> ## Documentation Index > Fetch the complete documentation index at: https://shield.fi/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get balances > List authorized on-chain token balances for the authenticated wallet. ## OpenAPI ````yaml openapi.json GET /balances openapi: 3.1.0 info: title: Shield Swap API description: >- Shield Swap REST API for pools, positions, swaps, routes, quotes, settlement status, and transaction input schemas. Transactions target the configured shield_swap program and `token_registry.aleo`. ## Numeric wire format Exact financial values are JSON strings, not JSON numbers. Unsigned decimal inputs use ASCII digits and an optional `.` fraction, for example `"1234.50"`; base-unit integers use ASCII digits only. Grouping separators, localized decimal commas, signs, exponent notation, whitespace, Unicode digits, and redundant leading zeros are not accepted for those inputs. Signed response metrics may include a leading `-`. Clients should localize only for display and convert user input back to this canonical form before sending it. ## Authentication Most endpoints require credentials from an invited wallet. Public routes are `/health`, `/ready`, `/metrics`, `/auth/*`, `/protocol/state`, `/compliance*`, `GET /tokens*`, `GET /pools`, `GET /pools/stats`, and `GET /pools/{key}`. Browsers use HTTP-only session cookies issued by `/auth/verify`. Access sessions last 15 minutes and are renewed through `/auth/refresh`. Programmatic clients use a long-lived token from `POST /api-tokens` as `Authorization: Bearer ss_…`. API tokens cover data and trading routes and can request WebSocket tickets. Token management, code redemption, and admin routes require a browser session. ## WebSocket feed The live feed runs on the separate websocket gateway at `GET /ws`. 1. Request a ticket from `GET /auth/ws-ticket` using a browser session or API token. 2. Open the socket and send the `authenticate` frame within 5 seconds. 3. Subscribe to each required room. 4. Before the 60-second ticket expires, request a new ticket and send another `authenticate` frame. The socket accepts WebSocket tickets only. Session JWTs and API tokens are rejected. ```json {"action": "authenticate", "token": ""} {"action": "subscribe", "room": "trades:"} {"action": "unsubscribe", "room": ""} {"action": "synchronize"} ``` After reconnecting, resend subscriptions and then send `synchronize`. The gateway replies `{"control": "synchronized"}` when those subscriptions are active. Refetch any REST data that depends on the stream after receiving the reply. Each connection allows 32 rooms, 240 client frames per minute, and 2 KB per frame. A client may subscribe only to the balance room for its ticket subject. Rooms: - `pool_launches`: newly created pools - `pool_stats:`: price & liquidity updates - `ohlcv:`: candle updates - `trades:`: swaps / mints / burns - `balances:
`: balance-change hints for an address - `protocol_config`: revisioned protocol-configuration invalidations Server messages are either events (`{"type": , "data": { … }}`) or control messages (`{"control": }`). Event types are `PoolLaunch`, `PoolStats`, `Ohlcv`, `Trade`, `BalanceChange`, and `ProtocolConfigChanged`. Its data contains `revision`, `observed_block`, and the changed `scope`/`key` pairs. Financial fields use the numeric format described above. Treat `ProtocolConfigChanged` as an invalidation, not as the new configuration. Fetch `GET /protocol/state?minimum_revision=`; retry a `503 protocol_revision_pending` after the advertised `Retry-After`; and discard or requote any `/route` result whose `protocol_revision` is older. Subscribe to `pool_stats:` separately when live price and liquidity updates matter. The gateway currently sends `synchronized` and `resync_required` controls. `resync_required` means the stream may have missed updates, so refetch affected data over REST. Ignore unknown control values. Event delivery is at most once. Treat REST as the source of truth. During a deployment the gateway may close the socket with code 1012 (service restart); reconnect and restore the subscriptions. contact: name: Shield Swap license: name: '' version: 0.1.0 servers: - url: https://api.swap.shield.fi description: Shield Swap mainnet API security: [] tags: - name: schema description: On-chain function input schemas for trading / liquidity / token operations - name: auth description: Wallet sign-in, sessions, logout, and WebSocket tickets - name: access description: Invite access redemption and administration - name: api-tokens description: >- Long-lived API tokens for programmatic access; send as `Authorization: Bearer ss_…` on any gated endpoint - name: referral description: Referral redemption and administration - name: pools description: Pool metadata, stats, trades, OHLCV - name: positions description: LP positions - name: swaps description: Historical swaps - name: tokens description: Token registry - name: balances description: On-chain token balances - name: compliance description: Token/pair allowlist, pause, and pool-creation gating state - name: protocol description: Fee tiers and tick spacings - name: route description: Swap routing - name: debug description: On-chain introspection helpers - name: airdrop description: >- Faucet: sends ALEO, USDCx, and ETH to a user address as records, once per address per 15 min - name: unclaimed description: Pending swap outputs and position fees paths: /balances: get: tags: - balances summary: Get balances operationId: list_balances responses: '200': description: Per-token on-chain authorized balances content: application/json: schema: $ref: '#/components/schemas/BalanceListResponseDoc' '401': description: Authentication required content: application/json: schema: $ref: '#/components/schemas/ErrorResponseDoc' '500': description: Internal database or RPC error content: application/json: schema: $ref: '#/components/schemas/ErrorResponseDoc' security: - bearer_auth: [] components: schemas: BalanceListResponseDoc: type: object required: - data properties: data: type: array items: $ref: '#/components/schemas/TokenBalanceDoc' ErrorResponseDoc: type: object required: - error properties: error: type: string ref: type: - string - 'null' TokenBalanceDoc: type: object required: - token_id - token_address - symbol - name - decimals - balance properties: balance: type: string description: Base-unit balance (no decimals applied). decimals: type: integer format: int32 name: type: string symbol: type: string token_address: type: string token_id: type: string securitySchemes: bearer_auth: type: http scheme: bearer bearerFormat: JWT description: >- Session JWT (browsers receive it as an httpOnly cookie from `POST /auth/verify`; 15 min, silently renewed via `POST /auth/refresh`), or a long-lived API token (`ss_…`) minted at `POST /api-tokens`. API tokens work on data and trading endpoints and can request WebSocket tickets; token management and admin endpoints accept session JWTs only. ````