The CoinVast public API
Five endpoints. No key. No signup.

GET /api/coins

The full coin registry, currently 32 assets. This is the source of truth for everything else: valid coin ids, per-coin minimums, confirmation counts, and the address pattern we use to sanity-check payout addresses. Cache it for minutes, not days; the list changes when we add coins.

curl https://coinvast.io/api/coins

{
  "coins": [
    {
      "id": "xmr",
      "ticker": "XMR",
      "name": "Monero",
      "network": "Monero",
      "decimals": 8,
      "confirmations": 10,
      "minAmount": 0.05,
      "addressPattern": "^[48][0-9AB][1-9A-HJ-NP-Za-km-z]{93}$",
      "custody": "node",
      "popular": true
    },
    { "id": "usdt-trc20", "ticker": "USDT", "network": "Tron (TRC-20)", "...": "..." }
  ]
}

• id is what every other endpoint expects. Tickers alone collide across networks, so USDT on Tron is usdt-trc20, on Ethereum usdt-erc20, on TON usdt-ton.
• minAmount is the smallest accepted deposit in coin units. Quotes and orders below it are rejected with a 400.
• addressPattern is a regex source for a basic format check, not full validation. We apply it server-side to payout and refund addresses; you can apply it client-side to fail fast.
• Coins with a memo field (tag or memo chains like XRP and TON) may need payoutMemo when you create an order, and their deposit may come with a depositMemo you must include when sending.

GET /api/ticker

USD prices and 24-hour change for a fixed set of headline coins (BTC, ETH, XMR, SOL, LTC, TON, DOGE, KAS). It exists for the price strip on our site. It is not a quote: use /api/quote for any number you intend to trade on. On upstream failure it returns an empty entries array with status 200 rather than an error.

curl https://coinvast.io/api/ticker

{
  "entries": [
    { "id": "btc", "ticker": "BTC", "priceUsd": 106240.0, "change24hPct": 1.42 },
    { "id": "xmr", "ticker": "XMR", "priceUsd": 412.55, "change24hPct": -0.83 }
  ]
}

POST /api/quote

A live quote for a pair and amount. Two modes: float (0.5% spread, quote valid 30 seconds) and fixed (1.0% spread, valid 60 seconds). Both work over the API even though our own UI currently exposes float only. The spread and the payout network fee are separate fields, never hidden in the rate.

curl -X POST https://coinvast.io/api/quote \
  -H "Content-Type: application/json" \
  -d '{ "from": "xmr", "to": "btc", "amountIn": 2.5, "mode": "float" }'

{
  "quote": {
    "id": "eyJmcm9tIjoieG1yIi...<base64url payload>.<hex hmac>",
    "from": "xmr",
    "to": "btc",
    "amountIn": 2.5,
    "amountOut": 0.00965312,
    "rate": 0.00386365,
    "mode": "float",
    "spreadPct": 0.5,
    "networkFee": 0.00006,
    "expiresAt": 1781234567890
  }
}

• quote.id is the signed quoteId you pass to /api/order. It is self-contained and HMAC-signed; tampering with it or re-using it after expiresAt gets a 400. Treat it as opaque.
• All amounts are in coin units, not satoshis or wei. rate is amountOut per 1 unit of from, after spread, before the network fee. amountOut is what actually lands: amountIn × rate minus networkFee, floored to the coin's display precision.
• expiresAt is epoch milliseconds. Refresh rather than racing the clock: a quote with 2 seconds left is a 400 waiting to happen.
• 400 on unknown coin, identical pair, amount under the coin minimum, or amount too small to clear the network fee. 503 when the upstream price source is down with no cache, or when swaps are paused for maintenance.

POST /api/order

Turns an unexpired quote into a swap and returns a deposit address. The pair, amount and mode in the body must match the quote exactly; any drift gets a 400 telling you to refresh the rate. The deposit must arrive within 30 minutes or the order expires.

curl -X POST https://coinvast.io/api/order \
  -H "Content-Type: application/json" \
  -d '{
    "quoteId": "eyJmcm9tIjoieG1yIi...<from the quote>",
    "from": "xmr",
    "to": "btc",
    "amountIn": 2.5,
    "mode": "float",
    "payoutAddress": "bc1qw4nsga9w3h9jzx0nmtkfh4nv9vh87qj5y3z8ae",
    "refundAddress": "48jWWbXZUd9b2iDVnYrqyTXi3FuKKZBRkVtJ1MYkdnRb...",
    "email": "you@example.com"
  }'

{
  "order": {
    "id": "K7TQ2WXMNR",
    "createdAt": 1781234567890,
    "status": "AWAITING_DEPOSIT",
    "quote": { "...": "the verified quote, echoed back" },
    "payoutAddress": "bc1qw4nsga9w3h9jzx0nmtkfh4nv9vh87qj5y3z8ae",
    "refundAddress": "48jWWbXZUd9b2iDVnYrqy...",
    "depositAddress": "888tNkZrPN6JsEgekjMnAB...",
    "timeline": [
      { "at": 1781234567890, "status": "AWAITING_DEPOSIT",
        "note": "Swap created — waiting for your XMR deposit" }
    ],
    "expiresAt": 1781236367890
  }
}

• Required: quoteId, from, to, amountIn, mode, payoutAddress. The payout address must match the destination coin's addressPattern.
• Optional: refundAddress (strongly recommended, validated against the from coin's pattern), payoutMemo for tag and memo chains, and email for status notifications. The email is write-only: it is never returned by any public endpoint, including this response.
• Send the deposit to depositAddress (plus depositMemo if present) for the exact amountIn, before expiresAt.
• Order ids are 10 characters from an unambiguous uppercase alphabet, and lookups are case-insensitive.

GET /api/order/{id}

The live state of an order: current status, full timeline with timestamps and transaction hashes (depositTxid, payoutTxid appear once known). Expiry is applied lazily on read, so an abandoned order flips to EXPIRED the first time anyone fetches it past the window.

curl https://coinvast.io/api/order/K7TQ2WXMNR

{
  "order": {
    "id": "K7TQ2WXMNR",
    "status": "SENDING",
    "depositTxid": "5f2a9c...",
    "payoutTxid": "b81d04...",
    "timeline": [
      { "at": 1781234567890, "status": "AWAITING_DEPOSIT", "note": "..." },
      { "at": 1781234890123, "status": "CONFIRMING", "txid": "5f2a9c..." },
      { "at": 1781235241000, "status": "EXCHANGING" },
      { "at": 1781235290456, "status": "SENDING", "txid": "b81d04..." }
    ],
    "...": "same shape as the create response"
  }
}

Unknown id: 404 with { "error": "Order not found" }. There is no list-orders endpoint by design; an order is only reachable by its id.

No key needed, so do not make us add one