Timing and limits - Symbiosis

All values are enforced server-side. Build retry logic and clock handling around them.

Windows and expiries

What	Value	Notes
Quote expiry	3 seconds	Accept immediately or re-request. Accepting an expired quote returns `409`.
HMAC timestamp tolerance	±30 seconds	Also the replay window. Keep clocks NTP-synced; there is no server-time endpoint yet.
Session token	60 minutes	No refresh endpoint; sign in again. Revocation is server-side and immediate.
Websocket ticket	30 seconds	Mint immediately before connecting; one ticket per connection attempt.
TOTP login challenge	5 minutes	The window between password acceptance and code submission.
TOTP code acceptance	±5 time steps	Codes slightly ahead of or behind the current 30-second step are accepted.
Email verification link	24 hours
Password reset link	30 minutes	Single use.
API key lifetime	Optional, 1 second to 365 days	Any `expires_in_secs` in that range at mint time; omitted means no expiry.

Rate limits

What	Limit
Deposit address issuance	One new address per chain every 3 days; `429` beyond that. Older addresses keep being credited.
Everything else	None enforced today. That will change; honor `429` with backoff.

Settlement timing

Deposits are credited at chain finality (the finalized block tag), not a fixed confirmation count. Before that, the deposit is invisible to the API.
Withdrawals are signed and broadcast asynchronously. Track them through GET /custody/get-withdrawals: Queued → Pending (broadcast, hash available) → Confirmed or Failed.

Pagination

All list endpoints share one contract:

limit is capped at 100; omitting it returns the maximum page.
Cursors are opaque. Pass a response’s next_cursor back as last_cursor to continue; never construct or parse one.
next_cursor is non-null whenever a page is non-empty, so “is there another page” can only be inferred from a full page. Reading to the tail costs one empty fetch.
Changing filters invalidates a cursor: restart from the first page.