Skip to main content

​
Response envelope

The envelope is not uniform across the surface — it depends on the endpoint family. Enveloped (legacy /api/v1/* + raw stats/swaps): 
// Success
{ "success": true, "data": { /* payload */ } }

// Error
{ "success": false, "error": { "code": "...", "message": "..." } }
These endpoints wrap success payloads: /api/v1/pairs, /api/v1/candles, /api/v1/candles/latest, /api/v1/stats, /api/v1/top-movers, /api/v1/protocols (and the raw /stats/*, /swaps/* families). Top-level (no wrapper): newer endpoints return the payload directly — no success/data keys:
  • /screener, /search, /trending, /tokens/{mint}/intel, /tokens/{mint}/risk
For example, /screener returns { results, total_matches, limit, offset, warnings } at the top level. Errors are always enveloped (even for the top-level endpoints), but the error field shape differs:
  • Most endpoints: { "success": false, "error": { "code": "...", "message": "..." } }.
  • The /screener and /search filter-validation 400 returns error as a string: { "success": false, "data": null, "error": "invalid parameter: invalid_filter:mint|creator|mints" }. A malformed mint, mints[], or creator triggers this 400; an unsupported filter (e.g. risk_score) instead stays 200 and adds a note to the warnings[] array.
Streaming protocols (WebSocket, gRPC) use protocol-native error frames — see the WebSocket and gRPC pages.

​
Base paths

Endpoints live under different base paths, and one is served by a separate service:
FamilyBase pathNotes
candles, candles/latest, pairs, protocols, stats, top-movers/api/v1/...Versioned.
screener, trending, search, tokens/* (intel, risk, holders, audit, …)/ (root)Unversioned.
tokens/{mint}/audit/ (root)Separate service (CT106) — same host (api.dexploit.dev) but a different backend. Returns a 200 indexed: false sentinel for valid-but-unindexed mints and 400 for malformed mints.
All paths share the same host, https://api.dexploit.dev, and the same Authorization / API-key auth.

​
Rate limits

Dexploit’s pricing model is capped requests-per-second, unlimited monthly usage. Pick a tier that matches your sustained throughput; there is no monthly volume to budget against.
TierSustained RPS60-second burst window
Free201,200 reqs
Developer1006,000 reqs
Pro50030,000 reqs
Enterpriseunlimitedunlimited
The burst window is the smoothing knob: a Free-tier client can issue up to 1,200 requests in a single second as long as the rolling 60-second sum stays under 1,200. Indexers and backfill jobs benefit from this; steady-state polling never sees the burst headroom.

​
Inspecting your usage

Call GET /credits at any time to see your current tier, RPS cap, requests used in the current window, and feature flags: 
{
  "tier": "free",
  "rps_cap": 20,
  "rps_window_secs": 60,
  "current_window_used": 7,
  "current_window_remaining": 1193,
  "current_window_reset_secs": 23,
  "monthly_used": 4321,
  "monthly_used_note": "informational; no monthly cap on Dexploit",
  "tier_features": {
    "smart_money_access": false,
    "whales_access": false
  }
}
monthly_used is informational. There is no monthly cap on Dexploit — the field shows your cumulative request count for the current calendar month so you can size up your typical load.

​
Rate limiting

When you exceed your tier’s RPS cap you get HTTP 429 with code: "RATE_LIMIT_EXCEEDED". Back off and retry. Use GET /credits to read your current-window usage and the seconds until it resets (current_window_reset_secs).

​
Tier-locked features

Some endpoints are paid-tier-only. Free tier callers get HTTP 200 with tier_locked: true rather than a 429: 
{
  "mint": "BoMb…",
  "results": [],
  "tier_locked": true,
  "tier_required": "developer",
  "upgrade_url": "https://dexploit.dev/pricing",
  "computed_at": 1779852398772
}
This keeps client code simple — same response shape, an extra flag — and lets your UI render an upsell where data would be without an error-handling branch. Currently tier-locked endpoints: /tokens/{mint}/smart-money, /tokens/{mint}/whales.

​
gRPC stream caps

The dexploit.v1.SwapStream service caps concurrent connections per tier:
TierMax concurrent SwapStream connections
Free1
Developer10
Pro50
Enterpriseunlimited
Exceeding the cap returns RESOURCE_EXHAUSTED. The wallet_tags filter is Pro+ only — on lower tiers the filter is silently dropped and the response carries x-dexploit-tier-locked-filter: wallet_tags metadata. See gRPC: SwapStream for the full reference.

​
Error codes

CodeStatusMeaningRemedy
UNAUTHORIZED401Key missing, malformed, or revoked.Generate a new key in the dashboard.
FORBIDDEN403Authenticated, but not allowed.Check your tier; some endpoints require Pro or Enterprise.
RATE_LIMIT_EXCEEDED429RPS cap exceeded in current window.Back off and retry; check current_window_reset_secs from /credits.
INVALID_PARAM400One of your query params is wrong.See error.message. The most common cause is sending mint to /candles — use pair_address.
MISSING_PARAM400A required param is absent.Add it.
NOT_FOUND404Resource doesn’t exist (e.g., unknown mint or pair_address).Verify via /api/v1/pairs.
UNAVAILABLE503Backend dependency is down.Retry with backoff.
GATEWAY_TIMEOUT504Upstream took too long.Retry; reduce limit if persistent.
INTERNAL500Server-side error.Retry. If it persists, contact support.