API & webhooks

Portfolio plan. Read-only.

The API is read-only and part of the Portfolio plan. Create a key in the bot with /apikey new; it is shown once.

Authentication

Send the key as a bearer token (or as ?key=):

curl -H "Authorization: Bearer SGK_..." \
  https://pay.shinganguard.com/api/v1/wallets

Endpoints

Endpoint	Returns
`GET /api/v1/wallets`	Each wallet: chain, address, label, health score, approval count, USD value.
`GET /api/v1/approvals`	Approvals: token, spender, risk, unlimited, source (erc20/permit2), age.
`GET /api/v1/alerts`	Recent alerts: severity, kind, title, timestamp.
`GET /api/v1/health`	Health score, approval/risky/dormant counts, total value.

All responses are JSON with {"ok":true, ...}. A missing or invalid key returns 401; a valid key on a non-Portfolio plan returns 403.

Webhooks

Set a URL with /webhook https://example.com/hook. When an alert fires, Shingan POSTs JSON:

{
  "id": 1234,
  "severity": "critical",
  "kind": "transfer",
  "title": "Possible active drain",
  "body": "…",
  "wallet_id": "7",
  "ts": "2026-09-15T11:00:00Z"
}

Verify the signature header against the secret shown by /webhook:

X-Shingan-Signature: sha256=HMAC_SHA256(secret, raw_body)

Webhooks fire for alerts at or above your minimum severity and respect wallet mutes, but ignore quiet hours.

Limits

120 requests per minute per key. Webhook deliveries have a 5-second timeout and one attempt.