API Playground

The API Playground is a dashboard-only troubleshooting workspace for the documented Operator API. It sends requests through the dashboard server, which injects the active staff-session bearer token. The browser never receives that token.

Navigation

The API Playground sidebar group contains scoped submenus:

• Session
• Launch
• Users
• Markets
• Trades
• Resolutions
• Balance Operations
• API Keys
• Webhooks
• Wallet Adapter
• Staffs
• Simulator, staging only

A submenu is hidden when none of its requests are available to the current staff scopes. An individual request can require more scopes than its submenu; Portfolio HTML, for example, requires both users:read and launch:write.

Request workflow

1. Select a submenu and request.
2. Fill required path params and optional query params under Params.
3. Review inherited auth type, operator, and required scopes under Authorization. Authorization is read-only.
4. Adjust only the safe Accept and Content-Type headers under Headers.
5. Edit raw JSON under Body, then use Format JSON or Reset example when needed.
6. Review the fixed environment and final URL.
7. Select Send. Write, destructive, and external-mutation requests require confirmation.

The base host and HTTP method come from the source-backed request catalog and cannot be changed. Unsaved request edits are not stored.

Response workspace

Every response shows:

• HTTP status
• elapsed time
• displayed response size
• content type
• Pretty, Raw, and Headers views
• Preview only for the Portfolio HTML response
• Copy response and Copy cURL actions

Copied cURL uses Authorization: Bearer ${OPERATOR_TOKEN}. It never contains the active staff token.

Response bodies are kept in memory only and clear when the request changes. API-key creation and staff onboarding/reset responses show a copy-now warning because one-time values are not persisted by the Playground. Bodies over 2 MiB are truncated with an explicit warning.

Request safety

Read requests send directly. Confirmations summarize method, final path, environment, and side effect for:

• launch and Portfolio HTML generation
• API-key creation and revocation
• market visibility changes
• webhook creation, update, deletion, and replay
• Wallet Adapter update and tests
• staff creation, update, and password reset
• simulator mutations

Cancel stops the in-flight browser request. The dashboard server also enforces a 30-second upstream timeout, a 256 KiB request-body limit, an allowlisted route catalog, safe request headers, current scopes, staff-only restrictions, and staging-only restrictions. Beacon remains the final authorization authority.

HTML preview isolation

Portfolio Preview uses iframe srcdoc with:

• sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox"
• no allow-same-origin
• referrerpolicy="no-referrer"
• a preview-only CSP that blocks network subresources by default

The frame cannot access dashboard cookies or parent DOM. Open/Resolved/Trade History scripts can run inside the isolated document, and Trade links can open normal new tabs. Raw remains the exact upstream body.

Intentionally unavailable actions

The superseded legacy resolution-listing route is omitted in favor of Resolutions. Staff login, password change, and logout are also omitted because they own the dashboard session lifecycle and cannot safely run through inherited authorization.

Staff management requests remain available to staff sessions with staffs:read or staffs:write; only the three auth-lifecycle actions are excluded.

The Playground is an operator troubleshooting tool. It does not make browser-side API-key integration safe; external applications must call the Operator API from their backend.