: BigInt(pool.maxUtilizationBps),
  totalLiabilities: BigInt(pool.totalLiabilities),
  vaultLamports: BigInt(pool.vaultReserves),
  deployedLamports: BigInt(pool.deployedLamports),
  unclaimedUnderwriterRewards: BigInt(pool.unclaimedUnderwriterRewards),
  rentExemptMinimum: BigInt(await connection.getMinimumBalanceForRentExemption(0)),
  paused: pool.paused,
};

const { premium, payout } = quoteSingleTrade(ctx, 300_000_000n);

effectivePartnerFeeBps(ctx);                    // no partner → 0n
effectivePartnerFeeBps(ctx, { active: true });  // → ctx.partnerFeeBps

const result = checkEligibility(
  ctx,
  300_000_000n,      // this trade
  9_500_000_000n,    // market cap in micro-USD
  300_000_000n,      // what the policy already covers per trade
);

if (!result.eligible) console.log('would be refused:', result.reasons);

const pool = await fetchPool(connection, programId);
const used = utilizationBps(pool!);   // 4200 = 42%

const pool = await fetchPool(connection, programId);
// Headroom the program would agree with, in basis points.
const headroom = Math.max(0, pool!.maxUtilizationBps - backingUtilizationBps(pool!));

import { Connection } from '@solana/web3.js';
import { fetchPool } from '@apecover/core/solana';

const connection = new Connection(process.env.RPC_URL!, 'confirmed');
const pool = await fetchPool(connection, process.env.APECOVER_PROGRAM_ID!);
if (pool === null) throw new Error('no pool on this cluster');

try {
  await ape.insureTrade(params);
} catch (error) {
  const declined = declineFor(error);
  if (declined === null) throw error;      // a real fault — do not swallow it
  console.log('refused:', declined.reason, declined.detail);
}

import { PriceSourceKind, sourceVariant } from '@apecover/sdk';

const variant = sourceVariant(PriceSourceKind.Pyth);   // → the IDL variant name

import { EvmChainAdapter } from '@apecover/core/evm';
import { evmAddress } from '@apecover/common';

const adapter = new EvmChainAdapter({
  chain: 'robinhood-testnet',
  pool: evmAddress('0x932e54A4929f156154dABa61d30abe5172542370'),
});

const call = adapter.buildCreatePolicy({
  owner: evmAddress('0x00000000000000000000000000000000000000a1'),
  tier: 1, packSize: 10, coveredTradeSize: 1_000n,
  premium: 30_000_000_000_000_000n,   // what the quote said; see below
});
// { kind, to, data, value } — sign it with whatever wallet you already have.
//
// `premium` is required on a native pool and is the *value* of the call, not an
// argument in it: createPolicy is payable, the contract recomputes the premium
// from its own tier table, and it reverts NativeValueMismatch() on any other
// amount — zero included. On an ERC-20 pool the allowance pays and value is 0.

adapter.addressFor({ kind: 'policy', index: 3n });   // '3', not an address

import { SolanaChainAdapter } from '@apecover/core/solana';

const adapter = new SolanaChainAdapter({
  programId: '4xhLjuNsJPE4XssmJTYhL7d5VHhHTs4S8yKSVXSbxnU8',
  pool: '3J31LrGG5Ko7iECH4o4QCdh7vXfShUHc2Npww2pCQPaH',
});

adapter.addressFor({ kind: 'vault' });   // a base58 PDA, not an id

Endpoint reference

15 endpoints, generated from the service’s own route table. A field marked ? is optional.

These are the endpoints an API key can call, and they are the whole of what an integration touches.

https://apecover.io/api/openapi.json generates from the same route table as this page, and is wider than it: the document is the deployment’s own inventory, so it also carries routes that are served without being part of the integration contract.

What this API is not

Every read here comes from the indexed projection of the event log, not from the chain directly, so it can be a few seconds behind — which is why a projection read carries a freshness stamp rather than leaving you to assume it is current. It is the right source for a dashboard and the wrong one for a decision that moves money. The keeper re-reads the chain before finalising anything, and so should you.

Read that stamp in the unit the chain counts in. On Solana it is asOfSlot; on Robinhood Chain the projection folds blocks, and a slot number and a block number are two unrelated clocks — comparing one to the other is a category error rather than a small inaccuracy. And not every route has one: the fact strip at the top of this page says which do.

/quote is the exception: it reads pool parameters from chain, because a quote is a number the caller is about to act on. On Solana. The reader it uses is a Solana account reader and there is no EVM one, which is the whole of why the price is missing from a Robinhood quote.