Kalshi: 27 reads, 6 writes and 2 destructive calls, one client

CFTC-regulated event contracts — search markets, read order books, and place, cancel and track real orders. Every call below is available over HTTP, through the SDK and as a tool for a coding agent, with the same arguments and the same meter.

What Kalshi can do here

The integration exposes 27 reads, 6 writes and 2 destructive calls, each with a declared input and output schema rather than a page of documentation you would have to translate. CFTC-regulated event contracts — search markets, read order books, and place, cancel and track real orders.

How it authenticates

Kalshi authenticates with a privateKey, supplied per request or stored once against your account and sealed at rest. On our side the same value is read from apiKeyId and privateKey when we broker the call for you.

Capabilities it fulfils

Kalshi answers prediction.market.get and prediction.market.search in the vendor-neutral form, which means code asking for any of those can be pointed at Kalshi without naming it. If it goes down, or you would rather use somebody else, that is a preference change and not a rewrite.

• getExchangeStatus — read: Whether the exchange and trading are open. The connection test — public and free.
• getExchangeSchedule — read: Trading hours and planned maintenance windows. Public and free.
• getUserDataTimestamp — read: How current the exchange's user-facing data is. Public and free.
• listMarkets — read: Search and filter markets. Public and free — the main discovery call.
• getMarket — read: One market by ticker. Public and free.
• getOrderbook — read: The live order book for one market. Public and free.
• listEvents — read: Events — groups of related markets. Public and free.
• getEvent — read: One event with its markets. Public and free.
• getEventMetadata — read: Presentation metadata for an event — images, colours and settlement sources. Public and free.
• listSeries — read: Series — the recurring templates events are minted from. Public and free.
• getSeries — read: One series and its rules. Public and free.
• listTrades — read: Public executions across markets — the tape. Public and free.
• getCandlesticks — read: OHLC price history for one market. Public and free.
• listStructuredTargets — read: The real-world entities markets are written about — people, teams, companies, films. Public and free.
• getStructuredTarget — read: One structured target by id. Public and free.
• listMilestones — read: Scheduled real-world events markets resolve against — elections, earnings, fixtures. Public and free.
• getMilestone — read: One milestone by id. Public and free.
• listMultivariateCollections — read: The parlay templates combo markets are minted from — the machinery behind the KXMVE* tickers that dominate the market list. Public and free.
• getMultivariateCollection — read: One combo collection and its rules. Public and free.
• lookupMultivariateTickers — write: Resolve a set of legs to the combo market ticker that represents them. NEEDS A KEY.
• createMultivariateMarket — write: 🔴 MINTS A NEW COMBO MARKET on the exchange. NEEDS A KEY. Not a trade in itself, but it creates a tradeable instrument that did not exist — do not call it exploratively.
• getBalance — read: Your account balance. NEEDS A KEY — signed with the RSA-PSS scheme.
• listPositions — read: Your open positions. NEEDS A KEY.
• listOrders — read: Your orders. NEEDS A KEY.

Questions

Do I have to bring my own API keys?

You can, and that lane is free for ever — pass your key on the request or store it against your account, and we are one proxy hop. The paid lane is the other direction: we call 226 providers with our credentials so you never register anywhere. Both go through the same client and the same operation names.

What happens to a key I store here?

It is sealed with AES-256-GCM before it reaches the database and is only ever opened to make the call you asked for. It is scoped to your account, it is never logged, and deleting the connection deletes it. For an OAuth provider we hold a refresh token instead, and revoking the link at the provider stops the calls here immediately.

What happens when a provider changes its API?

The operation contract is declared, so a response that no longer matches is a refusal rather than a silently wrong answer. The contract does not coerce types — a field declared a number that arrives as a string is rejected at the edge, on the way in and on the way out.