> ## Documentation Index
> Fetch the complete documentation index at: https://docs.symbiosis.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Timing and limits

> Every window, expiry, and limit an integration must plan around

All values are enforced server-side. Build retry logic and clock handling
around them.

## Windows and expiries

| What                     | Value                          | Notes                                                                                 |
| ------------------------ | ------------------------------ | ------------------------------------------------------------------------------------- |
| Quote expiry             | **3 seconds**                  | Accept immediately or re-request. Accepting an expired quote returns `409`.           |
| HMAC timestamp tolerance | ±30 seconds                    | Also the replay window. Keep clocks NTP-synced; there is no server-time endpoint yet. |
| Session token            | 60 minutes                     | No refresh endpoint; sign in again. Revocation is server-side and immediate.          |
| Websocket ticket         | 30 seconds                     | Mint immediately before connecting; one ticket per connection attempt.                |
| TOTP login challenge     | 5 minutes                      | The window between password acceptance and code submission.                           |
| TOTP code acceptance     | ±5 time steps                  | Codes slightly ahead of or behind the current 30-second step are accepted.            |
| Email verification link  | 24 hours                       |                                                                                       |
| Password reset link      | 30 minutes                     | Single use.                                                                           |
| API key lifetime         | Optional, 1 second to 365 days | Any `expires_in_secs` in that range at mint time; omitted means no expiry.            |

## Rate limits

| What                     | Limit                                                                                           |
| ------------------------ | ----------------------------------------------------------------------------------------------- |
| Deposit address issuance | One new address per chain every 3 days; `429` beyond that. Older addresses keep being credited. |
| Everything else          | None enforced today. That will change; honor `429` with backoff.                                |

## Settlement timing

* **Deposits** are credited at chain finality (the `finalized` block tag), not a
  fixed confirmation count. Before that, the deposit is invisible to the API.
* **Withdrawals** are signed and broadcast asynchronously. Track them through
  `GET /custody/get-withdrawals`: `Queued` → `Pending` (broadcast, hash available)
  → `Confirmed` or `Failed`.

## Pagination

All list endpoints share one contract:

* `limit` is capped at **100**; omitting it returns the maximum page.
* Cursors are opaque. Pass a response's `next_cursor` back as `last_cursor` to
  continue; never construct or parse one.
* `next_cursor` is non-null whenever a page is non-empty, so "is there another
  page" can only be inferred from a full page. Reading to the tail costs one
  empty fetch.
* Changing filters invalidates a cursor: restart from the first page.