SignalFloor REST API
Programmatic access to signals, providers, and portfolio data for Elite subscribers. Build bots, dashboards, and integrations against the same data the SignalFloor app uses.
- Bearer-authenticated
- 60 req/min default
- Scope-gated & revocable
Authentication
Include your API key as a bearer token in the Authorization header:
GET https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/signals HTTP/1.1
Authorization: Bearer sf_<your-key>
Accept: application/jsonKeys are created and revoked at /settings → API Keys. The raw key is shown once at creation — we only store a SHA-256 hash server-side.
Quickstart — downloads & code samples
Import the OpenAPI spec into your SDK generator of choice (Kiota, OpenAPI Generator, Orval, etc.) or drop the Postman collection into Postman / Bruno / Insomnia. Both files ship the full `/v1` surface.
OpenAPI 3.1 spec
/api/openapi.json — feed into any spec-driven SDK generator.
Postman collection
/api/postman.json — v2.1 schema. Set the api_key variable and run.
List recent signals (same call, three languages)
curl -sS "https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/v1/signals?limit=5" \
-H "Authorization: Bearer sf_your_key_here"const res = await fetch(
"https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/v1/signals?limit=5",
{ headers: { Authorization: "Bearer " + process.env.SIGNALFLOOR_API_KEY } },
);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const { data, pagination } = await res.json();
console.log(`Got ${data.length} signals, next_cursor=${pagination.next_cursor}`);import os, requests
r = requests.get(
"https://vszujmlwpywubgzfrxbs.supabase.co/functions/v1/public-api/v1/signals",
headers={"Authorization": f"Bearer {os.environ['SIGNALFLOOR_API_KEY']}"},
params={"limit": 5},
timeout=10,
)
r.raise_for_status()
body = r.json()
print(f"Got {len(body['data'])} signals; "
f"version={r.headers.get('X-API-Version')}; "
f"remaining={r.headers.get('X-RateLimit-Remaining')}")All three calls return the same JSON envelope. Swap the `sf_your_key_here` token for your own live or sandbox key — sandbox keys (prefix sf_sandbox_) return deterministic seed data so CI tests are stable.
Endpoints
- GET
/v1/signalssignals:readList recent signals. Supports filters: provider_id, asset, direction, status, since (ISO timestamp).
- GET
/v1/signals/{id}signals:readFetch a single signal by ID, including full analysis text.
- GET
/v1/providersproviders:readList providers ranked by performance. Elite keys see early-access providers.
- GET
/v1/providers/{id}providers:readFetch one provider's full profile and performance history.
Example response
Successful calls return HTTP 200 with a JSON envelope. Listing endpoints include a next_cursor for pagination when more results are available.
HTTP/1.1 200 OK
Content-Type: application/json
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1728945600
{
"data": [
{
"id": "sig_01H...",
"provider_id": "prv_01H...",
"asset": "EURUSD",
"direction": "buy",
"entry_price": 1.0842,
"stop_loss": 1.0810,
"take_profits": [1.0880, 1.0910],
"status": "active",
"created_at": "2026-04-13T09:14:07Z"
}
],
"next_cursor": null
}Error codes
All errors return a JSON body with error.code and error.message. Retry 5xx with exponential backoff; do not retry 4xx without fixing the request.
| Status | Meaning |
|---|---|
| 400 | Malformed request — check query params or JSON body. |
| 401 | Missing or invalid bearer token. |
| 403 | Valid key but missing required scope for this endpoint. |
| 404 | Resource ID not found (or hidden from your account). |
| 429 | Rate limit exceeded. Respect X-RateLimit-Reset / Retry-After. |
| 5xx | Transient server error. Safe to retry with exponential backoff. |
Rate limits
Default rate limit is 60 requests per minute per API key. Responses include X-RateLimit-Remaining and X-RateLimit-Reset headers. Exceeding the limit returns 429 Too Many Requests. Need a higher limit? Reach out to your account manager.
Frequently asked questions
Who can use the SignalFloor API?
The API is currently available to Elite-tier subscribers. Trader and Pro accounts can preview the documentation, but bearer tokens can only be generated on an active Elite subscription.
How do I authenticate?
Include your API key as a bearer token in the Authorization header: 'Authorization: Bearer sf_<your-key>'. Keys are generated at /settings → API Keys. The raw key is shown once at creation; we only store a SHA-256 hash server-side.
What are the rate limits?
Default limit is 60 requests per minute per API key. Every response includes X-RateLimit-Remaining and X-RateLimit-Reset headers. Exceeding the limit returns HTTP 429 with a Retry-After header.
Which scopes are available?
Scopes are assigned at key creation: 'signals:read' grants access to /signals endpoints, 'providers:read' grants access to /providers endpoints. Requests with an insufficient scope return HTTP 403.
How do I revoke a compromised key?
Visit /settings → API Keys, find the key by its prefix (the first 8 characters are stored for display), and click Revoke. Revoked keys stop working immediately. Generating a fresh key does not affect existing keys.
Is there a sandbox or test environment?
Yes. Mint a sandbox key (free, no Elite subscription required) by calling the `create_public_api_key_sandbox` RPC from your Supabase dashboard or from the Settings → API Keys page. Sandbox keys have the prefix `sf_sandbox_` and resolve against deterministic seed data — same request, same bytes, every time — so they're safe for CI integration fixtures. Rate limit is 30 req/min.
How is the API versioned?
All endpoints live under the `/v1/` prefix. Un-versioned legacy paths still work but carry `Deprecation: true` + `Sunset: Wed, 22 Oct 2026 00:00:00 GMT` response headers. Full policy at /api-docs#versioning. Inside a major version we guarantee no breaking field removals, no contract flips, and additive-only changes.
Ready to integrate?
Elite subscribers can generate unlimited keys from Settings. Every key is scoped, rate-limited, and fully revocable.
Manage API keys