> ## Documentation Index > Fetch the complete documentation index at: https://docs.symbiosis.markets/llms.txt > Use this file to discover all available pages before exploring further. # Get the quotes the user has made, across requests. ## OpenAPI ````yaml /openapi.yaml get /rfq/get-quotes openapi: 3.1.0 info: title: Symbiosis API description: >- The Symbiosis REST API. ## Authentication Endpoints accept one of two credentials: - **Session token**: `Authorization: Bearer `, from `POST /auth/login`. - **API key (HMAC)**: three headers on every request: - `APIKEY`: the API key id, from `POST /auth/api-keys`. - `X-Hmac-Timestamp`: current Unix time in milliseconds. - `X-Hmac-Signature`: Base64-encoded HMAC-SHA256 of `timestamp_ms "\n" METHOD "\n" PATH_AND_QUERY "\n" BODY`, keyed with the API key secret. `PATH_AND_QUERY` is the full request target including the query string. ## Wire formats Token amounts (`U256`) serialize in responses as 0x-prefixed hex strings; requests accept decimal strings, 0x-prefixed hex strings, or JSON numbers. Asset ids and addresses are 0x-prefixed hex strings. Prices are integers scaled by 1e6. ## Request ids Every response carries an `x-request-id` header: a server-minted UUID that keys our logs. Include it when reporting a problem. The server never adopts an id you send; an inbound `x-request-id` is logged alongside ours, so a request that never got a response can still be found. ## Identifiers and uniqueness For integrators mirroring this API into their own storage: - **Globally unique, never reused**: `user_id`, `api_key_id`, `request_id`, `quote_id`, `match_id`, `withdrawal_id`, `job_id`, audit event `id`. The ledger's `entry_id` is also strictly increasing: a safe dedupe key and cursor. - **Unique per user**: `client_withdrawal_id`, the caller-chosen idempotency key. Replaying the same id and terms returns the original withdrawal; the same id with different terms returns 409. - **Composite keys**: an outcome token is `(venue, asset_id)`, never `asset_id` alone; balances are keyed by `(user, venue, asset_id)`, with USDC held separately. - **Not unique**: a ledger `ref_id` (every entry the same record caused shares it) and a withdrawal's `transaction_hash` (it can change if the job is re-signed; key on `job_id`). version: 0.1.0 servers: - url: https://api.symbiosis.markets security: [] tags: - name: auth description: Accounts, sessions, API keys, and websocket tickets. - name: custody description: Deposit addresses, balances, and withdrawals. - name: rfq description: Quote requests, quotes, and matching. paths: /rfq/get-quotes: get: tags: - rfq summary: Get the quotes the user has made, across requests. operationId: get_user_quotes parameters: - in: query name: asset_id schema: type: - string - 'null' style: form - in: query name: last_cursor schema: type: - string - 'null' style: form - in: query name: limit schema: type: - integer - 'null' format: uint32 minimum: 0 style: form - in: query name: venue_id schema: anyOf: - $ref: '#/components/schemas/Venue' - type: 'null' style: form responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/Page_for_UserQuote' '401': description: Invalid, missing, or mis-signed credentials. '403': description: Authenticated, but the credential lacks the required scope. security: - SessionBearer: [] - ApiKeyHmac: [] HmacTimestamp: [] HmacSignature: [] components: schemas: Venue: description: The supported markets of the system. type: string enum: - polymarket - kalshi - limitless Page_for_UserQuote: type: object properties: items: type: array items: $ref: '#/components/schemas/UserQuote' next_cursor: type: - string - 'null' required: - items UserQuote: description: >- One of the user's own quotes, joined with the market context of the request it priced. Deliberately omits the requester's identity: quoting alone does not disclose the counterparty. That happens on a match ([`UserRFQMatch`]), or when the requester opted into disclosure. type: object properties: created_at: type: string format: date-time expires_at: type: string format: date-time fee_bps: $ref: '#/components/schemas/BasisPoints' price: $ref: '#/components/schemas/Price' quote_id: $ref: '#/components/schemas/QuoteId' request_id: $ref: '#/components/schemas/RequestId' status: $ref: '#/components/schemas/QuoteStatus' required: - quote_id - request_id - price - status - fee_bps - expires_at - created_at BasisPoints: description: 'A fee rate in basis points: 1 bp = 0.01%, so 25 = a 0.25% fee.' type: integer format: uint16 maximum: 65535 minimum: 0 Price: description: |- A price as an integer scaled by 1e6. 650000 = 0.65 USDC per token. Outcome-token prices sit strictly between 0 and 1000000. type: integer format: uint64 minimum: 0 QuoteId: description: A quote's globally unique id. Server-assigned, never reused. type: string format: uuid RequestId: description: A quote request's globally unique id. Server-assigned, never reused. type: string format: uuid QuoteStatus: type: string enum: - Open - Matched - Expired securitySchemes: SessionBearer: type: http scheme: bearer bearerFormat: JWT description: Session token from `POST /auth/login`. ApiKeyHmac: type: apiKey in: header name: APIKEY description: API key id, from `POST /auth/api-keys`. HmacTimestamp: type: apiKey in: header name: X-Hmac-Timestamp description: Unix milliseconds used in the signed message. HmacSignature: type: apiKey in: header name: X-Hmac-Signature description: >- Base64 HMAC-SHA256 over `timestamp_ms \n METHOD \n PATH_AND_QUERY \n BODY`. See the API description for the signing scheme. ````