Account

Admin: list accounts (paginated)

get

Authorizations

bearer

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

pagenumberOptional

Page number (default: 1)

Example: 1

pageSizenumberOptional

Number of items per page (default: 10)

Example: 10

sortstringOptional

Sort field and order. Use - prefix for descending. Example: -createdAt, createdAt

Example: -createdAt

selectstringOptional

Fields to select (comma separated). Use + prefix to include hidden fields. Example: name,status,+holders

populatestringOptional

Relations to populate (comma separated). Example: wallet,token

Responses

200Success

No content

get/api/account

HTTPcURLJavaScriptPython

GET /api/account HTTP/1.1
Host: api.bound.exchange
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200Success

No content

get

Responses

200Success

No content

get/api/account/me

HTTPcURLJavaScriptPython

GET /api/account/me HTTP/1.1
Host: api.bound.exchange
Accept: */*

200Success

No content

Verify a referral code is valid (public)

get

Path parameters

codestringRequired

Responses

200Success

No content

get/api/account/referral-code/{code}/verify

HTTPcURLJavaScriptPython

GET /api/account/referral-code/{code}/verify HTTP/1.1
Host: api.bound.exchange
Accept: */*

200Success

No content

Change password step 1 — get current password challenge

post

Returns sessionId, salt, and serverPublic (B) to begin SRP proof of the existing password.

Responses

200

Returns sessionId, salt, and serverPublic (B)

No content

post/api/account/srp/change-password/init

HTTPcURLJavaScriptPython

POST /api/account/srp/change-password/init HTTP/1.1
Host: api.bound.exchange
Accept: */*

200

Returns sessionId, salt, and serverPublic (B)

No content

Change password step 2 — verify old password and set new credentials

post

Client proves knowledge of the old password via M1, then submits new salt, verifier, and encrypted blob atomically.

Body

application/json

sessionIdstringRequired

Session ID returned by POST /auth/srp/change-password/init

clientPublicstringRequired

Client ephemeral public key A = g^a mod N (base64)

clientProofstringRequired

Client proof M1 = H(H(N)⊕H(g) || H(I) || salt || A || B || K) (base64)

newSrpSaltstringRequired

New SRP salt generated client-side (base64, 32 bytes)

newSrpVerifierstringRequired

New SRP verifier v = g^x mod N (base64)

newEncryptedBlobstringRequired

Keystore blob re-encrypted with new derived key (base64, max 13708 chars)

newPasswordHintstringOptional

New password hint

Responses

200

Password changed — returns serverProof (M2) for client verification

No content

post/api/account/srp/change-password/verify

HTTPcURLJavaScriptPython

POST /api/account/srp/change-password/verify HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 158

{
  "sessionId": "text",
  "clientPublic": "text",
  "clientProof": "text",
  "newSrpSalt": "text",
  "newSrpVerifier": "text",
  "newEncryptedBlob": "text",
  "newPasswordHint": "text"
}

200

Password changed — returns serverProof (M2) for client verification

No content

Rotate auth wallet — atomically swap the keystore to a new external wallet

post

Wallet-auth accounts only. Client re-encrypts the blob with the NEW wallet derivation key client-side; server verifies the NEW wallet control proof (fresh nonce) and atomically replaces encryptedBlob + auth-wallet fields. Old-wallet derivation signature is never sent.

Authorizations

bearer

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

application/json

addressstringRequired

Address of the NEW auth wallet

chainstring · enumRequiredPossible values:

publicKeystringRequired

Public key of the NEW auth wallet (verifies EVM/Solana signatures)

providerstringRequired

metamask | phantom | xverse | okx | unisat

challengeIdstringRequired

challengeId from GET /auth/wallet/challenge?address=

signaturestringRequired

NEW wallet signature over the issued server nonce (control proof)

encryptedBlobstringRequired

Keystore blob re-encrypted client-side with the NEW wallet derivation key

Responses

200

Auth wallet rotated

No content

400

Method not allowed, signature invalid, challenge invalid, taken, or not a wallet keystore

401

Unauthorized

post/api/account/wallet/rotate

HTTPcURLJavaScriptPython

POST /api/account/wallet/rotate HTTP/1.1
Host: api.bound.exchange
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 132

{
  "address": "text",
  "chain": "evm",
  "publicKey": "text",
  "provider": "text",
  "challengeId": "text",
  "signature": "text",
  "encryptedBlob": "text"
}

No content

Set up TOTP 2FA — generate a new secret and return the otpauth URI

post

Responses

200

Returns otpauthUri for QR code rendering

No content

post/api/account/2fa/setup

HTTPcURLJavaScriptPython

POST /api/account/2fa/setup HTTP/1.1
Host: api.bound.exchange
Accept: */*

200

Returns otpauthUri for QR code rendering

No content

Enable or disable TOTP 2FA — requires a valid OTP code

post

Body

application/json

object · TotpToggleDtoOptional

Responses

200

2FA state toggled

No content

400

Invalid OTP code or setup not completed

post/api/account/2fa/toggle

HTTPcURLJavaScriptPython

POST /api/account/2fa/toggle HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content

Set an inscription as the account avatar

patch

Body

application/json

inscriptionIdstring · nullableOptional

The inscriptionId to set as avatar. Pass null or omit to remove the avatar.

Responses

200

Avatar updated

No content

400

Inscription not found or not owned by caller

patch/api/account/avatar

HTTPcURLJavaScriptPython

PATCH /api/account/avatar HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 24

{
  "inscriptionId": "text"
}

No content

Remove a default token for a slot

delete

Body

application/json

slotstring · enumRequiredPossible values:

tokenIdstringRequired

Responses

200

Default token removed successfully

No content

400

Invalid slot or tokenId

401

Unauthorized

delete/api/account/default-token

HTTPcURLJavaScriptPython

DELETE /api/account/default-token HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 32

{
  "slot": "usdc",
  "tokenId": "text"
}

No content

Set a default token for a slot

patch

Body

application/json

slotstring · enumRequiredPossible values:

tokenIdstringRequired

Responses

200

Default token set successfully

No content

400

Token not found, unsupported chain, or token invalid for slot

401

Unauthorized

patch/api/account/default-token

HTTPcURLJavaScriptPython

PATCH /api/account/default-token HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 32

{
  "slot": "usdc",
  "tokenId": "text"
}

No content

Initiate email change (or first-time email set) — send verification link to new address

post

Queues a verification email to the new address (and a notice to the current address, if one exists). Returns { srpSession } for SRP accounts; passkey and wallet accounts return {} (they re-authenticate with JWT + emailed token only). Emailless passkey/wallet accounts may use this to set an email for the first time.

Body

application/json

newEmailstringRequired

New email address to associate with the account

Responses

200

Returns { srpSession } for SRP accounts, {} for passkey/wallet accounts

No content

400

New email already taken or same as current email

429

Rate limit exceeded

post/api/account/change-email/init

HTTPcURLJavaScriptPython

POST /api/account/change-email/init HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "newEmail": "text"
}

No content

Confirm email change (or first-time email set) using verification token

post

Finalises the email update. SRP accounts: srpData (sessionId, clientPublic, clientProof, newSrpVerifier) is required, and the srpSession from the init response provides sessionId, salt, and serverPublic. Passkey and wallet accounts re-authenticate with JWT + emailed token only (no step-up) — they send neither srpData nor any passkey fields.

Body

application/json

tokenstringRequired

Verification token from the change-email email link

emailstringRequired

New email address being verified (cross-verified against the token)

Responses

200

Email updated successfully

No content

400

Invalid or expired token, email mismatch, or missing re-auth fields

post/api/account/change-email/verify

HTTPcURLJavaScriptPython

POST /api/account/change-email/verify HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 129

{
  "token": "text",
  "email": "text",
  "srpData": {
    "newSrpVerifier": "text",
    "sessionId": "text",
    "clientPublic": "text",
    "clientProof": "text"
  }
}

No content