> ## Documentation Index
> Fetch the complete documentation index at: https://docs.symbiosis.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# List the user's balances.



## OpenAPI

````yaml /openapi.yaml get /custody/get-balances
openapi: 3.1.0
info:
  title: Symbiosis API
  description: >-
    The Symbiosis REST API.


    ## Authentication


    Endpoints accept one of two credentials:


    - **Session token**: `Authorization: Bearer <token>`, from `POST
    /auth/login`.

    - **API key (HMAC)**: three headers on every request:
      - `APIKEY`: the API key id, from `POST /auth/api-keys`.
      - `X-Hmac-Timestamp`: current Unix time in milliseconds.
      - `X-Hmac-Signature`: Base64-encoded HMAC-SHA256 of
        `timestamp_ms "\n" METHOD "\n" PATH_AND_QUERY "\n" BODY`, keyed with the API key
        secret. `PATH_AND_QUERY` is the full request target including the query string.

    ## Wire formats


    Token amounts (`U256`) serialize in responses as 0x-prefixed hex strings;
    requests accept decimal strings, 0x-prefixed hex strings, or JSON numbers.
    Asset ids and addresses are 0x-prefixed hex strings. Prices are integers
    scaled by 1e6.


    ## Request ids


    Every response carries an `x-request-id` header: a server-minted UUID that
    keys our logs. Include it when reporting a problem. The server never adopts
    an id you send; an inbound `x-request-id` is logged alongside ours, so a
    request that never got a response can still be found.


    ## Identifiers and uniqueness


    For integrators mirroring this API into their own storage:


    - **Globally unique, never reused**: `user_id`, `api_key_id`, `request_id`,
    `quote_id`, `match_id`, `withdrawal_id`, `job_id`, audit event `id`. The
    ledger's `entry_id` is also strictly increasing: a safe dedupe key and
    cursor.

    - **Unique per user**: `client_withdrawal_id`, the caller-chosen idempotency
    key. Replaying the same id and terms returns the original withdrawal; the
    same id with different terms returns 409.

    - **Composite keys**: an outcome token is `(venue, asset_id)`, never
    `asset_id` alone; balances are keyed by `(user, venue, asset_id)`, with USDC
    held separately.

    - **Not unique**: a ledger `ref_id` (every entry the same record caused
    shares it) and a withdrawal's `transaction_hash` (it can change if the job
    is re-signed; key on `job_id`).
  version: 0.1.0
servers:
  - url: https://api.symbiosis.markets
security: []
tags:
  - name: auth
    description: Accounts, sessions, API keys, and websocket tickets.
  - name: custody
    description: Deposit addresses, balances, and withdrawals.
  - name: rfq
    description: Quote requests, quotes, and matching.
paths:
  /custody/get-balances:
    get:
      tags:
        - custody
      summary: List the user's balances.
      operationId: get_balances
      parameters:
        - in: query
          name: asset_ids
          description: Comma-separated list of asset ids
          schema:
            description: Comma-separated list of asset ids
            type:
              - string
              - 'null'
            default: null
          style: form
        - in: query
          name: last_cursor
          description: The last cursor, emitted by the previous response.
          schema:
            description: The last cursor, emitted by the previous response.
            type:
              - string
              - 'null'
          style: form
        - in: query
          name: limit
          description: The maximum number of items to return.
          schema:
            description: The maximum number of items to return.
            type:
              - integer
              - 'null'
            format: uint32
            minimum: 0
          style: form
        - in: query
          name: venue
          description: The venue to filter by.
          schema:
            description: The venue to filter by.
            anyOf:
              - $ref: '#/components/schemas/Venue'
              - type: 'null'
          style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Page_for_GetBalancesResponse'
        '401':
          description: Invalid, missing, or mis-signed credentials.
        '403':
          description: Authenticated, but the credential lacks the required scope.
      security:
        - SessionBearer: []
        - ApiKeyHmac: []
          HmacTimestamp: []
          HmacSignature: []
components:
  schemas:
    Venue:
      description: The supported markets of the system.
      type: string
      enum:
        - polymarket
        - kalshi
        - limitless
    Page_for_GetBalancesResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/GetBalancesResponse'
        next_cursor:
          type:
            - string
            - 'null'
      required:
        - items
    GetBalancesResponse:
      type: object
      properties:
        asset_id:
          type: string
        balance:
          $ref: '#/components/schemas/TokenAmount'
        pending_balance:
          $ref: '#/components/schemas/TokenAmount'
        venue:
          $ref: '#/components/schemas/Venue'
      required:
        - asset_id
        - venue
        - balance
        - pending_balance
    TokenAmount:
      description: |-
        An amount in the asset's native indivisible units.

         A fixed point representation of a token or USDC amount, scaled by 1e6.

         Responses encode amounts as 0x-prefixed hex strings; requests also accept decimal strings and JSON numbers.
      type: string
  securitySchemes:
    SessionBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Session token from `POST /auth/login`.
    ApiKeyHmac:
      type: apiKey
      in: header
      name: APIKEY
      description: API key id, from `POST /auth/api-keys`.
    HmacTimestamp:
      type: apiKey
      in: header
      name: X-Hmac-Timestamp
      description: Unix milliseconds used in the signed message.
    HmacSignature:
      type: apiKey
      in: header
      name: X-Hmac-Signature
      description: >-
        Base64 HMAC-SHA256 over `timestamp_ms \n METHOD \n PATH_AND_QUERY \n
        BODY`. See the API description for the signing scheme.

````