The SignalFloor REST API is available on the Elite subscription tier. Authenticate with a bearer token generated from your account settings. Base URL is https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api. Every endpoint requires a scope that is attached to the API key at creation time: signals:read gives access to signal endpoints, providers:read for provider endpoints. Rate limit defaults to 60 requests per minute per key.

Elite API

SignalFloor REST API

Programmatic access to signals, providers, and portfolio data for Elite subscribers. Build bots, dashboards, and integrations against the same data the SignalFloor app uses.

Generate API keyView Elite plan
  • Bearer-authenticated
  • 60 req/min default
  • Scope-gated & revocable

Authentication

Include your API key as a bearer token in the Authorization header:

GET https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/signals HTTP/1.1
Authorization: Bearer sf_<your-key>
Accept: application/json

Keys are created and revoked at /settings → API Keys. The raw key is shown once at creation — we only store a SHA-256 hash server-side.

Quickstart — downloads & code samples

Import the OpenAPI spec into your SDK generator of choice (Kiota, OpenAPI Generator, Orval, etc.) or drop the Postman collection into Postman / Bruno / Insomnia. Both files ship the full `/v1` surface.

OpenAPI 3.1 spec

/api/openapi.json — feed into any spec-driven SDK generator.

Postman collection

/api/postman.json — v2.1 schema. Set the api_key variable and run.

List recent signals (same call, three languages)

curlGET /v1/signals
curl -sS "https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/v1/signals?limit=5" \
  -H "Authorization: Bearer sf_your_key_here"
JavaScript (fetch)GET /v1/signals
const res = await fetch(
  "https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/v1/signals?limit=5",
  { headers: { Authorization: "Bearer " + process.env.SIGNALFLOOR_API_KEY } },
);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const { data, pagination } = await res.json();
console.log(`Got ${data.length} signals, next_cursor=${pagination.next_cursor}`);
Python (requests)GET /v1/signals
import os, requests

r = requests.get(
    "https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/v1/signals",
    headers={"Authorization": f"Bearer {os.environ['SIGNALFLOOR_API_KEY']}"},
    params={"limit": 5},
    timeout=10,
)
r.raise_for_status()
body = r.json()
print(f"Got {len(body['data'])} signals; "
      f"version={r.headers.get('X-API-Version')}; "
      f"remaining={r.headers.get('X-RateLimit-Remaining')}")

All three calls return the same JSON envelope. Swap the `sf_your_key_here` token for your own live or sandbox key — sandbox keys (prefix sf_sandbox_) return deterministic seed data so CI tests are stable.

Endpoints

  • GET/v1/signalssignals:read

    List recent signals. Supports filters: provider_id, asset, direction, status, since (ISO timestamp).

  • GET/v1/signals/{id}signals:read

    Fetch a single signal by ID, including full analysis text.

  • GET/v1/providersproviders:read

    List providers ranked by performance. Elite keys see early-access providers.

  • GET/v1/providers/{id}providers:read

    Fetch one provider's full profile and performance history.

Example response

Successful calls return HTTP 200 with a JSON envelope. Listing endpoints include a next_cursor for pagination when more results are available.

HTTP/1.1 200 OK
Content-Type: application/json
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1728945600

{
  "data": [
    {
      "id": "sig_01H...",
      "provider_id": "prv_01H...",
      "asset": "EURUSD",
      "direction": "buy",
      "entry_price": 1.0842,
      "stop_loss": 1.0810,
      "take_profits": [1.0880, 1.0910],
      "status": "active",
      "created_at": "2026-04-13T09:14:07Z"
    }
  ],
  "next_cursor": null
}

Error codes

All errors return a JSON body with error.code and error.message. Retry 5xx with exponential backoff; do not retry 4xx without fixing the request.

StatusMeaning
400Malformed request — check query params or JSON body.
401Missing or invalid bearer token.
403Valid key but missing required scope for this endpoint.
404Resource ID not found (or hidden from your account).
429Rate limit exceeded. Respect X-RateLimit-Reset / Retry-After.
5xxTransient server error. Safe to retry with exponential backoff.

Rate limits

Default rate limit is 60 requests per minute per API key. Responses include X-RateLimit-Remaining and X-RateLimit-Reset headers. Exceeding the limit returns 429 Too Many Requests. Need a higher limit? Reach out to your account manager.

Frequently asked questions

Who can use the SignalFloor API?

The API is currently available to Elite-tier subscribers. Trader and Pro accounts can preview the documentation, but bearer tokens can only be generated on an active Elite subscription.

How do I authenticate?

Include your API key as a bearer token in the Authorization header: 'Authorization: Bearer sf_<your-key>'. Keys are generated at /settings → API Keys. The raw key is shown once at creation; we only store a SHA-256 hash server-side.

What are the rate limits?

Default limit is 60 requests per minute per API key. Every response includes X-RateLimit-Remaining and X-RateLimit-Reset headers. Exceeding the limit returns HTTP 429 with a Retry-After header.

Which scopes are available?

Scopes are assigned at key creation: 'signals:read' grants access to /signals endpoints, 'providers:read' grants access to /providers endpoints. Requests with an insufficient scope return HTTP 403.

How do I revoke a compromised key?

Visit /settings → API Keys, find the key by its prefix (the first 8 characters are stored for display), and click Revoke. Revoked keys stop working immediately. Generating a fresh key does not affect existing keys.

Is there a sandbox or test environment?

Yes. Mint a sandbox key (free, no Elite subscription required) by calling the `create_public_api_key_sandbox` RPC from your Supabase dashboard or from the Settings → API Keys page. Sandbox keys have the prefix `sf_sandbox_` and resolve against deterministic seed data — same request, same bytes, every time — so they're safe for CI integration fixtures. Rate limit is 30 req/min.

How is the API versioned?

All endpoints live under the `/v1/` prefix. Un-versioned legacy paths still work but carry `Deprecation: true` + `Sunset: Wed, 22 Oct 2026 00:00:00 GMT` response headers. Full policy at /api-docs#versioning. Inside a major version we guarantee no breaking field removals, no contract flips, and additive-only changes.

Ready to integrate?

Elite subscribers can generate unlimited keys from Settings. Every key is scoped, rate-limited, and fully revocable.

Manage API keys