Xora public API

Read-only endpoints for protocol statistics. Designed for aggregators, wallet integrations, and on-chain dashboards. JSON, cached, rate-limited per IP. No authentication required for public reads.

Base URL

https://xora.finance/api

Endpoints

Protocol stats

GET /api/stats cached 120s · 10 req/min/IP

Returns live TVL, depositor count, total yield distributed, treasury balance, and XRP price. Updated every two minutes.

{ "tvlXRP": 1490.67, "tvlUSD": 2101.85, "treasuryXRP": 2316.6, "users": 28, "totalYieldPaid": 2.80679, "totalYieldUSD": 3.96, "xrpPrice": 1.41, "lastFetch": 1779008385320 }

Health

GET /api/health public · 30 req/min/IP

Returns operational status. Public callers see status only; owner callers (with admin secret) see detailed checks for Redis, XRPL, treasury, and yield distribution.

{ "status": "healthy", "timestamp": "2026-05-17T09:00:20.672Z" }

Rate limits

/api/stats — 10 requests per minute per IP. Response is cached server-side for 120 seconds.
/api/health — 30 requests per minute per IP. Designed for uptime monitors. Public response is minimal.
Exceeded limits return HTTP 429 with {"error":"Too many requests"}. Back off and retry.

For aggregators

If you maintain a DeFi protocol aggregator (DeFi Llama, Bitcompare, CeFiRates, Token Terminal, Messari) and want to list Xora, the /api/stats endpoint is the source of truth for TVL and headline numbers. The TVL figure is the sum of all user ledger balances (XRP owed to depositors). The treasury figure is the on-chain XRP backing those balances.

Both numbers are reported separately rather than collapsed into a single max() — daily yield credits can temporarily inflate user ledger sums above treasury between distribution cycles, and reporting both keeps the picture honest.

Suggested polling cadence

Real-time dashboards: 120-second poll (matches server cache).
Daily TVL snapshots: once per day, ideally at 01:00 UTC (post yield distribution).
Historical backfill: not supported via API. Treasury wallet history is public on XRPL — query directly via xrpscan.com, bithomp.com, or any XRPL node.

CORS

Documented read-only endpoints set Access-Control-Allow-Origin: *. Browser-side aggregators can fetch directly without a proxy. Authenticated, admin, and write endpoints stay restricted to Xora origins.

Stability and changelog

Field names in /api/stats are stable. Additive changes (new fields) may ship without notice; removed or renamed fields will be announced 30 days in advance.
Major versioning: none yet — when introduced, the new path will be /api/v2/stats and v1 will remain for at least 90 days.
Changes are posted on the blog and mirrored to llms.txt.

Contact

For integration support, custom endpoints, or higher rate limits: api@xora.finance. For security issues, see security.

XORA · Public API Stable since 2026-05-17