API Reference

The app exposes a small set of serverless routes under src/app/api/. They back interactive features; none expose the time-series database directly.

GET /api/carry-oracle?key=<strategyKey>

Returns the oracle-transparency report for one carry strategy: the curated platform mechanism + per-token explanation + risk notes, merged with live on-chain reads (oracle address, description(), current rate, Fluid operate-vs-liquidation spread). Used by the lazy-loaded ORACLE tab.

• key is validated against ^[a-z0-9-]{3,80}$ and only used for an object lookup in the curated config (it never reaches the RPC call arguments), so there is no injection surface.
• Responses: 200 (report), 400 (bad key), 404 (no oracle config for that strategy), 502 (on-chain read failed). Cached s-maxage=1800, stale-while-revalidate=3600.

POST /api/sim/swap-cost

Quotes the execution cost of a leveraged-carry round trip using the 0x Swap API (indicative /price). The number of swaps priced depends on the strategy's swapTokens.kind (single, t2-smart-col, t3-smart-debt, t4-smart-pool). Returns per-leg slippage/fees so the trade simulator can show entry/exit cost and the tiered cost warnings. Falls back to a fixed-bps estimate when a live quote isn't available.

POST /api/notify-capacity

Captures an email + strategy for a borrow-capacity alert into capacity_notifications. Validates email / address / strategy-key / symbol shapes and uses a honeypot field. Returns 200 for both fresh and duplicate signups (it does not leak which pairs already exist). The send pipeline is not wired yet; this endpoint only captures.

POST /api/newsletter/subscribe

Captures a newsletter signup into newsletter_subscribers.