@0xmonaco/types 1.0.73 → 1.0.74-develop.367860f

package/dist/wire/schema.d.ts

@@ -297,7 +297,9 @@ export interface paths {
          *      address — and a per-order mode always overrides it. The write is sequenced
          *      through the matching engine; on success the next order from the wallet
          *      family already resolves the new mode. Delegated-agent sessions cannot
-         *      change it.
+         *      change it. It spends the per-account settings-write rate limit (about one
+         *      write per second, burst 10) that the copy trading lead trader and follow
+         *      writes share.
          */
         put: operations["set_self_trade_prevention_default"];
         post?: never;
@@ -442,8 +444,8 @@ export interface paths {
          * List application balances
          * @description List application balances.
          *
-         *      Returns a paginated list of all user balances for this application.
-         *      Requires backend authentication via secret key.
+         *      Returns a paginated list of the balances of the application's users.
+         *      Public: the application is selected by `client_id`.
          */
         get: operations["list_application_balances"];
         put?: never;
@@ -488,9 +490,9 @@ export interface paths {
          * List application movements
          * @description List application movements.
          *
-         *      Returns a paginated list of all ledger movements (deposits, withdrawals,
-         *      trades, etc.) for this application. Requires backend authentication via
-         *      secret key.
+         *      Returns a paginated list of the ledger movements (deposits, withdrawals,
+         *      trades, etc.) of the application's users. Public: the application is
+         *      selected by `client_id`.
          */
         get: operations["list_application_movements"];
         put?: never;
@@ -512,8 +514,8 @@ export interface paths {
          * List application orders
          * @description List application orders.
          *
-         *      Returns a paginated list of all orders for this application. Requires
-         *      backend authentication via secret key.
+         *      Returns a paginated list of all orders placed by the application's users.
+         *      Public: the application is selected by `client_id`.
          */
         get: operations["list_application_orders"];
         put?: never;
@@ -536,8 +538,8 @@ export interface paths {
          * @description Get application stats.
          *
          *      Returns aggregate volume and fee stats for this application. Stats are
-         *      scoped to trades where the application's users were the taker. Requires
-         *      backend authentication via secret key.
+         *      scoped to trades where the application's users were the taker. Public:
+         *      the application is selected by `client_id`.
          */
         get: operations["get_application_stats"];
         put?: never;
@@ -559,8 +561,8 @@ export interface paths {
          * List application users
          * @description List application users.
          *
-         *      Returns a paginated list of all users for this application. Requires
-         *      backend authentication via secret key.
+         *      Returns a paginated list of the application's users. Public: the
+         *      application is selected by `client_id`.
          */
         get: operations["list_application_users"];
         put?: never;
@@ -730,11 +732,13 @@ export interface paths {
          *      application's behalf do not count. Setting the fee it already has is a
          *      no-op that succeeds and does not use up a change.
          *
-         *      The fee can be set while builder fees are switched off
-         *      (`builderFeeEnabled` false): it is stored and nothing is charged until they
-         *      are switched on. Once charged, a new fee applies to orders placed after the
-         *      change within a few seconds; resting orders keep the fee they were placed
-         *      with.
+         *      The fee can be set while the revenue share or builder fees are switched
+         *      on, and is refused (**HTTP 403** / **PERMISSION_DENIED**) while both are
+         *      off. With builder fees off (`builderFeeEnabled` false) it is stored and
+         *      nothing is charged until they are switched on. A newly stored fee reaches order requests within a few
+         *      seconds. Sequencer ordering is authoritative for matching-engine policy and
+         *      enrollment state: an order processed before one of those sequenced changes
+         *      uses the earlier state, and a later order uses the new state.
          *
          *      A refused change is **HTTP 409** / **FAILED_PRECONDITION** when the
          *      application is not enrolled with a payout address or has no changes left
@@ -787,8 +791,7 @@ export interface paths {
          *
          *      The application is taken from the authenticated session; there is no
          *      application id in the request. The caller must be the application's
-         *      configured payout wallet. This method is gated by `buildercodes_enabled`
-         *      like the rest of the service.
+         *      configured payout wallet.
          */
         get: operations["get_buildercodes_config"];
         put?: never;
@@ -909,13 +912,13 @@ export interface paths {
          *
          *      Delegated-agent sessions are refused: a delegated grant conveys only
          *      order-management authority, and this claim converts reserved balance into a
-         *      tradeable one. The refusal happens before the feature check, so a delegated
-         *      caller is refused whether or not BuilderCodes is enabled.
+         *      tradeable one. No program switch gates the claim: a balance already
+         *      credited stays claimable whether or not the revenue share is on.
          *
          *      Transport contracts differ, and this comment is emitted into the generated
          *      gRPC SDK where HTTP statuses do not exist. An insufficient payout balance
          *      is **HTTP 409** on REST and **FAILED_PRECONDITION** on gRPC; a refused
-         *      caller (delegated session, or BuilderCodes disabled) is **HTTP 403** on
+         *      caller (delegated session) is **HTTP 403** on
          *      REST and **PERMISSION_DENIED** on gRPC.
          *
          *      A claim can also fail as **HTTP 503** / **UNAVAILABLE** when the matching
@@ -940,6 +943,11 @@ export interface paths {
          *      retry with backoff, and an overload positively wants one. Only an UNTAGGED
          *      availability failure — matching-engine transport, timeout and fail-closed
          *      paths — carries the unknown outcome.
+         *
+         *      A claim spends the per-user movement budget withdrawals and collateral
+         *      transfers share. Over budget it is refused with **HTTP 429** /
+         *      **RESOURCE_EXHAUSTED** before it reaches the sequencer, so it committed
+         *      nothing and is safe to retry after the interval in `details.retryAfter`.
          */
         post: operations["claim_buildercode_rewards"];
         delete?: never;
@@ -975,7 +983,9 @@ export interface paths {
          *      `leader` handle that names a different leader is refused. `copyExisting`
          *      copies the leader's open positions into the new copy account at creation
          *      (see PreviewFollow for what that costs); it applies only to a create, and
-         *      an edit that sets it is refused.
+         *      an edit that sets it is refused. A create and an edit each spend the
+         *      per-account settings-write rate limit (about one write per second, burst
+         *      10) that UpsertLeadTrader and the self-trade-prevention default share.
          */
         post: operations["upsert_follow"];
         delete?: never;
@@ -1146,9 +1156,7 @@ export interface paths {
          *      There is no margin reduction: a follow exits by being stopped. Follow
          *      writes need a master account session (not a delegated agent or a
          *      sub-account). 404 unless the follow is yours; 409 while it is stopping
-         *      or once it is stopped, and when copy trading is not available on the
-         *      platform at all (the platform then runs copy trading exits only). It
-         *      spends the per-user movement budget withdrawals and collateral transfers
+         *      or once it is stopped. It spends the per-user movement budget withdrawals and collateral transfers
          *      share. It is not idempotent: a retry after a timeout whose first attempt
          *      landed adds the amount twice, so read the follow before retrying.
          */
@@ -1173,8 +1181,11 @@ export interface paths {
          * @description Stop a follow.
          *
          *      Stops mirroring the leader. Stopping one of your own follows only; the
-         *      follow is identified by its id. An exit is never gated beyond ownership,
-         *      except that a delegated agent session cannot stop a follow.
+         *      follow is identified by its id. An exit is never refused for the state
+         *      of the account or the platform. Only three things apply: ownership, the
+         *      refusal of a delegated agent session, and a per-account rate limit of
+         *      its own (about one stop per second, burst 20), which closes and follow
+         *      edits never spend.
          */
         post: operations["stop_follow"];
         delete?: never;
@@ -1232,7 +1243,9 @@ export interface paths {
          *      TraderCode handle. The profile is replaced as sent: an omitted `bio` or
          *      `minAllocation` clears it and an omitted `status` means ACTIVE; an
          *      omitted `shareBps` keeps the current share (the platform default on a
-         *      registration). A follower with a live follow cannot register.
+         *      registration). A follower with a live follow cannot register. It spends
+         *      the per-account settings-write rate limit (about one write per second,
+         *      burst 10) that UpsertFollow and the self-trade-prevention default share.
          */
         put: operations["upsert_lead_trader"];
         post?: never;
@@ -1360,7 +1373,10 @@ export interface paths {
          *
          *      Master accounts only. Creates (or updates, keyed on `agent_address`) a
          *      delegation linking the calling owner to an agent wallet, together with the
-         *      policy that constrains what the agent may do on the owner's behalf.
+         *      policy that constrains what the agent may do on the owner's behalf. An
+         *      owner holds at most 10 active, unexpired agents; a new one past that is
+         *      rejected until one is revoked or expires. Binding an agent to one margin
+         *      account (`allowed_margin_account_ids`) makes it that sub-account's key.
          */
         post: operations["upsert_delegated_agent"];
         delete?: never;
@@ -1412,7 +1428,8 @@ export interface paths {
          *      `ListDelegatedAgentOwners`) and a freshly generated session public key.
          *      The new session acts as the owner but records the agent's address for
          *      policy enforcement. Requires an active delegation for the (owner, agent)
-         *      pair. Session expiry is bounded by the delegation expiry, if set. Every
+         *      pair, and, when the delegation has an IP allowlist, a caller address
+         *      inside it. Session expiry is bounded by the delegation expiry. Every
          *      authenticated request and periodic WebSocket session revalidation requires
          *      the backing delegation to remain active and unexpired.
          */
@@ -1696,6 +1713,29 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/margin/accounts/{marginAccountId}/pnl": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * @description One margin account's own PnL: realized (settled on the account plus
+         *      still held in its open risk buckets) and unrealized (its positions
+         *      repriced at the latest risk marks). Transfers between the caller's
+         *      accounts are flows, not PnL, so the figures of the caller's accounts sum
+         *      to the owner-wide figure.
+         */
+        get: operations["get_margin_account_pnl"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/margin/accounts/{marginAccountId}/simulate-order-risk": {
         parameters: {
             query?: never;
@@ -1728,6 +1768,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/margin/collateral/transfer": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Move collateral between the spot wallet, the caller's margin accounts and
+         *      their risk buckets. `from` and `to` each name the wallet or a margin
+         *      account (optionally one of its risk buckets). Supported moves: wallet to
+         *      the default margin account and back, margin account to margin account,
+         *      and margin account to one of its own risk buckets. The older transfer
+         *      routes keep working unchanged.
+         */
+        post: operations["transfer_collateral"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/margin/parent-margin-account": {
         parameters: {
             query?: never;
@@ -1849,6 +1913,101 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/margin/sub-accounts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Open a sub-account: another margin account of the caller, keyed by
+         *      `subaccount_key`, with its own collateral and its own risk buckets. The
+         *      default margin account (key `default`) is the only one deposits and
+         *      withdrawals touch; fund a sub-account with `TransferCollateral`.
+         *      Re-creating the key of a closed sub-account re-opens the same account.
+         *      Keys starting with `copy:` are reserved. An owner may hold a limited
+         *      number of open sub-accounts, set by their weighted 14-day volume tier
+         *      (10 at the first tier, up to 50) or an admin override; a create past it
+         *      is refused. Copy-trading sub-accounts do not count.
+         */
+        post: operations["create_sub_account"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/margin/sub-accounts/{marginAccountId}/close": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Close a sub-account. Refused unless it is flat: no position and no order,
+         *      conditional order or TWAP. Its flat, solvent risk buckets close in the
+         *      same step, and all of its remaining collateral moves to the default
+         *      margin account. A risk bucket in liquidation or bad debt refuses the
+         *      close, and nothing moves.
+         */
+        post: operations["close_sub_account"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/margin/sub-accounts/{marginAccountId}/collateral/transfer-in": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Move collateral from the caller's default margin account to one of their
+         *      sub-accounts, in one sequenced step. The same move as `TransferCollateral`
+         *      from the default account to the sub-account. The path names an open
+         *      sub-account of the caller; the default margin account itself is refused
+         *      (fund it with the parent-margin-account routes).
+         */
+        post: operations["transfer_collateral_to_sub_account"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/margin/sub-accounts/{marginAccountId}/collateral/transfer-out": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Move collateral from one of the caller's sub-accounts back to their
+         *      default margin account, in one sequenced step. The mirror of
+         *      `TransferCollateralToSubAccount`; the amount must fit the sub-account's
+         *      free collateral.
+         */
+        post: operations["transfer_collateral_from_sub_account"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/market/funding/history": {
         parameters: {
             query?: never;
@@ -2643,12 +2802,14 @@ export interface paths {
          * Get your referral position
          * @description Read your own referral position (self-scoped).
          *
-         *      Return the authenticated caller's referral position: their direct (L1)
-         *      referrer, the total rewards they have earned, and their most recent reward
-         *      rows. Self-scoped — identity comes only from the session, never a path id,
+         *      Return the authenticated caller's referral position: their referral chain
+         *      upward (L1, L2 and onward — who referred them, who referred that wallet, and
+         *      so on, as many levels as PitPass currently rewards), the total rewards they
+         *      have earned, and their most recent reward rows.
+         *      Self-scoped — identity comes only from the session, never a path id,
          *      so a caller can only ever read their own chain. Every other user is
          *      identified by their public wallet address, never an internal id. An empty
-         *      `referrer` means the caller was not referred.
+         *      `referrer` and `upline` mean the caller was not referred.
          */
         get: operations["get_my_referral_position"];
         put?: never;
@@ -2670,10 +2831,12 @@ export interface paths {
          * Get your referral downline and earnings
          * @description Read your own downline earnings (self-scoped).
          *
-         *      Return who the authenticated caller earns from and how much: an
-         *      earnings-by-source breakdown aggregated from the caller's reward rows across
-         *      all three reward levels (L1/L2/L3), their L1 direct-referee roster (including
-         *      referees who have not traded yet), and a per-level earnings summary.
+         *      Return who the authenticated caller earns from and how much: one page of
+         *      the earnings-by-source breakdown across every reward level, their L1
+         *      direct-referee roster (including referees who have not traded yet), and a
+         *      per-level earnings summary that always covers every level and source,
+         *      whatever page is requested. `earnings_by_source` is paged (`page_size`,
+         *      `page_token`); a request without them gets the first page, not every row.
          *      Self-scoped — identity comes only from the session, never a path id. Every
          *      source and referee is identified by their public wallet address, never an
          *      internal id.
@@ -2687,6 +2850,41 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/pitpass/referrals/me/tree": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get one level of your referral tree
+         * @description Read one level of your own referral tree (self-scoped).
+         *
+         *      Return the wallets directly referred by `parent` — the authenticated caller
+         *      when `parent` is omitted, otherwise one of the caller's own referees above
+         *      the deepest rewarded level — one page at a time, newest first. Each node carries its level
+         *      relative to the caller, its parent, how many wallets it has referred (so the
+         *      client knows whether it can be expanded), and what the caller has earned
+         *      from that wallet's own trades. Expanding a node is another call with
+         *      `parent` set to that node's wallet; the tree stops at the deepest level that
+         *      pays referral rewards, which an admin configures (at most 10).
+         *
+         *      Self-scoped — identity comes only from the session. A `parent` that is not
+         *      the caller or a referee the caller can expand returns 404, the same
+         *      as a wallet that does not exist, so the endpoint cannot be used to read
+         *      anyone else's tree. Every node is identified by its public wallet address,
+         *      never an internal id.
+         */
+        get: operations["get_my_referral_tree"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/pitpass/rewards/balance": {
         parameters: {
             query?: never;
@@ -2729,7 +2927,8 @@ export interface paths {
          *      trading balance under the authenticated application, making it tradeable
          *      immediately. Ledger-only (one shared vault + one backend ledger) — no
          *      on-chain transaction and no gas. Fails with 402 when the rewards balance is
-         *      insufficient.
+         *      insufficient. It spends the per-user movement budget withdrawals and
+         *      collateral transfers share.
          */
         post: operations["transfer_rewards"];
         delete?: never;
@@ -2769,7 +2968,13 @@ export interface paths {
          *      Submits a MARKET reduce-only close for every open position owned by the
          *      caller, optionally filtered to a single trading pair. Best-effort and
          *      partial: each position closes independently and per-position failures are
-         *      reported in `results` rather than aborting the batch.
+         *      reported in `results` rather than aborting the batch. Each close draws
+         *      one item from the risk-reduction rate limit (an empty call draws one).
+         *      The first 100 are charged before anything is sent: over budget, the
+         *      whole call is refused with 429 and nothing is closed. Past 100 open
+         *      positions the rest are charged 100 at a time as the call reaches them,
+         *      and those the budget does not cover are not sent: they come back in
+         *      `results` with `RATE_LIMIT_EXCEEDED`, to be retried.
          */
         post: operations["batch_close_all_positions"];
         delete?: never;
@@ -3285,28 +3490,16 @@ export interface components {
              * @example master
              */
             accountType?: string | null;
-            /**
-             * @description Whether the user is allowed to withdraw
-             * @example true
-             */
-            canWithdraw?: boolean | null;
             /**
              * @description Account creation timestamp (ISO 8601)
              * @example 2023-11-13T10:30:00Z
              */
             createdAt?: string | null;
-            /** @description Email address */
-            email?: string | null;
             /**
              * @description Whether the user account is active
              * @example true
              */
             isActive?: boolean | null;
-            /**
-             * @description Whether the user is banned
-             * @example false
-             */
-            isBanned?: boolean | null;
             /**
              * Format: uuid
              * @description Master account ID (for sub-accounts)
@@ -3741,7 +3934,7 @@ export interface components {
              */
             strategyKey?: string | null;
             /**
-             * @description Risk bucket mode for margin orders. Defaults to ISOLATED. Values: ISOLATED, CROSS.
+             * @description Risk bucket mode for margin orders. Defaults to ISOLATED. Values: ISOLATED, CROSS. On an isolated-only market (TradingPairData.isolated_only) a CROSS order that is not reduce-only is rejected with HTTP 400 / gRPC INVALID_ARGUMENT carrying the structured error code CROSS_MARGIN_NOT_ALLOWED.
              * @example CROSS
              * @enum {string|null}
              */
@@ -3944,7 +4137,7 @@ export interface components {
             amount?: string | null;
             /**
              * Format: int32
-             * @description Realized whole-basis-point rate for this credit after the Monaco-floor clamp, computed from the credited amount divided by the gross protocol take and truncated down. This can be lower than the configured BuilderCodes budget.
+             * @description Basis-point rate applied to this credit. For `BUILDER_FEE`, this is the normalized builder-fee rate charged to the taker. For `REVENUE_SHARE`, it is the realized whole-basis-point rate after the Monaco-floor clamp and can be lower than the configured BuilderCodes budget.
              * @example 1000
              */
             appliedBps?: number | null;
@@ -3954,7 +4147,7 @@ export interface components {
              */
             createdAt?: string | null;
             /**
-             * @description Payout category for this credit. `REVENUE_SHARE` is active; `BUILDER_FEE` is reserved and is not currently emitted.
+             * @description Payout category for this credit: `REVENUE_SHARE` for Monaco revenue sharing or `BUILDER_FEE` for an ordinary builder fee charged to the taker.
              * @example REVENUE_SHARE
              * @enum {string|null}
              */
@@ -4271,6 +4464,16 @@ export interface components {
             message?: string | null;
             submittedQuantity?: string | null;
         };
+        CloseSubAccountRequest: {
+            marginAccountId?: string | null;
+        };
+        CloseSubAccountResponse: {
+            marginAccountId?: string | null;
+            /** @description The default margin account that received the remaining collateral. */
+            defaultMarginAccountId?: string | null;
+            /** @description Collateral moved to the default margin account. */
+            amount?: string | null;
+        };
         ClosedTrade: {
             /**
              * Format: uuid
@@ -4299,6 +4502,17 @@ export interface components {
             /** @description Execution time (RFC 3339) */
             closedAt?: string | null;
         };
+        /**
+         * @description One side of a `TransferCollateral`: the spot wallet, or a margin account
+         *      and optionally one of its risk buckets.
+         */
+        CollateralTransferEndpoint: {
+            /** @description The spot wallet. Set exactly one of `wallet` and `margin_account_id`. */
+            wallet?: boolean | null;
+            marginAccountId?: string | null;
+            /** @description A risk bucket of `margin_account_id`. */
+            riskBucketId?: string | null;
+        };
         ConditionalOrder: {
             conditionalOrderId?: string | null;
             /** Format: uuid */
@@ -4521,7 +4735,7 @@ export interface components {
              */
             strategyKey?: string | null;
             /**
-             * @description Risk bucket mode for margin orders. Defaults to ISOLATED. Values: ISOLATED, CROSS.
+             * @description Risk bucket mode for margin orders. Defaults to ISOLATED. Values: ISOLATED, CROSS. On an isolated-only market (TradingPairData.isolated_only) a CROSS order that is not reduce-only is rejected with HTTP 400 / gRPC INVALID_ARGUMENT carrying the structured error code CROSS_MARGIN_NOT_ALLOWED.
              * @example CROSS
              * @enum {string|null}
              */
@@ -4598,6 +4812,23 @@ export interface components {
              */
             trailingStopOrderId?: string | null;
         };
+        CreateSubAccountRequest: {
+            /**
+             * @description Sub-account key: up to 64 letters, digits, `_`, `-`, `.` or `:`. Keys
+             *      starting with `copy:` are reserved, and `default` names the default
+             *      margin account.
+             */
+            subaccountKey?: string | null;
+            /** @description Optional display label. */
+            label?: string | null;
+        };
+        CreateSubAccountResponse: {
+            marginAccountId?: string | null;
+            subaccountKey?: string | null;
+            /** @description Values: ACTIVE. */
+            marginAccountState?: string | null;
+            label?: string | null;
+        };
         CreateTwapOrderRequest: {
             /**
              * Format: uuid
@@ -4670,7 +4901,7 @@ export interface components {
              */
             riskBucketId?: string | null;
             /**
-             * @description Risk bucket mode for margin TWAP orders. Defaults to ISOLATED. Values: ISOLATED, CROSS.
+             * @description Risk bucket mode for margin TWAP orders. Defaults to ISOLATED. Values: ISOLATED, CROSS. On an isolated-only market (TradingPairData.isolated_only) a CROSS order that is not reduce-only is rejected with HTTP 400 / gRPC INVALID_ARGUMENT carrying the structured error code CROSS_MARGIN_NOT_ALLOWED.
              * @example CROSS
              * @enum {string|null}
              */
@@ -4811,6 +5042,8 @@ export interface components {
              * @description Legacy field; no concurrent open-order cap is enforced. New or updated policies leave it unset.
              */
             maxOpenOrders?: number | null;
+            /** @description IP addresses and CIDR ranges the agent may create its delegated session from, normalized. Empty allows any address. */
+            ipAllowlist?: string[] | null;
         };
         DelegatedAgentOwner: {
             /**
@@ -5144,12 +5377,13 @@ export interface components {
              *      margin account yet.
              *
              *      This is NOT trading headroom for existing cross exposure. It is bounded
-             *      by allocation (principal not earmarked by risk buckets) as well as by
+             *      by allocation (net deposits plus settled realized PnL not allocated to
+             *      risk buckets) as well as by
              *      margin requirements, and an unrealized gain does not raise it: a
              *      mark-to-market gain is initial margin against existing cross exposure but
              *      may not fund an exit. `MarginAccountSummary.free_collateral` credits that
              *      gain in full and remains the trading-margin headroom for existing cross
-             *      exposure — but a NEW isolated or first-use position allocates principal
+             *      exposure — but a NEW isolated or first-use position allocates collateral
              *      through the same gate this field measures, so size those from this field.
              *
              *      Note the two `margin_*` fields answer opposite questions:
@@ -5231,12 +5465,6 @@ export interface components {
              * @example 5
              */
             total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -5249,6 +5477,12 @@ export interface components {
              * @example 1
              */
             totalPages?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page. The whole set is already in memory, so over-fetching is free and an
+             *      empty token is the definitive end of the walk.
+             */
+            nextPageToken?: string | null;
         };
         GetBuildercodePayoutSummaryResponse: {
             /**
@@ -5283,7 +5517,7 @@ export interface components {
              * @example 0x0000000000000000000000000000000000000001
              */
             payoutAddress?: string | null;
-            /** @description Current BuilderCodes feature-flag state. Successful responses are true because this endpoint is gated by the flag. */
+            /** @description Whether the BuilderCodes revenue share is switched on. While false no new share accrues; balances already credited stay readable and claimable. */
             buildercodesEnabled?: boolean | null;
             /**
              * Format: uint32
@@ -5434,20 +5668,31 @@ export interface components {
         };
         GetMarginAccountMovementsResponse: {
             movements?: components["schemas"]["MarginAccountMovement"][] | null;
-            /**
-             * Format: uint32
-             * @description Matching movements. Exact up to 10,000 pages of the requested page size (page_size x 10,000 rows) and saturates there, so a caller with more movements than the listing can page through reads the cap, not its lifetime total.
-             * @example 150
-             */
-            total?: number | null;
-            /** Format: uint32 */
-            page?: number | null;
             /** Format: uint32 */
             pageSize?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one SQL statement with one global ORDER BY, so a
+             *      page shorter than `pageSize` proves the walk is exhausted and this is
+             *      empty. A non-empty token always has at least one further row behind it.
+             */
+            nextPageToken?: string | null;
+        };
+        GetMarginAccountPnlResponse: {
+            marginAccountId?: string | null;
+            /**
+             * @description Decimal string: settled on the account plus still held in its open risk
+             *      buckets.
+             */
+            realizedPnl?: string | null;
+            /**
+             * @description Decimal string: the account's open positions repriced at the latest risk
+             *      marks.
+             */
+            unrealizedPnl?: string | null;
         };
         GetMarginAccountSummaryResponse: {
             marginAccountId?: string | null;
-            accountState?: string | null;
             equity?: string | null;
             initialMarginRequired?: string | null;
             maintenanceMarginRequired?: string | null;
@@ -5456,23 +5701,26 @@ export interface components {
              * @description The largest amount a transfer-out of this scope will actually accept.
              *
              *      NOT a clamped `free_collateral`. Free collateral is equity headroom, and
-             *      equity includes realized PnL, accrued funding and mark-to-market gains
-             *      that are not principal a transfer can move — so the two can differ
-             *      without limit. An unrealized gain never counts toward this figure.
+             *      equity includes mark-to-market gains that a transfer cannot move — so
+             *      the two can differ without limit. An unrealized gain never counts toward
+             *      this figure.
+             *
+             *      For a risk bucket this is the bucket's allocated collateral plus its
+             *      realized PnL, less what its positions and resting orders require (the
+             *      bucket's allocation may go negative, which is how realized profit leaves
+             *      a live bucket); for a parent margin account, net deposits plus settled
+             *      realized PnL that no risk bucket has allocated.
              *
-             *      For a risk bucket this is capped by the bucket's allocated collateral;
-             *      for a parent margin account, by deposited collateral that no risk bucket
-             *      has earmarked.
+             *      This is the largest accepted transfer-out, and every smaller amount is
+             *      accepted too. It is zero on a risk bucket that is not `NORMAL` (under
+             *      liquidation or frozen as bad debt), whose allocation cannot be released,
+             *      and on a risk bucket whose realized loss has used up its allocation: that
+             *      bucket cannot be released at all, and the parent margin account is
+             *      charged at most its allocation, the loss past it being the insurance
+             *      fund's.
              *
-             *      This is the largest accepted transfer-out, NOT a promise that every
-             *      smaller one is accepted. Acceptance is not monotone in the amount: a risk
-             *      bucket whose realized loss exceeds its remaining value accepts the full
-             *      close-out reported here — which settles that loss to the parent margin
-             *      account — while refusing a partial withdrawal that would leave the bucket
-             *      holding less collateral than the loss it has already taken. For such a
-             *      bucket the accepted amounts are everything up to its equity, plus this
-             *      figure itself, with a gap in between. Size a transfer directly from this
-             *      field rather than shaving a margin off it.
+             *      Printed truncated toward zero at the quote asset's precision, so the
+             *      printed amount itself is always accepted.
              */
             withdrawableCollateral?: string | null;
             totalPositionNotional?: string | null;
@@ -5507,6 +5755,16 @@ export interface components {
             copyFollowId?: string | null;
             /** @description On a copy risk bucket row, the followed leader's custom TraderCode handle, when they still hold one */
             copyLeaderHandle?: string | null;
+            /**
+             * @description The risk bucket's lifecycle state. Present only for risk-bucket rows;
+             *      a parent margin account has no lifecycle of its own. Values: NORMAL,
+             *      PENDING_LIQUIDATION, LIQUIDATING, BAD_DEBT, CLOSED.
+             */
+            riskBucketState?: string | null;
+            /** @description See `MarginAccountSummary.subaccount_key`. */
+            subaccountKey?: string | null;
+            /** @description See `MarginAccountSummary.margin_account_state`. */
+            marginAccountState?: string | null;
         };
         GetMarkPriceResponse: {
             /** Format: uuid */
@@ -5634,16 +5892,10 @@ export interface components {
             movements?: components["schemas"]["LedgerMovement"][] | null;
             /**
              * Format: uint32
-             * @description Matching movements. Exact up to 10,000 pages of the requested page size (page_size x 10,000 rows) and saturates there, so a user with more matching movements than the listing can page through reads the cap, not their lifetime total.
+             * @description Number of movements matching the filter, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 150
              */
             total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -5652,15 +5904,28 @@ export interface components {
             pageSize?: number | null;
             /**
              * Format: uint32
-             * @description Number of pages at the requested page size. Exact up to 10,000 and saturates there, the last page this listing can reach.
+             * @description Number of pages at this pageSize, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 8
              */
             totalPages?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page. Each arm of the union is cut at the same over-fetched depth and the
+             *      outer query orders the merged rows, so a page shorter than `pageSize`
+             *      means both arms are exhausted and this is empty — a non-empty token always
+             *      has at least one further row behind it.
+             */
+            nextPageToken?: string | null;
+            /**
+             * @description True when more than the server ceiling of movements matched, so the count stopped at the ceiling and total/totalPages are a lower bound. False when total is exact, including exactly the ceiling.
+             * @example false
+             */
+            totalCapped?: boolean | null;
         };
         GetMyFeeTierResponse: {
             /**
              * Format: int32
-             * @description Caller's resolved tier (1–6) from their wallet's stored weighted 14-day volume
+             * @description Caller's resolved tier (1–6) from the higher of their wallet's weighted 14-day volume and any volume floor set on the wallet. A floor that is set or changed counts once it applies to the wallet's fills, usually within a minute, and likewise for an account the wallet opens in a new application; a removed or expired floor stops counting at once
              * @example 2
              */
             currentTierLevel?: number | null;
@@ -5680,7 +5945,7 @@ export interface components {
              */
             perpVolume14d?: string | null;
             /**
-             * @description Additional weighted volume needed to reach the next tier; omitted at tier 6
+             * @description Additional weighted volume needed to reach the next tier, counted from the volume the current tier resolved from; omitted at tier 6
              * @example 17500000
              */
             volumeToNextTier?: string | null;
@@ -5694,16 +5959,18 @@ export interface components {
             feeSchedule?: components["schemas"]["FeeTierScheduleRow"][] | null;
         };
         GetMyReferralDownlineResponse: {
-            /** @description One row per (source trader, level, token) the caller earns from, across all three reward levels. Comes straight from the caller's reward rows — no tree walk. */
+            /** @description One page of rows, one per (source account, level, token) the caller earns from, across every reward level, ordered by each source account's own total, largest first. A wallet that traded through several applications has one account per application: its rows within a page are merged into one row at the position of its first (largest) part, so a merged row can sit below a smaller one, and the wallet can appear again on a later page. Paged by `pageSize` / `pageToken`; follow `nextPageToken` for the rest. Comes from the caller's maintained reward totals — no tree walk. */
             earningsBySource?: components["schemas"]["ReferralEarningsSource"][] | null;
-            /** @description The caller's direct (L1) referees, newest first, including referees who have not traded yet (0 earned). Bounded to the most recent 500 EFFECTIVE referees (after per-wallet dedupe and the winning-edge filter). The earnings views (`earnings_by_source` and the summary) are unbounded and count every level, so a caller past the roster cap still sees their full earnings; only this roster listing is capped. */
+            /** @description The caller's direct (L1) referees, newest first, including referees who have not traded yet (0 earned). Bounded to the most recent 500 EFFECTIVE referees (after per-wallet dedupe and the winning-edge filter). The summary counts every level and source and `earnings_by_source` pages through every row, so a caller past the roster cap still sees their full earnings; only this roster listing is capped. */
             directReferees?: components["schemas"]["ReferralDirectReferee"][] | null;
-            /** @description Total earned broken down by level (L1/L2/L3). */
+            /** @description Total earned broken down by level. Covers every level and source regardless of the `earnings_by_source` page. */
             summary?: components["schemas"]["ReferralEarningsSummary"] | null;
+            /** @description Cursor for the next `earningsBySource` page; empty when there are no more rows. */
+            nextPageToken?: string | null;
         };
         GetMyReferralPositionResponse: {
             /**
-             * @description Public wallet address of the caller's direct (L1) referrer — who referred them. Empty when the caller was not referred. Never exposes L2/L3 upline or any internal id.
+             * @description Public wallet address of the caller's direct (L1) referrer — who referred them. Empty when the caller was not referred. The same wallet as the first `upline` entry; never an internal id.
              * @example 0x0000000000000000000000000000000000000002
              */
             referrer?: string | null;
@@ -5719,6 +5986,21 @@ export interface components {
             referrerDisplay?: string | null;
             /** @description The caller's most recent reward rows, newest first. Bounded server-side — not the full history. */
             rewards?: components["schemas"]["ReferralRewardEntry"][] | null;
+            /** @description The caller's referral chain upward, nearest first: L1 (who referred the caller), then L2 (who referred them), and so on. At most as many entries as PitPass currently rewards levels (at most 10); shorter when the chain ends, empty when the caller was not referred. These are the wallets the caller's own trades pay referral rewards to. */
+            upline?: components["schemas"]["ReferralUplineEntry"][] | null;
+        };
+        GetMyReferralTreeResponse: {
+            /** @description Wallet address whose referees `nodes` lists — the caller's own wallet when the request omitted `parent`. */
+            parent?: string | null;
+            /**
+             * Format: int32
+             * @description Depth of `parent` below the caller: 0 for the caller, otherwise the level of the referee being expanded. Every node is one level deeper.
+             */
+            parentLevel?: number | null;
+            /** @description The wallets `parent` referred, newest first. A wallet that signed up under several referrers (one per app) appears only under the referrer the reward engine pays. */
+            nodes?: components["schemas"]["ReferralTreeNode"][] | null;
+            /** @description Cursor for the next page; empty when there are no more. */
+            nextPageToken?: string | null;
         };
         /** @description Latest public open interest for a trading pair. */
         GetOpenInterestResponse: {
@@ -5763,7 +6045,7 @@ export interface components {
              */
             tradingPairId?: string | null;
             /**
-             * @description What kind of order this row is: LIMIT or MARKET for a book order, TWAP for a TWAP parent, CONDITIONAL for a price-triggered order. TWAP and CONDITIONAL appear only in responses — they name a row's kind and cannot be placed through the create-order request, which still takes LIMIT, MARKET or IOC. A row of either kind carries its kind-specific fields in `twap` or `conditional`; the fields shared by every kind (id, side, quantity, status, timestamps) are populated in place as usual.
+             * @description Order type: LIMIT or MARKET
              * @example LIMIT
              */
             orderType?: string | null;
@@ -5773,7 +6055,7 @@ export interface components {
              */
             side?: string | null;
             /**
-             * @description Limit price (null for market orders). For a TWAP parent this is its optional parent-level limit price, and for a conditional order the limit price its triggered order will carry (null when it triggers as a market order).
+             * @description Limit price (null for market orders)
              * @example 35000.00
              */
             price?: string | null;
@@ -5956,7 +6238,7 @@ export interface components {
              */
             batchId?: string | null;
             /**
-             * @description Stable terminal cause for a cancelled order: USER_REQUESTED, REPLACED, LIQUIDATION, INSUFFICIENT_MARGIN, REDUCE_ONLY_EXHAUSTED, POSITION_CLOSED, OCO_SIBLING_TRIGGERED, or SYSTEM
+             * @description Stable terminal cause for a cancelled order: USER_REQUESTED, REPLACED, LIQUIDATION, INSUFFICIENT_MARGIN, REDUCE_ONLY_EXHAUSTED, POSITION_CLOSED, OCO_SIBLING_TRIGGERED, SELF_TRADE_PREVENTION, AUTO_DELEVERAGING, PRICE_BAND, SLIPPAGE_TOLERANCE, or SYSTEM. AUTO_DELEVERAGING means auto-deleveraging closed the position your risk bucket held and this resting order was cancelled with it; you were deleveraged as a counterparty, not liquidated. PRICE_BAND means the exchange's protective price band stopped the order and its remainder was cancelled; SLIPPAGE_TOLERANCE means your own slippageToleranceBps did.
              * @example REDUCE_ONLY_EXHAUSTED
              */
             terminalReason?: string | null;
@@ -5965,10 +6247,6 @@ export interface components {
              * @example false
              */
             postOnly?: boolean | null;
-            /** @description Present only when orderType is TWAP: the full TWAP parent, identical to what GET /api/v1/orders/twap/{twapOrderId} returns — schedule, slice counters, progress, and terminal reason. The row's shared fields mirror it: quantity is the parent's total quantity, filledQuantity its executed quantity, and status maps its state onto the order statuses. */
-            twap?: components["schemas"]["TwapOrder"] | null;
-            /** @description Present only when orderType is CONDITIONAL: the full conditional order, identical to what the conditional-order endpoints return — trigger price and direction, condition type, linked group, and the order it triggers into. The row's shared fields mirror it, with status mapping its state onto the order statuses. */
-            conditional?: components["schemas"]["ConditionalOrder"] | null;
             /**
              * Format: int64
              * @description Opaque, compare-only revision counter for this order's state: the sequencer step that wrote it. A strictly higher value is strictly newer state for that order. The SAME counter is carried on every order WebSocket event and on the `orders` snapshot frame, so a reconnecting client reconciles on `(id, version)` — take the REST row when `snapshot.version >= local.version`, else keep local state. Note `>=`, not `>`: on the stream, equal versions mean the SAME STEP rather than identical state, because one step emits several events for one order (an `OrderPlaced` and then its fills) and a batch shares one step across every item. A REST row is that step's FINAL state, so it wins a tie. Between two REST reads the comparison is simpler — equal there does mean identical state. Do not read anything else into the number: it is not a count of updates, consecutive values are not expected (it is drawn from a global sequence shared by every order, so per-order values are sparse and gaps are normal), and it is not comparable across different orders. Absent means unknown: an order last written before this field existed. Fall back to a full field comparison for those rather than treating absent as version zero — and note that a comparison against an absent value is false in both directions, so an order held locally without one is never refreshed by the merge above; take the REST row unconditionally for those. Reconciling on this counter does NOT on its own close a reconnect gap: an order that filled or was cancelled while the socket was down appears in neither the resting snapshot nor the stream, so recover fills from `listUserTrades` (ordered by execution time) and resolve anything your local state believes is resting that the snapshot no longer lists with a targeted `getOrder`. Unlike `updatedAt`, this value is identical on every REST endpoint that serves the same order state, and never advances without a state change.
@@ -6141,6 +6419,18 @@ export interface components {
             total?: components["schemas"]["PortfolioMarginTotal"];
             positions?: components["schemas"]["PortfolioMarginPositionCounts"];
             riskBuckets?: components["schemas"]["PortfolioRiskBucket"][] | null;
+            /**
+             * @description The margin account `total`, `positions` and `risk_buckets` describe;
+             *      absent when the caller has no margin account yet.
+             */
+            marginAccountId?: string | null;
+            /**
+             * @description With `include_accounts`: every open margin account of the caller, the
+             *      default one first, then sub-accounts by key.
+             */
+            accounts?: components["schemas"]["PortfolioMarginAccount"][] | null;
+            /** @description With `include_accounts`: the sum of `accounts`' totals. */
+            ownerTotal?: components["schemas"]["PortfolioMarginTotal"] | null;
         };
         GetPortfolioPerformanceResponse: {
             window?: components["schemas"]["PortfolioSeriesWindow"];
@@ -6394,10 +6684,15 @@ export interface components {
             cumFees?: string | null;
             /**
              * Format: int64
-             * @description Opaque, non-negative producer-owned version for this position row. Compare only within the same position; higher is newer. 0 is the unranked legacy sentinel and never participates in ordering: treat it exactly as an absent version and fall back to a full field comparison rather than ranking it as oldest. It advances on sequenced position mutations (open, add, reduce, close, funding, margin transfer, liquidation, ADL) and is shared by the persisted read, the WebSocket positions snapshot and a RANKED live position_update frame. Ranked live frames include fills that leave a position open, direct isolated-position margin adds/reductions, and copy-position margin adds; the copy add refreshes its isolated child and copy-cross siblings at the same version. Cross-risk-bucket ALLOCATE/RELEASE and copy follow/stop refreshes use margin_added/margin_reduced but omit the version because those commands write no position rows. Funding omits it because it re-reads live state after sequencing; terminal frames omit it because they report size 0 and sometimes LIQUIDATED while the stored row keeps its size and records CLOSED. Wallet IN/OUT and plain isolated allocation send no position frame. Transfer frames use captured post-command state and are released only after durable acknowledgement. mark_price, unrealized_pnl, liquidation_price, leverage, maintenance_margin_required and initial_margin_required are UNVERSIONED valuation fields, re-derived per payload rather than served from the versioned row: the version does not advance for them (five move with the oracle mark; leverage does not, being opening notional over posted margin, but the live surfaces derive it while the persisted row serves its stored column, so it can still disagree at an unchanged version) (a valuation-only oracle tick persists nothing; a state-transitioning one, a breach or recovery, persists the account's snapshot and restamps the positions it changed), so the merge rule is per field group — on an equal version skip the versioned fields but still take all six from the newer payload, because discarding a whole payload on an equal version freezes displayed PnL and can leave a stale margin requirement on screen. isolated_margin is the one exception among the versioned fields: the WebSocket positions snapshot overlays it from an independent live matching-engine read rather than the versioned row, so take it from the newest payload on an equal version too or a consumer can retain stale backing. The version advances exactly when the row's versioned content changed at that sequence, a change undone within one persistence batch included; a position a command left unchanged keeps its version, so a RANKED live frame for an untouched sibling of a filled position can carry a higher version than the persisted row while describing identical content — rank it as newer, and nothing changes. A response served from live matching-engine state reports 0 (unranked): the engine holds the state but not the version.
+             * @description Opaque, non-negative producer-owned version for this position row. Compare only within the same position; higher is newer. 0 is the unranked legacy sentinel and never participates in ordering: treat it exactly as an absent version and fall back to a full field comparison rather than ranking it as oldest. It advances on sequenced position mutations (open, add, reduce, close, funding, margin transfer, liquidation, ADL) and is shared by the persisted read, the WebSocket positions snapshot and a RANKED live position_update frame. Ranked live frames include fills, non-zero funding settlements, terminal closes/liquidations/ADL, direct isolated-position margin adds/reductions, and copy-position margin adds; each uses captured post-command state, and terminal frames retain the stored size and exact CLOSED/LIQUIDATED classification. After restart, a terminal frame rebuilt from legacy reduction history omits the version when that history lacks the margin fields needed to reconstruct complete lifetime allocated margin. Cross-risk-bucket ALLOCATE/RELEASE and copy follow/stop refreshes use margin_added/margin_reduced but omit the version because those commands write no position rows. Wallet IN/OUT and plain isolated allocation send no position frame. Transfer and funding frames use captured post-command state and are released only after durable acknowledgement. mark_price, unrealized_pnl, liquidation_price, leverage, maintenance_margin_required and initial_margin_required are UNVERSIONED valuation fields, re-derived per payload rather than served from the versioned row: the version does not advance for them (five move with the oracle mark; leverage does not, being opening notional over posted margin, but the live surfaces derive it while the persisted row serves its stored column, so it can still disagree at an unchanged version) (a valuation-only oracle tick persists nothing; a state-transitioning one, a breach or recovery, persists the account's snapshot and restamps the positions it changed), so the merge rule is per field group — on an equal version skip the versioned fields but still take all six from the newer payload, because discarding a whole payload on an equal version freezes displayed PnL and can leave a stale margin requirement on screen. isolated_margin is the one exception among the versioned fields: the WebSocket positions snapshot overlays it from an independent live matching-engine read rather than the versioned row, so take it from the newest payload on an equal version too or a consumer can retain stale backing. The version advances exactly when the row's versioned content changed at that sequence, a change undone within one persistence batch included; a position a command left unchanged keeps its version, so a RANKED live frame for an untouched sibling of a filled position can carry a higher version than the persisted row while describing identical content — rank it as newer, and nothing changes. A response served from live matching-engine state reports 0 (unranked): the engine holds the state but not the version.
              * @example 918342
              */
             version?: number | null;
+            /**
+             * @description RFC 3339 instant at which this position opened. Same contract as
+             *      `Position.opened_at` above.
+             */
+            openedAt?: string | null;
         };
         GetPositionRiskResponse: {
             positionId?: string | null;
@@ -6601,18 +6896,36 @@ export interface components {
         /** @description Recent trades for a trading pair. */
         GetTradesResponse: {
             trades?: components["schemas"]["PublicTrade"][] | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Maximum number of trades returned
              * @example 25
              */
             pageSize?: number | null;
+            /**
+             * @description Cursor for the next page, under **proven** semantics: the read over-fetches
+             *      one row past `page_size`, so an empty token means the walk is finished and
+             *      a non-empty token means a further trade was actually seen. Unlike
+             *      `ListUserTradesResponse.next_page_token` (AIP-158 "maybe more"), a client
+             *      can stop here on the empty token without a confirming extra request — this
+             *      listing reads one table, so there is no hot/archive interleave that could
+             *      hide rows behind a short page.
+             *
+             *      That one table is the hot `trades` table, so a walk reaches the end of the
+             *      archiver's retention window rather than the end of the pair's history. This
+             *      is the endpoint's long-standing scope, unchanged by the cursor.
+             *
+             *      There is no public walk over a pair's ARCHIVED history, and this endpoint is
+             *      not a partial one — do not point market-data consumers at the user trade
+             *      listings to continue it. `GetUserTrades` / `ListUserTrades` do merge the
+             *      archive, but they are authenticated and user-scoped (`auth.user_id` is the
+             *      read's first mandatory filter), so they return only trades where the caller
+             *      was maker or taker. Following them to extend a public pair tape would
+             *      silently drop every fill between two other parties. An individual archived
+             *      trade does stay publicly reachable by id: `GetTradeById` falls back to the
+             *      archive table on a hot miss.
+             */
+            nextPageToken?: string | null;
         };
         /** @description Single trading pair details. */
         GetTradingPairResponse: {
@@ -7003,29 +7316,50 @@ export interface components {
              */
             balanceId?: string | null;
         };
+        /** @description What the caller has earned at one referral level. */
+        LevelEarnings: {
+            /**
+             * Format: int32
+             * @description Referral level: 1 for direct referees, 2 for their referees, and so on (at most 10).
+             * @example 1
+             */
+            level?: number | null;
+            /**
+             * @description All-time credited earnings at this level, in the reward token's RAW atomic units.
+             * @example 900000
+             */
+            earned?: string | null;
+        };
         ListAllFundingHistoryResponse: {
             records?: components["schemas"]["FundingRecord"][] | null;
-            /** Format: uint32 */
+            /**
+             * Format: uint32
+             * @description Settlements matching the filter, bounded by the server count ceiling — see
+             *      `totalCapped`. A lower bound when `totalCapped` is true.
+             */
             total?: number | null;
             /** Format: uint32 */
-            page?: number | null;
-            /** Format: uint32 */
             pageSize?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `pageSize` proves the walk is exhausted and this is empty.
+             */
+            nextPageToken?: string | null;
+            /**
+             * @description True when MORE than the server ceiling matched, so the count stopped at
+             *      the ceiling and `total` is a lower bound.
+             */
+            totalCapped?: boolean | null;
         };
         ListAppBalancesResponse: {
             balances?: components["schemas"]["ApplicationBalance"][] | null;
             /**
              * Format: uint32
-             * @description Total matching balances
+             * @description Number of balances matching the filter, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 50
              */
             total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -7034,25 +7368,24 @@ export interface components {
             pageSize?: number | null;
             /**
              * Format: uint32
-             * @description Total number of pages
+             * @description Number of pages at this pageSize, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 3
              */
             totalPages?: number | null;
-        };
-        ListAppMovementsResponse: {
-            movements?: components["schemas"]["ApplicationMovement"][] | null;
             /**
-             * Format: uint32
-             * @description Matching movements. Exact up to 10,000 pages of the requested page size (page_size x 10,000 rows) and saturates there, so an application with more matching movements than the listing can page through reads the cap, not its lifetime total.
-             * @example 150
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `pageSize` proves the walk is exhausted and this is empty.
              */
-            total?: number | null;
+            nextPageToken?: string | null;
             /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
+             * @description True when more than the server ceiling of balances matched, so the count stopped at the ceiling and total/totalPages are a lower bound.
+             * @example false
              */
-            page?: number | null;
+            totalCapped?: boolean | null;
+        };
+        ListAppMovementsResponse: {
+            movements?: components["schemas"]["ApplicationMovement"][] | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -7060,26 +7393,14 @@ export interface components {
              */
             pageSize?: number | null;
             /**
-             * Format: uint32
-             * @description Number of pages at the requested page size. Exact up to 10,000 and saturates there, the last page this listing can reach.
-             * @example 8
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `pageSize` proves the walk is exhausted and this is empty.
              */
-            totalPages?: number | null;
+            nextPageToken?: string | null;
         };
         ListAppOrdersResponse: {
             orders?: components["schemas"]["ApplicationOrder"][] | null;
-            /**
-             * Format: uint32
-             * @description Matching orders. Exact up to 10,000 pages of the requested page size (page_size x 10,000 rows) and saturates there, so an application with more matching orders than the listing can page through reads the cap, not its lifetime total.
-             * @example 150
-             */
-            total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -7087,26 +7408,20 @@ export interface components {
              */
             pageSize?: number | null;
             /**
-             * Format: uint32
-             * @description Number of pages at the requested page size. Exact up to 10,000 and saturates there, the last page this listing can reach.
-             * @example 8
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `pageSize` proves the walk is exhausted and this is empty.
              */
-            totalPages?: number | null;
+            nextPageToken?: string | null;
         };
         ListAppUsersResponse: {
             users?: components["schemas"]["AppUser"][] | null;
             /**
              * Format: uint32
-             * @description Total number of users
+             * @description Number of users matching the filter, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 50
              */
             total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -7115,10 +7430,21 @@ export interface components {
             pageSize?: number | null;
             /**
              * Format: uint32
-             * @description Total number of pages
+             * @description Number of pages at this pageSize, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 3
              */
             totalPages?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `pageSize` proves the walk is exhausted and this is empty.
+             */
+            nextPageToken?: string | null;
+            /**
+             * @description True when more than the server ceiling of users matched, so the count stopped at the ceiling and total/totalPages are a lower bound.
+             * @example false
+             */
+            totalCapped?: boolean | null;
         };
         ListBuilderFeeChangesResponse: {
             /** @description Builder-fee changes, newest first. */
@@ -7134,11 +7460,6 @@ export interface components {
              * @description Total payout rows for this application.
              */
             total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number.
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page.
@@ -7149,6 +7470,12 @@ export interface components {
              * @description Total number of pages.
              */
             totalPages?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `page_size` proves the walk is exhausted and this is empty.
+             */
+            nextPageToken?: string | null;
         };
         ListConditionalOrdersResponse: {
             orders?: components["schemas"]["ConditionalOrder"][] | null;
@@ -7185,27 +7512,34 @@ export interface components {
         };
         ListFundingHistoryResponse: {
             records?: components["schemas"]["FundingRecord"][] | null;
-            /** Format: uint32 */
+            /**
+             * Format: uint32
+             * @description Settlements matching the filter, bounded by the server count ceiling — see
+             *      `totalCapped`. A lower bound when `totalCapped` is true.
+             */
             total?: number | null;
             /** Format: uint32 */
-            page?: number | null;
-            /** Format: uint32 */
             pageSize?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `pageSize` proves the walk is exhausted and this is empty.
+             */
+            nextPageToken?: string | null;
+            /**
+             * @description True when MORE than the server ceiling matched, so the count stopped at
+             *      the ceiling and `total` is a lower bound.
+             */
+            totalCapped?: boolean | null;
         };
         ListFundingPaymentsResponse: {
             records?: components["schemas"]["FundingPaymentRecord"][] | null;
             /**
              * Format: uint32
-             * @description Matching funding payment records. Exact up to 10,000 pages of the requested page size (page_size x 10,000 rows) and saturates there, so a user with more matching payments than the listing can page through reads the cap, not their lifetime total.
+             * @description Number of funding payments matching the filter, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 2
              */
             total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -7214,10 +7548,21 @@ export interface components {
             pageSize?: number | null;
             /**
              * Format: uint32
-             * @description Number of pages at the requested page size. Exact up to 10,000 and saturates there, the last page this listing can reach.
+             * @description Number of pages at this pageSize, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 1
              */
             totalPages?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `pageSize` proves the walk is exhausted and this is empty.
+             */
+            nextPageToken?: string | null;
+            /**
+             * @description True when more than the server ceiling of payments matched, so the count stopped at the ceiling and total/totalPages are a lower bound.
+             * @example false
+             */
+            totalCapped?: boolean | null;
         };
         ListLeadTraderClosedTradesResponse: {
             closedTrades?: components["schemas"]["ClosedTrade"][] | null;
@@ -7237,22 +7582,37 @@ export interface components {
         ListManagedMarketAssignmentsResponse: {
             /** @description Expected assignments, including phases currently unable to quote. */
             items?: components["schemas"]["ManagedMarketAssignment"][] | null;
-            /** Format: uint32 */
+            /**
+             * Format: uint32
+             * @description Exact: a maker's assignment inventory is a small bounded set.
+             */
             total?: number | null;
             /** Format: uint32 */
-            page?: number | null;
-            /** Format: uint32 */
             pageSize?: number | null;
             inventoryObservedAt?: string | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `page_size` proves the walk is exhausted and this is empty.
+             */
+            nextPageToken?: string | null;
         };
         ListMarginAccountsResponse: {
             accounts?: components["schemas"]["MarginAccountSummary"][] | null;
-            /** Format: uint32 */
+            /**
+             * Format: uint32
+             * @description Exact: a user's margin accounts and risk buckets are a small bounded set,
+             *      counted in memory after the repricing pass.
+             */
             total?: number | null;
             /** Format: uint32 */
-            page?: number | null;
-            /** Format: uint32 */
             pageSize?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page. The whole set is already in memory, so over-fetching is free and an
+             *      empty token is the definitive end of the walk.
+             */
+            nextPageToken?: string | null;
         };
         ListMyFollowersResponse: {
             followers?: components["schemas"]["Follower"][] | null;
@@ -7307,12 +7667,6 @@ export interface components {
              * @example 3
              */
             total?: number | null;
-            /**
-             * Format: uint32
-             * @description Current page number
-             * @example 1
-             */
-            page?: number | null;
             /**
              * Format: uint32
              * @description Items per page
@@ -7325,32 +7679,47 @@ export interface components {
              * @example 1
              */
             totalPages?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one ordered read, so a page shorter than
+             *      `page_size` proves the walk is exhausted and this is empty.
+             */
+            nextPageToken?: string | null;
         };
         ListPositionHistoryResponse: {
             events?: components["schemas"]["PositionHistoryEvent"][] | null;
-            /**
-             * Format: uint32
-             * @description Matching position-history events. Exact up to 10,000 pages of the requested page size (page_size x 10,000 rows) and saturates there, so a caller with more history than the listing can page through reads the cap, not its lifetime total.
-             * @example 150
-             */
-            total?: number | null;
-            /** Format: uint32 */
-            page?: number | null;
             /** Format: uint32 */
             pageSize?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one SQL statement with one global ORDER BY, so a
+             *      page shorter than `pageSize` proves the walk is exhausted and this is
+             *      empty. A non-empty token always has at least one further row behind it.
+             */
+            nextPageToken?: string | null;
         };
         ListPositionsResponse: {
             positions?: components["schemas"]["Position"][] | null;
             /**
              * Format: uint32
-             * @description Matching positions. Exact up to 10,000 pages of the requested page size (page_size x 10,000 rows) and saturates there, so a caller with more matching positions than the listing can page through reads the cap, not its lifetime total.
+             * @description Number of positions matching the filter, bounded by the server ceiling — a lower bound when totalCapped is true.
              * @example 150
              */
             total?: number | null;
             /** Format: uint32 */
-            page?: number | null;
-            /** Format: uint32 */
             pageSize?: number | null;
+            /**
+             * @description Cursor for the next page, minted from the last row of an over-fetched
+             *      page: this listing is one SQL statement with one global ORDER BY, so a
+             *      page shorter than `pageSize` proves the walk is exhausted and this is
+             *      empty. A non-empty token always has at least one further row behind it.
+             */
+            nextPageToken?: string | null;
+            /**
+             * @description True when more than the server ceiling of positions matched, so the count stopped at the ceiling and total is a lower bound. False when total is exact, including exactly the ceiling.
+             * @example false
+             */
+            totalCapped?: boolean | null;
         };
         ListSubAccountsResponse: {
             subAccounts?: components["schemas"]["SubAccount"][] | null;
@@ -7461,7 +7830,6 @@ export interface components {
         MarginAccountSummary: {
             /** @description Parent margin account UUID. */
             marginAccountId?: string | null;
-            accountState?: string | null;
             equity?: string | null;
             initialMarginRequired?: string | null;
             maintenanceMarginRequired?: string | null;
@@ -7470,23 +7838,26 @@ export interface components {
              * @description The largest amount a transfer-out of this scope will actually accept.
              *
              *      NOT a clamped `free_collateral`. Free collateral is equity headroom, and
-             *      equity includes realized PnL, accrued funding and mark-to-market gains
-             *      that are not principal a transfer can move — so the two can differ
-             *      without limit. An unrealized gain never counts toward this figure.
+             *      equity includes mark-to-market gains that a transfer cannot move — so
+             *      the two can differ without limit. An unrealized gain never counts toward
+             *      this figure.
              *
-             *      For a risk bucket this is capped by the bucket's allocated collateral;
-             *      for a parent margin account, by deposited collateral that no risk bucket
-             *      has earmarked.
+             *      For a risk bucket this is the bucket's allocated collateral plus its
+             *      realized PnL, less what its positions and resting orders require (the
+             *      bucket's allocation may go negative, which is how realized profit leaves
+             *      a live bucket); for a parent margin account, net deposits plus settled
+             *      realized PnL that no risk bucket has allocated.
              *
-             *      This is the largest accepted transfer-out, NOT a promise that every
-             *      smaller one is accepted. Acceptance is not monotone in the amount: a risk
-             *      bucket whose realized loss exceeds its remaining value accepts the full
-             *      close-out reported here — which settles that loss to the parent margin
-             *      account — while refusing a partial withdrawal that would leave the bucket
-             *      holding less collateral than the loss it has already taken. For such a
-             *      bucket the accepted amounts are everything up to its equity, plus this
-             *      figure itself, with a gap in between. Size a transfer directly from this
-             *      field rather than shaving a margin off it.
+             *      This is the largest accepted transfer-out, and every smaller amount is
+             *      accepted too. It is zero on a risk bucket that is not `NORMAL` (under
+             *      liquidation or frozen as bad debt), whose allocation cannot be released,
+             *      and on a risk bucket whose realized loss has used up its allocation: that
+             *      bucket cannot be released at all, and the parent margin account is
+             *      charged at most its allocation, the loss past it being the insurance
+             *      fund's.
+             *
+             *      Printed truncated toward zero at the quote asset's precision, so the
+             *      printed amount itself is always accepted.
              */
             withdrawableCollateral?: string | null;
             totalPositionNotional?: string | null;
@@ -7542,7 +7913,8 @@ export interface components {
              *
              *      Present only on risk-bucket summary rows served from a live risk engine
              *      snapshot; absent on parent rows and on persisted-fallback reads, where
-             *      neither of the gate's terms is reconstructable.
+             *      neither of the gate's terms is reconstructable. Printed truncated toward
+             *      zero at the quote asset's precision, like `withdrawable_collateral`.
              */
             availableOrderCollateral?: string | null;
             /**
@@ -7552,6 +7924,22 @@ export interface components {
             copyFollowId?: string | null;
             /** @description On a copy risk bucket row, the followed leader's custom TraderCode handle, when they still hold one */
             copyLeaderHandle?: string | null;
+            /**
+             * @description The risk bucket's lifecycle state. Present only for risk-bucket rows;
+             *      a parent margin account has no lifecycle of its own. Values: NORMAL,
+             *      PENDING_LIQUIDATION, LIQUIDATING, BAD_DEBT, CLOSED.
+             */
+            riskBucketState?: string | null;
+            /**
+             * @description The margin account's sub-account key; `default` is the default margin
+             *      account.
+             */
+            subaccountKey?: string | null;
+            /**
+             * @description The margin account's state. Values: ACTIVE, CLOSED (a closed
+             *      sub-account).
+             */
+            marginAccountState?: string | null;
         };
         MatchResult: {
             /**
@@ -7872,6 +8260,17 @@ export interface components {
              */
             positions?: string | null;
         };
+        /** @description One of the caller's open margin accounts in the owner rollup. */
+        PortfolioMarginAccount: {
+            marginAccountId?: string | null;
+            /** @description `default` for the default margin account, else the sub-account's key. */
+            subaccountKey?: string | null;
+            /**
+             * @description The account's totals. `withdrawable_collateral` here is the persisted
+             *      reconstruction of the engine's bound.
+             */
+            total?: components["schemas"]["PortfolioMarginTotal"] | null;
+        };
         PortfolioMarginPositionCounts: {
             total?: string | null;
             cross?: string | null;
@@ -7889,21 +8288,19 @@ export interface components {
              *      the bound the engine enforces on transfers-out and withdrawals, and
              *      therefore also the effective ceiling on funding new isolated or
              *      first-use order capacity, because allocating collateral to a risk
-             *      bucket passes through the same principal-gated door.
+             *      bucket passes through the same capacity-gated door.
              *
              *      NOT a clamped `parent_available_collateral`. That field is
-             *      `free_collateral`, an equity figure: it credits settled realized PnL,
-             *      accrued funding, and mark-to-market gains that a transfer-out cannot
-             *      move, so the two can differ without limit. This bound never credits an
-             *      unrealized gain. Under the default capacity basis it also excludes
-             *      non-principal balances such as banked realized PnL:
-             *      `min(deposited principal - bucket allocations,
-             *      free_collateral - max(unrealized_pnl, 0))`, floored at zero. Whatever
-             *      the engine's configured capacity basis, this is the bound its gates
-             *      actually enforce. It agrees with
-             *      `MarginAccountSummary.withdrawable_collateral` up to quote-decimal
-             *      truncation: this surface truncates toward zero at the quote asset's
-             *      precision, while the margin-accounts surface may carry sub-tick tails.
+             *      `free_collateral`, an equity figure: it credits mark-to-market gains
+             *      and realized PnL still held in open risk buckets, which a transfer-out
+             *      of the parent cannot move, so the two can differ without limit. This bound never credits an
+             *      unrealized gain. It counts net deposits plus the account's settled
+             *      realized PnL and funding, less what risk buckets have allocated:
+             *      `min(net deposits + settled realized PnL - bucket allocations,
+             *      free_collateral - max(unrealized_pnl, 0))`, floored at zero. This is the
+             *      bound the engine's gates actually enforce. The same figure as
+             *      `MarginAccountSummary.withdrawable_collateral`: both surfaces truncate it
+             *      toward zero at the quote asset's precision.
              *
              *      Size transfers-out, withdrawals, and new isolated/first-use positions
              *      from this field; `parent_available_collateral` remains the trading-margin
@@ -7954,17 +8351,16 @@ export interface components {
              *      accept — the bound enforced on bucket collateral withdrawals.
              *
              *      NOT a clamped `free_collateral`: free collateral is equity headroom and
-             *      credits realized PnL and mark-to-market gains that a transfer-out cannot
-             *      move. This bound is capped by the bucket's settled capacity (its
-             *      allocated collateral, under the default capacity basis), and an
-             *      unrealized gain never raises it.
+             *      credits mark-to-market gains that a transfer-out cannot move. This bound
+             *      is the bucket's allocated collateral plus its realized PnL, less funding
+             *      paid, unrealized losses and the margin its positions and resting orders
+             *      require. Realized profit can leave a live bucket this way (the bucket's
+             *      allocation may go negative); an unrealized gain never raises it.
              *
-             *      This is the largest accepted transfer-out, NOT a promise that every
-             *      smaller one is accepted: an underwater flat bucket accepts its full
-             *      close-out while refusing partial withdrawals below it. Agrees with the
-             *      risk-bucket rows' `MarginAccountSummary.withdrawable_collateral` up to
-             *      quote-decimal truncation (this surface truncates toward zero; that one
-             *      may carry sub-tick tails).
+             *      This is the largest accepted transfer-out, and every smaller amount is
+             *      accepted too. It is zero on a risk bucket that is not `NORMAL` and on one
+             *      whose realized loss has used up its allocation. The same figure as the
+             *      risk-bucket rows' `MarginAccountSummary.withdrawable_collateral`.
              */
             withdrawableCollateral?: string | null;
             /**
@@ -8211,10 +8607,38 @@ export interface components {
             cumFees?: string | null;
             /**
              * Format: int64
-             * @description Opaque, non-negative producer-owned version for this position row. Compare only within the same position; higher is newer. 0 is the unranked legacy sentinel and never participates in ordering: it means the row predates this field or came from a producer that does not stamp it, so treat it exactly as an absent version and fall back to a full field comparison rather than ranking it as oldest. It advances on sequenced position mutations (open, add, reduce, close, funding, margin transfer, liquidation, ADL) and is shared by the persisted read, the WebSocket positions snapshot and a RANKED live position_update frame. Ranked live frames include fills that leave a position open, direct isolated-position margin adds/reductions, and copy-position margin adds; the copy add refreshes its isolated child and copy-cross siblings at the same version. Cross-risk-bucket ALLOCATE/RELEASE and copy follow/stop refreshes use margin_added/margin_reduced but omit the version because those commands write no position rows. Funding omits it because it re-reads live state after sequencing; terminal frames omit it because they report size 0 and sometimes LIQUIDATED while the stored row keeps its size and records CLOSED. Wallet IN/OUT and plain isolated allocation send no position frame. Transfer frames use captured post-command state and are released only after durable acknowledgement. mark_price, unrealized_pnl, liquidation_price, leverage, maintenance_margin_required and initial_margin_required are UNVERSIONED valuation fields, re-derived per payload rather than served from the versioned row: the version does not advance for them (five move with the oracle mark; leverage does not, being opening notional over posted margin, but the live surfaces derive it while the persisted row serves its stored column, so it can still disagree at an unchanged version) (a valuation-only oracle tick persists nothing; a state-transitioning one, a breach or recovery, persists the account's snapshot and restamps the positions it changed), so the merge rule is per field group — on an equal version skip the versioned fields but still take all six from the newer payload, because discarding a whole payload on an equal version freezes displayed PnL and can leave a stale margin requirement on screen. isolated_margin is the one exception among the versioned fields: the WebSocket positions snapshot overlays it from an independent live matching-engine read rather than the versioned row, so take it from the newest payload on an equal version too or a consumer can retain stale backing. The version advances exactly when the row's versioned content changed at that sequence, a change undone within one persistence batch included; a position a command left unchanged keeps its version, so a RANKED live frame for an untouched sibling of a filled position can carry a higher version than the persisted row while describing identical content — rank it as newer, and nothing changes. A response served from live matching-engine state reports 0 (unranked): the engine holds the state but not the version.
+             * @description Opaque, non-negative producer-owned version for this position row. Compare only within the same position; higher is newer. 0 is the unranked legacy sentinel and never participates in ordering: it means the row predates this field or came from a producer that does not stamp it, so treat it exactly as an absent version and fall back to a full field comparison rather than ranking it as oldest. It advances on sequenced position mutations (open, add, reduce, close, funding, margin transfer, liquidation, ADL) and is shared by the persisted read, the WebSocket positions snapshot and a RANKED live position_update frame. Ranked live frames include fills, non-zero funding settlements, terminal closes/liquidations/ADL, direct isolated-position margin adds/reductions, and copy-position margin adds; each uses captured post-command state, and terminal frames retain the stored size and exact CLOSED/LIQUIDATED classification. After restart, a terminal frame rebuilt from legacy reduction history omits the version when that history lacks the margin fields needed to reconstruct complete lifetime allocated margin. Cross-risk-bucket ALLOCATE/RELEASE and copy follow/stop refreshes use margin_added/margin_reduced but omit the version because those commands write no position rows. Wallet IN/OUT and plain isolated allocation send no position frame. Transfer and funding frames use captured post-command state and are released only after durable acknowledgement. mark_price, unrealized_pnl, liquidation_price, leverage, maintenance_margin_required and initial_margin_required are UNVERSIONED valuation fields, re-derived per payload rather than served from the versioned row: the version does not advance for them (five move with the oracle mark; leverage does not, being opening notional over posted margin, but the live surfaces derive it while the persisted row serves its stored column, so it can still disagree at an unchanged version) (a valuation-only oracle tick persists nothing; a state-transitioning one, a breach or recovery, persists the account's snapshot and restamps the positions it changed), so the merge rule is per field group — on an equal version skip the versioned fields but still take all six from the newer payload, because discarding a whole payload on an equal version freezes displayed PnL and can leave a stale margin requirement on screen. isolated_margin is the one exception among the versioned fields: the WebSocket positions snapshot overlays it from an independent live matching-engine read rather than the versioned row, so take it from the newest payload on an equal version too or a consumer can retain stale backing. The version advances exactly when the row's versioned content changed at that sequence, a change undone within one persistence batch included; a position a command left unchanged keeps its version, so a RANKED live frame for an untouched sibling of a filled position can carry a higher version than the persisted row while describing identical content — rank it as newer, and nothing changes. A response served from live matching-engine state reports 0 (unranked): the engine holds the state but not the version.
              * @example 918342
              */
             version?: number | null;
+            /**
+             * @description RFC 3339 instant at which this position OPENED: the fill that took its
+             *      exposure from zero to non-zero. Time held is now minus opened_at for an
+             *      OPEN position, and updated_at minus opened_at for a terminal one. It never
+             *      changes for the life of the position id; a flip closes the position and
+             *      opens a new one, with a new id and its own opened_at.
+             *
+             *      Served from the matching engine's record of the opening fill while the
+             *      engine holds the position, and from the persisted row otherwise. The row
+             *      is written from the same fill's durable stamp, which comes from the
+             *      sequencer's non-decreasing stamp clock rather than the engine's wall
+             *      clock. The two readings normally agree to within one sequencer step, but
+             *      while the stamp clock is held ahead of a lagging host clock they differ by
+             *      that lead (`matching_engine_stamp_clock_live_lead_ms`), so a position's
+             *      value can move by it when the engine restarts and re-reads the row. Clamp
+             *      a computed time held at zero.
+             *
+             *      Absent when the opening instant is unknown, never filled with the read
+             *      instant. Positions opened before this field existed carry the persisted
+             *      row's value, which can trail the opening fill by the persistence lag
+             *      where the fill could not be recovered.
+             *
+             *      Not versioned, and not guaranteed constant at a given `version`: a
+             *      one-off operator correction can move it earlier without advancing the
+             *      version. Take it from the newest payload rather than skipping it on an
+             *      equal version.
+             */
+            openedAt?: string | null;
         };
         PositionHistoryEvent: {
             id?: string | null;
@@ -8524,7 +8948,7 @@ export interface components {
             source?: string | null;
             /**
              * Format: int32
-             * @description Referral level the caller earns from this source at: 1 (direct), 2, or 3.
+             * @description Referral level the caller earns from this source at: 1 (direct), 2, and so on (at most 10). Rows at a level deeper than PitPass rewards today are earlier earnings, kept as history.
              * @example 1
              */
             level?: number | null;
@@ -8557,6 +8981,10 @@ export interface components {
          *      ever pays in more than one reward token, atomic units across tokens are not
          *      additive, so read the per-token `earnings_by_source` rows for a correct
          *      breakdown.
+         *
+         *      `by_level` covers every level with earnings. `level1_earned`,
+         *      `level2_earned` and `level3_earned` are deprecated: they carry levels 1 to 3
+         *      for older clients and say nothing about deeper levels.
          */
         ReferralEarningsSummary: {
             /**
@@ -8565,20 +8993,25 @@ export interface components {
              */
             totalEarned?: string | null;
             /**
-             * @description Total earned from direct (L1) referees, in RAW atomic units.
+             * @deprecated
+             * @description DEPRECATED: use `byLevel`. Total earned from direct (L1) referees, in RAW atomic units.
              * @example 900000
              */
             level1Earned?: string | null;
             /**
-             * @description Total earned from L2 downline, in RAW atomic units.
+             * @deprecated
+             * @description DEPRECATED: use `byLevel`. Total earned from L2 downline, in RAW atomic units.
              * @example 400000
              */
             level2Earned?: string | null;
             /**
-             * @description Total earned from L3 downline, in RAW atomic units.
+             * @deprecated
+             * @description DEPRECATED: use `byLevel`. Total earned from L3 downline, in RAW atomic units.
              * @example 100000
              */
             level3Earned?: string | null;
+            /** @description All-time credited earnings per referral level, ascending by level, one entry per level the caller has earned at (levels with nothing earned are omitted). Covers every level, including levels deeper than PitPass rewards today. */
+            byLevel?: components["schemas"]["LevelEarnings"][] | null;
         };
         /** @description A single reward the caller has earned, one row per referred trade × level. */
         ReferralRewardEntry: {
@@ -8589,7 +9022,7 @@ export interface components {
             source?: string | null;
             /**
              * Format: int32
-             * @description Referral level this reward was paid at: 1 (direct, 30%), 2 (15%), or 3 (5%).
+             * @description Referral level this reward was paid at: 1 for the direct referrer, 2 for the referrer's referrer, and so on (at most 10).
              * @example 1
              */
             level?: number | null;
@@ -8619,6 +9052,50 @@ export interface components {
              */
             sourceDisplay?: string | null;
         };
+        /** @description One wallet in the caller's referral tree. */
+        ReferralTreeNode: {
+            /**
+             * @description Public wallet address of this referee. Never an internal id.
+             * @example 0x0000000000000000000000000000000000000004
+             */
+            wallet?: string | null;
+            /** @description Human-facing name for this referee: their custom TraderCode handle when they have claimed one, otherwise the wallet address (same as `wallet`). Render this instead of raw hex. */
+            display?: string | null;
+            /**
+             * Format: int32
+             * @description Depth below the caller: 1 (the caller referred this wallet), 2, and so on up to the configured reward depth (at most 10).
+             */
+            level?: number | null;
+            /** @description Wallet address of the referrer of this node — the caller for a level-1 node. */
+            parent?: string | null;
+            /**
+             * Format: date-time
+             * @description RFC 3339 time this wallet signed up under its parent.
+             */
+            referredAt?: string | null;
+            /**
+             * Format: uint32
+             * @description How many wallets this node has referred. Expand the node (request it as `parent`) when this is above 0. Always 0 at the deepest rewarded level, the deepest level shown.
+             */
+            refereeCount?: number | null;
+            /** @description What the caller has earned from this wallet's own trades, across every token, in RAW atomic units. `0` for a wallet that has not traded yet. */
+            totalEarned?: string | null;
+        };
+        /** @description One ancestor in the caller's referral chain. */
+        ReferralUplineEntry: {
+            /**
+             * @description Public wallet address of the ancestor. Never an internal id.
+             * @example 0x0000000000000000000000000000000000000002
+             */
+            wallet?: string | null;
+            /** @description Human-facing name for the ancestor: their custom TraderCode handle when they have claimed one, otherwise the wallet address (same as `wallet`). Render this instead of raw hex. */
+            display?: string | null;
+            /**
+             * Format: int32
+             * @description How far above the caller this ancestor is: 1 (the caller's direct referrer), 2, and so on up to the configured reward depth (at most 10).
+             */
+            level?: number | null;
+        };
         RefreshManagedMarketQuotesRequest: {
             launchId?: string | null;
             ownerId?: string | null;
@@ -8764,11 +9241,14 @@ export interface components {
              */
             maintenanceMarginRatio?: string | null;
             /**
-             * @deprecated
-             * @description DEPRECATED compatibility alias. This value is a maximum absolute base-asset quantity, not a notional. Use maxPositionSize.
+             * @description The most USD notional a position may hold at this bracket's max leverage: the next bracket's lowerBoundNotional, or the market's position cap on the top bracket. A position is valued at the order's price. Below the top bracket the cap is exclusive, since a notional at the next bound already sits in the next bracket. An order at a given leverage may take its position up to the cap of the highest bracket whose maxLeverage allows that leverage.
+             * @example 100000000
              */
             maxPositionNotional?: string | null;
-            /** @description Maximum authoritative absolute position size in base-asset quantity. A market-wide cap, repeated on every tier rather than varying per bracket. */
+            /**
+             * @deprecated
+             * @description DEPRECATED and no longer set: positions are capped in notional per bracket. Use maxPositionNotional.
+             */
             maxPositionSize?: string | null;
             /**
              * Format: uint32
@@ -9278,6 +9758,12 @@ export interface components {
              * @description MARKET only: client slippage tolerance in basis points, 0..1000, the same rule placement enforces — a LIMIT or IOC preview carrying it is rejected. Tightens the previewed walk to the band the real order will run under and never widens it; omit for the placement default.
              */
             slippageToleranceBps?: number | null;
+            /**
+             * @description The margin account the preview runs against: the default margin account
+             *      (the default) or any of the caller's open sub-accounts, previewing that
+             *      account's own risk buckets.
+             */
+            marginAccountId?: string | null;
         };
         StopFollowResponse: {
             /**
@@ -9676,6 +10162,11 @@ export interface components {
              * @example USDC
              */
             quoteAssetName?: string | null;
+            /**
+             * @description Isolated-only market: cross margin may only reduce a position here. An order from a CROSS risk bucket that is not reduce-only is rejected with the error code CROSS_MARGIN_NOT_ALLOWED; open the position with margin_mode ISOLATED instead
+             * @example false
+             */
+            isolatedOnly?: boolean | null;
         };
         /**
          * @description Trailing stop leg (0XM-2827). Reduce-only MARKET close whose trigger trails
@@ -9744,7 +10235,8 @@ export interface components {
             /**
              * @description The largest amount a further transfer-out will accept after this one.
              *      See `MarginAccountSummary.withdrawable_collateral`: this is an
-             *      allocation-bounded figure, not clamped equity headroom.
+             *      allocation-bounded figure, not clamped equity headroom. Truncated toward
+             *      zero at the collateral asset's precision.
              */
             newWithdrawableCollateral?: string | null;
             strategyKey?: string | null;
@@ -9753,6 +10245,30 @@ export interface components {
             asset?: string | null;
             amount?: string | null;
         };
+        TransferCollateralFromSubAccountRequest: {
+            /** @description The caller's sub-account the collateral leaves. */
+            marginAccountId?: string | null;
+            amount?: string | null;
+        };
+        TransferCollateralRequest: {
+            /** @description Collateral asset symbol or address. */
+            asset?: string | null;
+            amount?: string | null;
+            /** @description Where the collateral comes from. */
+            from?: components["schemas"]["CollateralTransferEndpoint"] | null;
+            /** @description Where the collateral goes. */
+            to?: components["schemas"]["CollateralTransferEndpoint"] | null;
+        };
+        TransferCollateralResponse: {
+            movementId?: string | null;
+            amount?: string | null;
+            /** @description The source margin account, when the source is one. */
+            fromMarginAccountId?: string | null;
+            /** @description The destination margin account, when the destination is one. */
+            toMarginAccountId?: string | null;
+            /** @description The destination risk bucket, when the destination is one. */
+            toRiskBucketId?: string | null;
+        };
         TransferCollateralToMarginAccountRequest: {
             /** @description Parent margin account UUID that receives collateral. */
             marginAccountId?: string | null;
@@ -9779,7 +10295,8 @@ export interface components {
             /**
              * @description The largest amount a further transfer-out will accept after this one.
              *      See `MarginAccountSummary.withdrawable_collateral`: this is an
-             *      allocation-bounded figure, not clamped equity headroom.
+             *      allocation-bounded figure, not clamped equity headroom. Truncated toward
+             *      zero at the collateral asset's precision.
              */
             newWithdrawableCollateral?: string | null;
             strategyKey?: string | null;
@@ -9857,6 +10374,18 @@ export interface components {
              *      row is stale (close/reopen race).
              */
             applyToPositionMargin?: boolean | null;
+            /**
+             * @description The margin account whose risk bucket is funded: the default margin
+             *      account (the default) or any of the caller's open sub-accounts, which
+             *      fund their own risk buckets from their own collateral. A copy-trading
+             *      sub-account's buckets belong to its follow and are refused.
+             */
+            marginAccountId?: string | null;
+        };
+        TransferCollateralToSubAccountRequest: {
+            /** @description The caller's sub-account that receives the collateral. */
+            marginAccountId?: string | null;
+            amount?: string | null;
         };
         TransferRewardsRequest: {
             /**
@@ -10147,21 +10676,21 @@ export interface components {
              */
             name?: string | null;
             /**
-             * @description Optional delegation expiry timestamp (ISO 8601). Ends delegated reads, trading, and session refresh. Omit for no delegation expiry; session expiry still applies.
+             * @description Delegation expiry timestamp (ISO 8601). Ends delegated reads, trading, and session refresh. Omit for the default of 14 days from now; at most 180 days ahead.
              * @example 2026-12-31T23:59:59Z
              */
             expiresAt?: string | null;
             /**
-             * @description Required JSON array of actions the agent may perform: CREATE_ORDER, CANCEL_ORDER, REPLACE_ORDER. An empty array permits no actions.
+             * @description Required JSON array of actions the agent may perform: CREATE_ORDER, CANCEL_ORDER, REPLACE_ORDER, READ, MANAGE_RISK_BUCKETS. Every delegated session may read the owner's data; a policy listing only READ, or no action, is a read-only key. MANAGE_RISK_BUCKETS lets the agent move a margin account's free collateral into that account's own risk buckets (POST /api/v1/margin/risk-buckets/collateral/transfer-in), only for an account listed in allowedMarginAccountIds and, if the policy lists markets, only into an isolated risk bucket on a listed market. No action lets an agent move collateral any other way. Any other value is rejected.
              * @example [
              *       "CREATE_ORDER",
              *       "CANCEL_ORDER"
              *     ]
              */
             allowedActions: string[];
-            /** @description Required JSON array of trading pair UUIDs. An order is allowed if its market or its margin account is permitted. Send [] for account-only scope; both scopes empty permit no orders. */
+            /** @description Required JSON array of trading pair UUIDs. Each listed scope must match: with markets and margin accounts both listed, an order needs a listed market AND a listed account. Send [] for account-only scope; both scopes empty permit no orders. */
             allowedTradingPairIds: string[];
-            /** @description Optional JSON array of additional margin account UUIDs. Omitted, null, or [] adds no account scope; it does not grant access to every account. An order is allowed if its market or its margin account is permitted. */
+            /** @description Optional JSON array of margin account UUIDs the agent is bound to. When listed, an order must be on one of these accounts (and on a listed market, if any are listed). Omitted, null, or [] leaves the account unrestricted; both scopes empty permit no orders. */
             allowedMarginAccountIds?: string[] | null;
             /**
              * @description Optional JSON array of permitted order types (LIMIT, MARKET). Omitted, null, or [] means unrestricted order types.
@@ -10192,6 +10721,13 @@ export interface components {
              * @description Unsupported legacy field. Requests that set maxOpenOrders are rejected; no concurrent open-order cap is enforced. Omit this field.
              */
             maxOpenOrders?: number | null;
+            /**
+             * @description Optional JSON array of up to 20 IP addresses or CIDR ranges the agent may create its delegated session from. Omitted, null, or [] allows any address.
+             * @example [
+             *       "203.0.113.0/24"
+             *     ]
+             */
+            ipAllowlist?: string[] | null;
         };
         UpsertFollowRequest: {
             /**
@@ -10414,10 +10950,26 @@ export interface operations {
     get_user_balances: {
         parameters: {
             query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the lowest token address.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      This listing has no database page to walk: it reads every balance row,
+                 *      overlays the matching engine's authoritative amounts (which can add rows
+                 *      the projection has not written yet and drop rows the engine has zeroed),
+                 *      and pages that in-memory set. The walk therefore seeks by KEY on
+                 *      `(token, asset_id)` — immutable, present on every row including a
+                 *      live-only one — rather than by index, so a balance that appears or
+                 *      vanishes mid-walk no longer shifts the rows behind it across the resume
+                 *      point and duplicate or skipped rows. `total` and `totalPages` are exact:
+                 *      the set is bounded by the asset universe, so there is nothing to cap.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -10529,10 +11081,28 @@ export interface operations {
                 tradingPairId?: string;
                 positionId?: string;
                 marginAccountId?: string;
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest payment.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      The walk seeks on `(created_at, id)` descending. Not `period_end`, which
+                 *      the removed page-number mode led its sort with: that column is nullable
+                 *      and the risk engine leaves it unset when a payment carries no window,
+                 *      while `created_at` is always stamped (it falls back to the settlement
+                 *      instant). The `id` tie-break is new — the removed order had none, so a
+                 *      page boundary inside one funding window could already repeat or drop a
+                 *      payment.
+                 *
+                 *      `total` and `totalPages` are populated — bounded by the server count
+                 *      ceiling, see `totalCapped`. Filters must match the request that produced
+                 *      the token, or the request is rejected 400.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -10808,7 +11378,19 @@ export interface operations {
     };
     get_portfolio_margin: {
         parameters: {
-            query?: never;
+            query?: {
+                /**
+                 * @description One of the caller's margin accounts (the default one or a sub-account) to
+                 *      describe instead of the default one: `total`, `positions` and
+                 *      `risk_buckets` are then that account's own.
+                 */
+                marginAccountId?: string;
+                /**
+                 * @description Also return `accounts`, one row per open margin account of the caller,
+                 *      and `owner_total`, their sum: the owner rollup across sub-accounts.
+                 */
+                includeAccounts?: boolean;
+            };
             header?: never;
             path?: never;
             cookie?: never;
@@ -11028,9 +11610,7 @@ export interface operations {
     get_user_movements: {
         parameters: {
             query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
                 /** @description Transaction type */
                 transactionType?: "DEPOSIT" | "WITHDRAWAL" | "TRADE" | "FEE" | "FUNDING" | "LIQUIDATION" | "INTEREST" | "REWARD" | "CHAIN_SYNC";
@@ -11040,6 +11620,19 @@ export interface operations {
                 assetId?: string;
                 /** @description Sort direction for createdAt */
                 orderBy?: "ASC" | "DESC";
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest row (or the oldest, when `orderBy` is ASC).
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      Every walk covers the ledger and funding arms merged. `total` and
+                 *      `totalPages` are populated — bounded by the server count ceiling, see
+                 *      `totalCapped`. Filters and `orderBy` must match the request that produced
+                 *      the token, or the request is rejected 400.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -11170,6 +11763,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Settings write rate limit exceeded — the lead trader profile, follow create/edit and self-trade-prevention default share a per-account budget (and the budget the account family shares); retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Internal server error */
             500: {
                 headers: {
@@ -11499,7 +12099,7 @@ export interface operations {
                  *       - Omitted or empty string (""): start a cursor walk with no prior
                  *         position, from the newest row.
                  *       - Non-empty: an opaque cursor from a previous response's
-                 *         `next_page_token`; results resume immediately after that position.
+                 *         `nextPageToken`; results resume immediately after that position.
                  *
                  *      Every walk covers full trade history — hot and archived rows merged. The
                  *      response carries no item count: this listing's table is too large to count
@@ -11554,15 +12154,34 @@ export interface operations {
     };
     list_application_balances: {
         parameters: {
-            query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+            query: {
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
                 /** @description User identifier (UUID) */
                 userId?: string;
                 /** @description Asset identifier (UUID) */
                 assetId?: string;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      Ordered by balance id ascending. NOT by `updated_at`, which the removed
+                 *      offset mode sorted on: that column changes on every balance movement, so
+                 *      a walk over it could repeat or skip rows with no concurrent insert at
+                 *      all.
+                 *
+                 *      `total` and `totalPages` are populated — bounded by the server count
+                 *      ceiling, see `totalCapped`.
+                 *
+                 *      Filters must match the request that produced the token, or the request
+                 *      is rejected 400.
+                 */
+                pageToken?: string;
+                /** @description Application client ID */
+                clientId: string;
             };
             header?: never;
             path?: never;
@@ -11579,22 +12198,29 @@ export interface operations {
                     "application/json": components["schemas"]["ListAppBalancesResponse"];
                 };
             };
-            /** @description Bad request */
+            /** @description Bad request (missing client_id, invalid filter or page token) */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Unauthorized - Invalid or missing x-server-key */
-            401: {
+            /** @description No active application has this client_id */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Internal server error */
-            500: {
+            /** @description Public read rate limit exceeded for this client IP; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -11659,10 +12285,8 @@ export interface operations {
     };
     list_application_movements: {
         parameters: {
-            query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+            query: {
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
                 /** @description User identifier (UUID) */
                 userId?: string;
@@ -11672,6 +12296,23 @@ export interface operations {
                 entryType?: "CREDIT" | "DEBIT" | "LOCK" | "UNLOCK" | "FEE";
                 /** @description Asset identifier (UUID) */
                 assetId?: string;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest movement.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      The response carries no item count: `user_ledger` is too large to count
+                 *      behind a filter. A movement with no recorded timestamp is not listed —
+                 *      the column is nullable, and a NULL has no position in the sort key.
+                 *
+                 *      Filters must match the request that produced the token, or the request
+                 *      is rejected 400.
+                 */
+                pageToken?: string;
+                /** @description Application client ID */
+                clientId: string;
             };
             header?: never;
             path?: never;
@@ -11688,15 +12329,22 @@ export interface operations {
                     "application/json": components["schemas"]["ListAppMovementsResponse"];
                 };
             };
-            /** @description Bad request */
+            /** @description Bad request (missing client_id, invalid filter or page token) */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Unauthorized - Invalid or missing x-server-key */
-            401: {
+            /** @description No active application has this client_id */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Public read rate limit exceeded for this client IP; retry after the interval in details.retryAfter */
+            429: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -11713,10 +12361,8 @@ export interface operations {
     };
     list_application_orders: {
         parameters: {
-            query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+            query: {
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
                 /** @description Order status (single value or comma-separated list) */
                 status?: string;
@@ -11728,6 +12374,23 @@ export interface operations {
                 side?: "BUY" | "SELL";
                 /** @description Order type */
                 orderType?: "LIMIT" | "MARKET" | "STOP_LOSS" | "TAKE_PROFIT" | "STOP_LIMIT" | "TRAILING_STOP";
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      Every walk covers full order history — hot and archived rows merged.
+                 *      The response carries no item count: `orders_all` is too large to count
+                 *      behind a filter.
+                 *
+                 *      Filters must match the request that produced the token, or the request
+                 *      is rejected 400.
+                 */
+                pageToken?: string;
+                /** @description Application client ID */
+                clientId: string;
             };
             header?: never;
             path?: never;
@@ -11744,15 +12407,22 @@ export interface operations {
                     "application/json": components["schemas"]["ListAppOrdersResponse"];
                 };
             };
-            /** @description Bad request */
+            /** @description Bad request (missing client_id, invalid filter or page token) */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Unauthorized - Invalid or missing x-server-key */
-            401: {
+            /** @description No active application has this client_id */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Public read rate limit exceeded for this client IP; retry after the interval in details.retryAfter */
+            429: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -11769,8 +12439,10 @@ export interface operations {
     };
     get_application_stats: {
         parameters: {
-            query?: {
+            query: {
                 since?: string;
+                /** @description Application client ID */
+                clientId: string;
             };
             header?: never;
             path?: never;
@@ -11787,15 +12459,22 @@ export interface operations {
                     "application/json": components["schemas"]["GetAppStatsResponse"];
                 };
             };
-            /** @description Bad request */
+            /** @description Bad request (missing client_id, invalid filter or page token) */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Unauthorized - Invalid or missing x-server-key */
-            401: {
+            /** @description No active application has this client_id */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Public read rate limit exceeded for this client IP; retry after the interval in details.retryAfter */
+            429: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -11813,15 +12492,34 @@ export interface operations {
     list_application_users: {
         parameters: {
             query: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
                 isActive?: boolean;
                 /** @description Account type filter */
                 accountType?: "master" | "sub";
                 /** @description Wallet address */
                 address: string;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      Ordered by user id ascending, NOT newest-first: `users.created_at` is
+                 *      nullable, so it cannot be a total keyset key, and excluding the rows
+                 *      without one would hide users from the listing an application
+                 *      reconciles against.
+                 *
+                 *      `total` and `totalPages` are populated — bounded by the server count
+                 *      ceiling, see `totalCapped`.
+                 *
+                 *      Filters must match the request that produced the token, or the request
+                 *      is rejected 400.
+                 */
+                pageToken?: string;
+                /** @description Application client ID */
+                clientId: string;
             };
             header?: never;
             path?: never;
@@ -11838,15 +12536,22 @@ export interface operations {
                     "application/json": components["schemas"]["ListAppUsersResponse"];
                 };
             };
-            /** @description Bad request */
+            /** @description Bad request (missing client_id, invalid filter or page token) */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            /** @description Unauthorized - Invalid or missing x-server-key */
-            401: {
+            /** @description No active application has this client_id */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Public read rate limit exceeded for this client IP; retry after the interval in details.retryAfter */
+            429: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -12126,7 +12831,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            /** @description Refused: neither the revenue share nor builder fees are switched on, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -12196,7 +12901,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            /** @description Refused: the caller is delegated or is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -12244,7 +12949,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            /** @description Refused: the caller is delegated or is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -12270,11 +12975,49 @@ export interface operations {
     list_buildercode_payouts: {
         parameters: {
             query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
-                /** @description Only return BuilderCodes payouts of this payout kind: REVENUE_SHARE (the frontend's share of Monaco's fee) or BUILDER_FEE (reserved and not currently emitted). Omit for every kind. */
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest credit.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `next_page_token`; results resume immediately after that position.
+                 *
+                 *      The walk seeks on `(created_at, id)` descending, served by
+                 *      `idx_buildercode_payouts_application_created_id`, whose leading key is the
+                 *      caller's own application and whose remaining keys are this seek's, both
+                 *      descending. Both key columns are NOT NULL and fixed for a credit's
+                 *      lifetime. (Spelled without the column list on purpose: the read contract
+                 *      test asserts this request message never mentions a caller-selected
+                 *      identity.)
+                 *
+                 *      This REPLACES the removed mode's `(sequence, sequence_ordinal, created_at,
+                 *      id)` order, whose two leading columns are nullable — no backfill exists
+                 *      for credits written before they did — and a nullable leading key cannot be
+                 *      a total cursor key: the NULL rows sort together at one end, and a seek
+                 *      through them would need a COALESCE no index covers.
+                 *
+                 *      ORDERING CHANGE, not just a pagination change. The new key is total and
+                 *      stable — a page can neither skip nor duplicate a credit — but it is NOT
+                 *      chronological inside one persistor batch. `created_at` defaults to `NOW()`,
+                 *      which is transaction-start time, so every credit one batch writes shares an
+                 *      identical timestamp; the `id` tie-break defaults to `gen_random_uuid()`,
+                 *      which the persistor leaves alone. So within a batch the order is arbitrary
+                 *      and a LATER fill can be listed ahead of an earlier one. The removed order
+                 *      led with `sequence` and `sequence_ordinal` precisely because those carry
+                 *      the engine's fill order, and one entry routinely holds several credits (a
+                 *      taker sweeping N makers, or a flattened `BatchCreateOrders`). Preserving
+                 *      fill chronology would need those columns backfilled first, which is not
+                 *      possible for credits written before they existed. Across batches the order
+                 *      is still newest-first.
+                 *
+                 *      `total` and `total_pages` are populated and exact, and count the rows the
+                 *      `kind` filter selects. Filters must match the request that produced the
+                 *      token, or the request is rejected 400.
+                 */
+                pageToken?: string;
+                /** @description Only return BuilderCodes payouts of this payout kind: REVENUE_SHARE (the frontend's share of Monaco's fee) or BUILDER_FEE (ordinary builder fees charged to takers and credited to enrolled applications). Omit for every kind. */
                 kind?: "REVENUE_SHARE" | "BUILDER_FEE";
             };
             header?: never;
@@ -12306,7 +13049,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            /** @description Refused: the caller is delegated or is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -12354,7 +13097,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            /** @description Refused: the caller is delegated or is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -12402,7 +13145,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Refused: BuilderCodes is disabled or the caller is delegated (gRPC: PERMISSION_DENIED) */
+            /** @description Refused: the caller is delegated (gRPC: PERMISSION_DENIED) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -12454,7 +13197,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Refused: BuilderCodes is not enabled, or the caller is a delegated-agent session (gRPC: PERMISSION_DENIED) */
+            /** @description Refused: the caller is a delegated-agent session (gRPC: PERMISSION_DENIED) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -12468,6 +13211,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Movement rate limit exceeded — withdrawals, collateral transfers and reward transfers share a per-user budget; refused before the claim reaches the sequencer, so nothing committed; retry after the interval in details.retryAfter (gRPC: RESOURCE_EXHAUSTED) */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Internal server error */
             500: {
                 headers: {
@@ -12597,6 +13347,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Settings write rate limit exceeded — the lead trader profile, follow create/edit and self-trade-prevention default share a per-account budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Internal server error */
             500: {
                 headers: {
@@ -12992,7 +13749,7 @@ export interface operations {
                     "application/json": components["schemas"]["AddFollowPositionMarginResponse"];
                 };
             };
-            /** @description Invalid follow id, trading pair or amount, or refused by the engine with code COPY_TRADING_REJECTED (no copy position on the pair, the position or the margin account is being liquidated, the position has lost more than its margin, more than the copy account holds; the message names the rule) */
+            /** @description Invalid follow id, trading pair or amount, or refused with code COPY_TRADING_REJECTED (no isolated copy position on the pair, the copy position is being liquidated or is in bad debt, or more than the copy account can put in; the message names the rule) */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -13020,7 +13777,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description The follow is stopping or stopped, or code COPY_TRADING_UNAVAILABLE: copy trading is not available on the platform */
+            /** @description The follow is stopping or stopped */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -13098,6 +13855,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Follow stop rate limit exceeded; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Internal server error */
             500: {
                 headers: {
@@ -13258,6 +14022,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Settings write rate limit exceeded — the lead trader profile, follow create/edit and self-trade-prevention default share a per-account budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Internal server error */
             500: {
                 headers: {
@@ -13974,10 +14745,24 @@ export interface operations {
     list_managed_market_assignments: {
         parameters: {
             query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the oldest assignment.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `next_page_token`; results resume immediately after that position.
+                 *
+                 *      The walk seeks on `(created_at, id)` ascending — the order this listing
+                 *      already read in, and the order
+                 *      `idx_market_launch_maker_inventory (maker_user_id, maker_application_id,
+                 *      created_at, id)` is built for, so the seek stays an index scan. Both
+                 *      columns are NOT NULL and fixed for a launch's lifetime. `total` is
+                 *      populated and exact: a maker's assignment inventory is a small bounded
+                 *      set.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -14072,13 +14857,43 @@ export interface operations {
     list_margin_accounts: {
         parameters: {
             query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Keep only risk-bucket rows in this state (see `risk_bucket_state`). A
+                 *      parent margin account row has no state, so any filter excludes it.
+                 */
                 state?: string;
                 /** @description Trading pair identifier (UUID) */
                 tradingPairId?: string;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the lowest margin account id.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      This listing has no database page to walk: one row is a margin account
+                 *      and one row is a risk bucket, each repriced against live marks and the
+                 *      engine's bounds, so the set is built in memory and paged there. The walk
+                 *      seeks by KEY on
+                 *      `(margin_account_id, trading_pair_id, risk_bucket_id, strategy_key)` —
+                 *      every component immutable for the row's lifetime, the parent row sorting
+                 *      ahead of its buckets — rather than by index, so a bucket that opens or
+                 *      closes mid-walk no longer shifts the rows behind it across the resume
+                 *      point. The strategy key is part of the key because an auto bucket the
+                 *      engine has not materialized yet carries no `risk_bucket_id`, and one
+                 *      account and pair can hold several strategies; such a row sorts under the
+                 *      id its bucket will carry once the engine projects it, derived from the
+                 *      account and pair, so provisioning completing mid-walk cannot move the row
+                 *      across the resume point and serve the same risk bucket twice. `total` is
+                 *      exact: a user's accounts and buckets are a small bounded set, counted in
+                 *      memory.
+                 *
+                 *      Filters must match the request that produced the token, or the request is
+                 *      rejected 400.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -14218,10 +15033,21 @@ export interface operations {
         parameters: {
             query?: {
                 movementType?: string;
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest movement — this listing always sorts
+                 *         newest-first.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      The response carries no item count: the underlying ledger is too large to
+                 *      count behind a filter. `movementType` must match the request that produced
+                 *      the token, or the request is rejected 400.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path: {
@@ -14253,6 +15079,39 @@ export interface operations {
             };
         };
     };
+    get_margin_account_pnl: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /**
+                 * @description One of the caller's margin accounts: the default one or a sub-account.
+                 * @example 2b1a5f9c-0000-4000-8000-000000000001
+                 */
+                marginAccountId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GetMarginAccountPnlResponse"];
+                };
+            };
+            /** @description Read rate limit exceeded — every authenticated read draws one request from the account's read budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     simulate_order_risk: {
         parameters: {
             query?: never;
@@ -14319,6 +15178,37 @@ export interface operations {
             };
         };
     };
+    transfer_collateral: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TransferCollateralRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TransferCollateralResponse"];
+                };
+            };
+            /** @description Movement rate limit exceeded — withdrawals and collateral transfers share a per-user budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     get_parent_margin_account_summary: {
         parameters: {
             query?: {
@@ -14415,10 +15305,13 @@ export interface operations {
         parameters: {
             query?: {
                 movementType?: string;
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description See `GetMarginAccountMovementsRequest.page_token`: the same cursor walk,
+                 *      scoped to the caller's parent margin account.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -14537,6 +15430,145 @@ export interface operations {
             };
         };
     };
+    create_sub_account: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSubAccountRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CreateSubAccountResponse"];
+                };
+            };
+            /** @description Movement rate limit exceeded — withdrawals and collateral transfers share a per-user budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    close_sub_account: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @example 2b1a5f9c-0000-4000-8000-000000000001 */
+                marginAccountId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CloseSubAccountRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CloseSubAccountResponse"];
+                };
+            };
+            /** @description Movement rate limit exceeded — withdrawals and collateral transfers share a per-user budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    transfer_collateral_to_sub_account: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /**
+                 * @description The caller's sub-account that receives the collateral.
+                 * @example 2b1a5f9c-0000-4000-8000-000000000001
+                 */
+                marginAccountId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TransferCollateralToSubAccountRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TransferCollateralResponse"];
+                };
+            };
+            /** @description Movement rate limit exceeded — withdrawals and collateral transfers share a per-user budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    transfer_collateral_from_sub_account: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /**
+                 * @description The caller's sub-account the collateral leaves.
+                 * @example 2b1a5f9c-0000-4000-8000-000000000001
+                 */
+                marginAccountId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TransferCollateralFromSubAccountRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TransferCollateralResponse"];
+                };
+            };
+            /** @description Movement rate limit exceeded — withdrawals and collateral transfers share a per-user budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     list_all_funding_history: {
         parameters: {
             query?: {
@@ -14544,12 +15576,30 @@ export interface operations {
                 startTime?: number;
                 /** @description End time as Unix timestamp (milliseconds) */
                 endTime?: number;
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
                 /** @description Sort direction for settledAt */
                 orderBy?: "ASC" | "DESC";
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest settlement (the oldest when `orderBy` is
+                 *         ASC).
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      The walk seeks on `(settled_at, id)` in the requested direction.
+                 *      `settled_at` is NOT NULL and never changes once a window settles, and the
+                 *      `id` tie-break makes the key total — the removed page-number mode ordered
+                 *      by `(settled_at, trading_pair_id, epoch)` with no tie-break, so a page
+                 *      boundary between two settlements sharing that triple could repeat or drop
+                 *      a row.
+                 *
+                 *      `total` is populated — bounded by the server count ceiling, see
+                 *      `totalCapped`. Filters and `orderBy` must match the request that produced
+                 *      the token, or the request is rejected 400.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -14735,12 +15785,29 @@ export interface operations {
                 startTime?: number;
                 /** @description End time as Unix timestamp (milliseconds) */
                 endTime?: number;
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
-                /** @description Sort direction for createdAt */
+                /** @description Sort direction for settledAt */
                 orderBy?: "ASC" | "DESC";
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest settlement (the oldest when `orderBy` is
+                 *         ASC).
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      The walk seeks on `(settled_at, id)` in the requested direction.
+                 *      `settled_at` is NOT NULL and never changes once a window settles, and the
+                 *      `id` tie-break makes the key total — the removed page-number mode ordered
+                 *      by `epoch` with no tie-break, so a page boundary between two
+                 *      settlements sharing it could repeat or drop a row.
+                 *
+                 *      `total` is populated — bounded by the server count ceiling, see
+                 *      `totalCapped`. Filters and `orderBy` must match the request that produced
+                 *      the token, or the request is rejected 400.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path: {
@@ -16308,7 +17375,15 @@ export interface operations {
     };
     get_my_referral_downline: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description `earningsBySource` rows per page (max 500) */
+                pageSize?: number;
+                /**
+                 * @description Opaque cursor from a previous response's `nextPageToken`; omit or send an
+                 *      empty string for the first page.
+                 */
+                pageToken?: string;
+            };
             header?: never;
             path?: never;
             cookie?: never;
@@ -16347,6 +17422,70 @@ export interface operations {
             };
         };
     };
+    get_my_referral_tree: {
+        parameters: {
+            query?: {
+                parent?: string;
+                /** @description Nodes per page (max 200) */
+                pageSize?: number;
+                /**
+                 * @description Opaque cursor from a previous response's `nextPageToken`; omit or send an
+                 *      empty string for the first page. Only valid with the same `parent`.
+                 */
+                pageToken?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GetMyReferralTreeResponse"];
+                };
+            };
+            /** @description Invalid `parent` wallet address, `pageSize`, or `pageToken` */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `parent` is not the caller or one of the caller's own expandable referees */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Read rate limit exceeded — every authenticated read draws one request from the account's read budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     get_rewards_balance: {
         parameters: {
             query?: never;
@@ -16431,6 +17570,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Movement rate limit exceeded — withdrawals, collateral transfers and reward transfers share a per-user budget; retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Internal server error */
             500: {
                 headers: {
@@ -16449,10 +17595,53 @@ export interface operations {
                 tradingPairId?: string;
                 /** @description Order status (single value or comma-separated list) */
                 status?: string;
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      ORDER DEPENDS ON THE FILTER, because the two cases are served from
+                 *      different places:
+                 *
+                 *       - `status=OPEN` is answered from the matching engine's live view, which
+                 *         carries no timestamps for a position the persistor has not written
+                 *         yet. It is ordered by `(marginAccountId, tradingPairId, positionId)`
+                 *         ascending — stable and total, but UUID order, NOT newest-first.
+                 *       - Every other filter reads persisted rows, ordered by the IMMUTABLE
+                 *         `(opened_at, id)` descending: newest-opened first. The removed
+                 *         page-number mode sorted on `COALESCE(closed_at, last_funding_at,
+                 *         opened_at)`, which *advances* whenever a position takes a funding
+                 *         payment or closes, so rows moved across a resume point mid-walk;
+                 *         `opened_at` never changes after the insert. Order therefore differs
+                 *         from the removed mode's. One exception: an operator correction may
+                 *         move an OPEN position's `opened_at` EARLIER, never later, to its
+                 *         opening fill. A walk in flight while that runs can return such a
+                 *         position a second time, but cannot skip one: dedupe on `positionId`.
+                 *
+                 *      Those are two separate cursor spaces, so a token is only valid in the one
+                 *      that minted it, and crossing between them is ASYMMETRIC:
+                 *
+                 *       - A PERSISTED token offered to `status=OPEN` while the engine is
+                 *         reachable is served: the live branch does not recognise it, declines,
+                 *         and the persisted walk answers. That is what keeps a walk going which
+                 *         started on persisted rows because the engine was down at the time and
+                 *         has since come back.
+                 *       - A LIVE token offered after the engine becomes unreachable is NOT
+                 *         served. The live branch cannot answer at all, and the persisted
+                 *         decoder rejects the `src=live` token, so the request is a 400 and the
+                 *         walk has to start over. There is no way to carry a live position into
+                 *         the persisted ordering: the two relations do not share a sort key, and
+                 *         resuming at a key from the wrong one would skip or repeat rows
+                 *         silently, which is worse than the restart.
+                 *
+                 *      A token neither relation recognises is rejected 400, and so is one minted
+                 *      under different filters.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -16500,6 +17689,13 @@ export interface operations {
                     "application/json": components["schemas"]["BatchCloseAllResponse"];
                 };
             };
+            /** @description Order rate limit exceeded — each call draws one item per open position it closes (at least 1) from the per-account risk-reduction budget it shares with cancels (and the budget the account family shares). Returned when the first 100 closes do not fit; positions past 100 that do not fit are reported per position as RATE_LIMIT_EXCEEDED instead. Retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     list_position_history: {
@@ -16509,12 +17705,24 @@ export interface operations {
                 marginAccountId?: string;
                 /** @description Trading pair identifier (UUID) */
                 tradingPairId?: string;
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
                 /** @description When true, return only DECREASE, CLOSE, and LIQUIDATE execution rows. */
                 reductionOnly?: boolean;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest event — this listing always sorts
+                 *         newest-first.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `nextPageToken`; results resume immediately after that position.
+                 *
+                 *      Every walk covers full position history — hot and archived rows merged.
+                 *      The response carries no item count: this listing's relation is too large
+                 *      to count behind a filter. Filters must match the request that produced the
+                 *      token, or the request is rejected 400.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;
@@ -16595,6 +17803,13 @@ export interface operations {
                     "application/json": components["schemas"]["ClosePositionResponse"];
                 };
             };
+            /** @description Order rate limit exceeded — each close draws one item from the per-account risk-reduction budget it shares with cancels (and the budget the account family shares); retry after the interval in details.retryAfter */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     get_position_pnl_history: {
@@ -16900,10 +18115,24 @@ export interface operations {
     get_trades: {
         parameters: {
             query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Max trades to return (max 100) */
+                /** @description Max trades to return (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the most recent trade (this listing always sorts
+                 *         newest-first).
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `next_page_token`; results resume immediately after that position.
+                 *
+                 *      The walk is a keyset seek on `(executed_at, id)`, both immutable once a
+                 *      trade is written, so a page can neither repeat nor skip a trade when new
+                 *      fills land mid-walk — the failure the removed page number had by
+                 *      construction on a table this endpoint appends to continuously.
+                 *      `trading_pair_id` is pinned inside the token, so a token minted for one
+                 *      pair is rejected rather than seeking into another pair's history.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path: {
@@ -16994,10 +18223,24 @@ export interface operations {
     list_pending_withdrawals: {
         parameters: {
             query?: {
-                /** @description Page number (1-indexed) */
-                page?: number;
-                /** @description Items per page (max 100) */
+                /** @description Items per page (max 1000) */
                 pageSize?: number;
+                /**
+                 * @description Pagination cursor with two states:
+                 *       - Omitted or empty string (""): start a cursor walk with no prior
+                 *         position, from the newest pending withdrawal.
+                 *       - Non-empty: an opaque cursor from a previous response's
+                 *         `next_page_token`; results resume immediately after that position.
+                 *
+                 *      The walk seeks on `(created_at, withdrawal_index)` descending — the order
+                 *      this listing already read in, served by
+                 *      `idx_withdrawals_user_created (user_id, created_at DESC)`. `created_at` is
+                 *      NOT NULL and `withdrawal_index` is the table's primary key, assigned by
+                 *      the vault in request order, so the key is total and immutable. `total` is
+                 *      populated and exact: a user's unexecuted withdrawals are a small bounded
+                 *      set.
+                 */
+                pageToken?: string;
             };
             header?: never;
             path?: never;