REST API
Portfolio
View positions and order history
List Positions
GET /api/ext/v1/portfolio/positionsScope: portfolio:read
Returns all active positions for the authenticated user.
Query Parameters
| Parameter | Type | Description |
|---|---|---|
page | integer | Page number (default: 1) |
per_page | integer | Items per page (default: 10, max: 100) |
cURL Example
API_KEY="po_live_your_api_key"
API_SECRET="your_api_secret"
TIMESTAMP=$(date +%s%3N)
NONCE=$(openssl rand -hex 16)
PATH="/api/ext/v1/portfolio/positions"
BODY_HASH=$(echo -n "" | openssl dgst -sha256 | awk '{print $NF}')
SIGNING_STRING="GET\n${PATH}\n${TIMESTAMP}\n${NONCE}\n${BODY_HASH}"
SIGNATURE=$(echo -ne "$SIGNING_STRING" | openssl dgst -sha256 -hmac "$API_SECRET" | awk '{print $NF}')
curl -s "https://api.winnova.pro${PATH}" \
-H "X-API-KEY: $API_KEY" \
-H "X-API-TIMESTAMP: $TIMESTAMP" \
-H "X-API-SIGNATURE: $SIGNATURE" \
-H "X-API-NONCE: $NONCE"Response
{
"success": true,
"data": {
"positions": [
{
"id": 1542,
"market_id": "f3f26422-20df-44e6-914e-dc70cfddba0b",
"market_name": "Will the Lakers win?",
"market_type": "moneyline",
"group_item_title": "Lakers",
"event_id": "63b2d028-f436-49cd-8184-f59bc41dd100",
"event_title": "Lakers vs Celtics",
"event_slug": "nba-lakers-vs-celtics-2026-04-05",
"category": "basketball",
"token_id": "42881612871834249183...",
"outcome": "Yes",
"raw_outcome": "a",
"outcome_a": "Yes",
"outcome_b": "No",
"shares": 100.50,
"available_shares": 100.50,
"reserved_shares": 100.50,
"avg_cost": 0.52,
"bet_amount": 52.26,
"expected_win_amount": 100.50,
"initial_win_rate": 0.52,
"current_win_rate": 0.58,
"current_value": 58.29,
"pnl": 6.03,
"pnl_percent": 11.54,
"best_bid": 0.57,
"best_ask": 0.59,
"home_team": {
"name": "Los Angeles Lakers",
"short_name": "Lakers",
"logo": "https://...",
"abbreviation": "lal",
"name_zh": "洛杉矶湖人",
"short_name_zh": "湖人"
},
"away_team": {
"name": "Boston Celtics",
"short_name": "Celtics",
"logo": "https://...",
"abbreviation": "bos",
"name_zh": "波士顿凯尔特人",
"short_name_zh": "凯尔特人"
},
"ended": false,
"can_cashout": true,
"confirming": false,
"is_bonus": false,
"is_future": false,
"market_status": "active",
"updated_at": "2026-04-04T10:00:00Z"
}
],
"pagination": {
"current_page": 1,
"total_pages": 1,
"total_count": 2,
"per_page": 10
}
}
}Error Response
{ "success": false, "error": "forbidden: missing scope portfolio:read" }Status 403 — portfolio:read scope not granted.
List Portfolio Orders
GET /api/ext/v1/portfolio/ordersScope: portfolio:read
Returns order history with event context.
Query Parameters
| Parameter | Type | Description |
|---|---|---|
side | string | Filter by side: BUY, SELL |
page | integer | Page number (default: 1) |
per_page | integer | Items per page (default: 10, max: 100) |
cURL Example
API_KEY="po_live_your_api_key"
API_SECRET="your_api_secret"
TIMESTAMP=$(date +%s%3N)
NONCE=$(openssl rand -hex 16)
PATH="/api/ext/v1/portfolio/orders?page=1&per_page=10"
BODY_HASH=$(echo -n "" | openssl dgst -sha256 | awk '{print $NF}')
SIGNING_STRING="GET\n${PATH}\n${TIMESTAMP}\n${NONCE}\n${BODY_HASH}"
SIGNATURE=$(echo -ne "$SIGNING_STRING" | openssl dgst -sha256 -hmac "$API_SECRET" | awk '{print $NF}')
curl -s "https://api.winnova.pro${PATH}" \
-H "X-API-KEY: $API_KEY" \
-H "X-API-TIMESTAMP: $TIMESTAMP" \
-H "X-API-SIGNATURE: $SIGNATURE" \
-H "X-API-NONCE: $NONCE"Response
{
"success": true,
"data": {
"orders": [
{
"id": "2c87c1ba-adde-41c8-ae3e-9fa90e922530",
"market_id": "f3f26422-20df-44e6-914e-dc70cfddba0b",
"event_id": "63b2d028-f436-49cd-8184-f59bc41dd100",
"event_slug": "nba-lakers-vs-celtics-2026-04-05",
"market_name": "Will the Lakers win?",
"home_team": {
"name": "Los Angeles Lakers",
"logo": "https://..."
},
"away_team": {
"name": "Boston Celtics",
"logo": "https://..."
},
"outcome": "Yes",
"side": "BUY",
"making_amount": 50.00,
"taking_amount": 90.91,
"status": "matched",
"tx_hashes": ["0xc4aa72de..."],
"is_bonus": false,
"created_at": "2026-04-04T08:00:00Z"
}
],
"pagination": {
"current_page": 1,
"total_pages": 21,
"total_count": 204,
"per_page": 10
}
}
}Error Response
{ "success": false, "error": "unauthorized" }Status 401 — missing or invalid API key / signature.