API overview

The _gamma API gives partners programmatic access to the protocol: read vault directories, NAV, statistics, allocations, and per-wallet portfolio data, and build unsigned deposit and withdraw transactions that your own wallet signs and submits.

Base URL

All endpoints live under /api.

Environment	Base URL
Production	https://app.gma.fi
Beta	https://beta.gma.fi

Examples in this reference use https://app.gma.fi.

Response envelope

Every JSON endpoint returns the same envelope. On success:

{
  "success": true,
  "data": { }
}

On error:

{
  "success": false,
  "error": "Human-readable message",
  "details": "optional, dev-only extra context"
}

Always branch on success rather than inferring status from the HTTP code alone.

Tiers

The API has two tiers:

• Keyless (public) — GET /api/circulating-supply and GET /api/oracle. No credential; Access-Control-Allow-Origin: *; cached at the edge (~60s). See Public endpoints.
• Partner (API-key gated) — everything else. Requires an Authorization: Bearer gma_api_... header. Keys carry a read or write scope and may be restricted to specific vaults and a single wallet. See Authentication.

Rate limits

• Keyless endpoints are rate limited per client IP at roughly 20 requests / 5 seconds.
• Partner endpoints are rate limited per API key using the key's configured per-minute limit (RPM), keyed by the key ID.
• Transaction builds (POST /api/vault/{id}/deposit, and POST or PUT /api/vault/{id}/withdraw) use a separate per-key window with the same RPM, so catalog and status polling cannot block your deposits and withdrawals. A key's total per-minute ceiling is therefore twice its RPM.
• Build capacity. Deposit and withdrawal builds draw on Solana RPC capacity reserved for funds flows, shared with in-app users. Each of your egress IPs gets up to 1,000 RPC credits per hour and 2,500 per day from that reserve, across all of your users. Beyond that, builds use the general capacity, as before. When both are exhausted, a build returns 429 with Retry-After but without X-RateLimit-* headers (those describe your key's window); it returns 503 when capacity cannot be checked.

Rate-limited responses return HTTP 429 with X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and Retry-After headers. Successful partner responses also carry the X-RateLimit-* headers so you can pace requests; on transaction-build responses they describe the build window. Be a good citizen and back off on 429.

Units

Token amounts are returned in Solana-style objects ({ mint, symbol, amount, decimals, uiAmount }) where amount is raw lamports (smallest unit) and uiAmount is the human value.

APY and PnL fields are fractional decimals (0.0824 = 8.24%) unless a page states otherwise. Two endpoints return percent values instead — portfolio-history and the pnlPct field of pnl-history — and both call this out explicitly. Read the unit notes on Vault endpoints before charting anything.

Next: Authentication