Prediction-markets

List stored venue credentials (metadata only — never material)

Responses

• credentials object[] (required)

Example

curl -X GET https://api.cofferline.com/v1/pm/credentials \
  -H "authorization: Bearer $TOKEN"

Store a venue trade credential (verified live, sealed at rest)

The credential is authenticated against the venue before anything is stored — an invalid key is refused. Material is sealed at rest (AES-256-GCM, bound to your tenant + venue), write-only — no endpoint returns it — and revocation zeroes the ciphertext. Every use is confined server-side to the known trading operations (order place/cancel, authenticated reads, collateral wrap), audited per use, and volume-watched (a security.alert webhook fires on anomalous usage). Know what you are handing over. Polymarket: the signer key you store is a FULL OWNER of your funder wallet (Polymarket binds each funder to exactly one signer; Safe funders are 1-of-1), so the trading-only constraint is Cofferline's application policy, not cryptography — a hypothetical compromise of the sealed store would mean control of that one funder. Use a dedicated signer EOA, keep only working trading balances in the funder, and rotate the signer (GET /v1/pm/credentials/{id}/rotation) quarterly or on personnel change. Geo-gated (451) like every prediction-market surface.

Request body

Responses

• id string (required)
• venue "kalshi" | "polymarket" (required)
• label string,null (required)
• meta object,null (required)
• created_at object (required)
• revoked_at object (required)

Example

curl -X POST https://api.cofferline.com/v1/pm/credentials \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{}'

Revoke a credential (ciphertext destroyed — nothing left to leak)

Parameters

• id in path, string (required)

Responses

• id string (required)
• venue "kalshi" | "polymarket" (required)
• label string,null (required)
• meta object,null (required)
• created_at object (required)
• revoked_at object (required)

Example

curl -X DELETE https://api.cofferline.com/v1/pm/credentials/{id} \
  -H "authorization: Bearer $TOKEN"

Signer rotation calldata: swap the funder Safe's owner to a new EOA

For Polymarket Safe funders (signature_type 2): returns the Safe swapOwner calldata that replaces the credential's stored signer with new_owner, with the owner-linked-list prevOwner parameter derived from the live on-chain owner set (the 0x…01 sentinel for a 1-of-1 Safe). Non-custodial: Cofferline never submits this transaction — you execute it from the funder Safe with your own wallet/UI, then re-store the credential with the new key and revoke the old one (revocation zeroes the sealed material). Recommended cadence: quarterly, or immediately on personnel change or suspected exposure — recommendation only; nothing is enforced server-side.

Parameters

• id in path, string (required)
• new_owner in query, string (required)

Responses

• credential_id string (required)
• venue "polymarket" (required)
• funder string (required)
• old_owner string (required)
• new_owner string (required)
• prev_owner string (required)
• call object (required)
• sequence string[] (required)
• rotation_policy string (required)

Example

curl -X GET https://api.cofferline.com/v1/pm/credentials/{id}/rotation \
  -H "authorization: Bearer $TOKEN"

The credential's resting orders, venue-authoritative (reconnect recovery)

Parameters

• credential_id in query, string (required)
• market in query, string

Responses

• orders object[] (required)

Example

curl -X GET https://api.cofferline.com/v1/pm/orders \
  -H "authorization: Bearer $TOKEN"

Route a prediction-market limit order under policy

Places a LIMIT order on Polymarket with your stored trade-scoped credential. The wallet's prediction_markets policy rules are enforced server-side with the ledger-derived exposure floor (#124) — an order the policy forbids is refused with the violated rule, never transmitted. Metered per order (base + bps) from the prepaid balance. Geo-gated (451); disabled environments answer EXECUTION_DISABLED. An operator can also switch off ONE venue platform-wide (#232): that answers EXECUTION_DISABLED naming the venue and the operator's reason, and affects only placement — cancels, cancel-all, open-order reads and fill sync keep working at a switched-off venue, so a position can always be exited.

Request body

• venue "polymarket"
• wallet string (required)
• credential_id string (required)
• condition_id string (required)
• token_id string (required)
• action "buy" | "sell" (required)
• price_usd string (required)
• size_shares string (required)
• client_order_id string
• state object

Responses

• venue "kalshi" | "polymarket" (required)
• order_id string (required)
• status string (required)
• cost_usd string (required)
• fee_usd string (required)
• policy_version integer (required)

Example

curl -X POST https://api.cofferline.com/v1/pm/orders \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{"wallet":"…","credential_id":"…","condition_id":"…","token_id":"…","action":"buy","price_usd":"…","size_shares":"…"}'

Cancel every resting order for the credential (optionally one market)

Parameters

• credential_id in query, string (required)
• market in query, string

Responses

• venue "kalshi" | "polymarket" (required)
• cancelled integer (required)
• order_ids string[] (required)
• failed_order_ids string[]
• complete boolean (required)

Example

curl -X DELETE https://api.cofferline.com/v1/pm/orders \
  -H "authorization: Bearer $TOKEN"

Prepare a client-signed Polymarket order (returns EIP-712 to sign)

The first half of the client-signed flow (#353), for Polymarket credentials you store WITHOUT a signer key. Runs every risk check the hosted route runs — jurisdiction, execution gates, the ledger-derived exposure floor (#124), your policy, the platform ceiling — then reserves the exposure and debits the fee on a durable 'prepared' order and returns the EXACT Polymarket V2 order struct plus its ready-to-sign EIP-712 payload. Sign typed_data with your own eth_signTypedData_v4 tooling (the same key that derived your stored CLOB creds) and POST the signature to /v1/pm/orders/submit before expires_at. If you never submit, the prepared order is swept and its hold + fee are released. Cofferline never receives your signer key.

Request body

• venue "polymarket"
• wallet string (required)
• credential_id string (required)
• condition_id string (required)
• token_id string (required)
• action "buy" | "sell" (required)
• price_usd string (required)
• size_shares string (required)
• client_order_id string
• state object

Responses

• venue "polymarket" (required)
• prepare_id string (required)
• client_order_id string (required)
• typed_data object (required)
• order object (required)
• cost_usd string (required)
• fee_usd string (required)
• policy_version integer (required)
• expires_at object (required)

Example

curl -X POST https://api.cofferline.com/v1/pm/orders/prepare \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{"wallet":"…","credential_id":"…","condition_id":"…","token_id":"…","action":"buy","price_usd":"…","size_shares":"…"}'

Submit a signed client-signed Polymarket order

The second half of the client-signed flow (#353). Provide the prepare_id from /v1/pm/orders/prepare and your EIP-712 signature over the returned typed_data. Cofferline verifies the signature recovers to your declared signer, then relays the order to the CLOB under your trade-only credentials through the SAME coordinator admission the hosted path uses. A prepared order that already expired, or one whose signature does not recover to the declared signer, is refused and nothing is transmitted.

Request body

• prepare_id string (required)
• signature string (required)

Responses

• venue "kalshi" | "polymarket" (required)
• order_id string (required)
• status string (required)
• cost_usd string (required)
• fee_usd string (required)
• policy_version integer (required)

Example

curl -X POST https://api.cofferline.com/v1/pm/orders/submit \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{"prepare_id":"…","signature":"…"}'

Cancel a resting prediction-market order

Parameters

• venue in path, "polymarket" (required)
• order_id in path, string (required)
• credential_id in query, string (required)

Responses

• venue "kalshi" | "polymarket" (required)
• order_id string (required)
• status string (required)

Example

curl -X DELETE https://api.cofferline.com/v1/pm/orders/{venue}/{order_id} \
  -H "authorization: Bearer $TOKEN"

Polymarket trade-readiness: live approval status + missing calldata

Reads the six on-chain V2 grants (pUSD allowance and CTF operator approval for the V2 CTF Exchange, V2 Neg Risk Exchange, and Neg Risk Adapter) plus live pUSD/USDC.e balances for the given funds-holding wallet, and returns owner-signable calldata for any missing grants — and for the USDC.e→pUSD wrap when raw USDC.e is present (the autonomous replacement for the venue UI's confirm-funds step). Non-custodial: submitting them is your own transaction. Geo-gated like every prediction-market surface.

Parameters

• address in path, string (required)

Responses

• address string (required)
• trade_ready boolean (required)
• approvals object[] (required)
• collateral object (required)
• collateral_note string (required)

Example

curl -X GET https://api.cofferline.com/v1/pm/onboarding/{address} \
  -H "authorization: Bearer $TOKEN"

Resolve an owner EOA to its Polymarket funder Safe candidates

Looks up every Polygon Safe the owner controls via the Safe Transaction Service, reads each candidate's six V2 trade grants and pUSD/USDC.e collateral, and names the likeliest funder (most grants set, then most pUSD). Use when the venue UI is unavailable or the agent never had one. Geo-gated like every Polymarket surface.

Parameters

• owner in path, string (required)

Responses

• owner string (required)
• funder string,null (required)
• candidates object[] (required)

Example

curl -X GET https://api.cofferline.com/v1/pm/funder/{owner} \
  -H "authorization: Bearer $TOKEN"

Journal venue fills into the wallet's ledger (idempotent)

Pages the credential's fills newest-first and journals each unseen fill as a balanced double-entry group under the given wallet, stamped with the wallet's active policy hash. Re-running never double-books — the venue fill/trade id is the settlement identity. Feeds the server-side exposure floor. Polymarket journals CLOB trades (resolution redemptions are on-chain CTF events, outside this reader).

Request body

• wallet string (required) — The treasury wallet whose books receive the fills
• credential_id string (required)

Responses

• journaled integer (required)
• skipped integer (required)
• settlements_journaled integer (required)
• complete boolean (required)

Example

curl -X POST https://api.cofferline.com/v1/pm/fills/sync \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{"wallet":"…","credential_id":"…"}'

Wrap the funder Safe's USDC.e into pUSD (platform-relayed, no user gas)

For Safe-type Polymarket credentials: signs approve(CollateralOnramp) + wrap() as Safe transactions with the sealed trade signer (the Safe owner) and relays them through the platform executor, which pays gas. The autonomous, API-only equivalent of the venue UI's confirm-funds step. Wraps the full unwrapped USDC.e balance unless amount_base_units narrows it.

Request body

• credential_id string (required)
• amount_base_units string

Responses

• wrapped_base_units string (required)
• txs string[] (required)
• collateral object (required)

Example

curl -X POST https://api.cofferline.com/v1/pm/wrap \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{"credential_id":"…"}'