Polymarket: 14 reads, 3 writes and 2 destructive calls, one client

On-chain prediction markets — live order books, pricing, tick sizes and price history. Every call below is available over HTTP, through the SDK and as a tool for a coding agent, with the same arguments and the same meter.

What Polymarket can do here

The integration exposes 14 reads, 3 writes and 2 destructive calls, each with a declared input and output schema rather than a page of documentation you would have to translate. On-chain prediction markets — live order books, pricing, tick sizes and price history.

How it authenticates

Polymarket authenticates with a clobApiKey, clobSecret and a clobPassphrase, supplied per request or stored once against your account and sealed at rest. On our side the same value is read from clobApiKey, clobPassphrase, clobSecret and walletAddress when we broker the call for you.

Called by name, not by capability

Polymarket does not currently map onto a vendor-neutral capability, so you call its operations by name. That is the right shape when you genuinely mean this provider — which, for a service with its own model of the world, is most of the time.

• getOk — read: Liveness check. The connection test — public, free and touches no account.
• listMarkets — read: Every CLOB market, paged. Public and free.
• listSimplifiedMarkets — read: Every market in a trimmed shape. Public and free — the cheap way to sync a full market list.
• listSamplingMarkets — read: Only markets that pay liquidity rewards. Public and free — the market-maker's shortlist.
• getMarket — read: One CLOB market by condition id. Public and free.
• getBook — read: The live order book for one outcome token. Public and free.
• getBooks — write: Order books for several tokens in one call. Public and free — the right way to watch a basket.
• getMidpoint — read: The midpoint price for one token. Public and free.
• getPrice — read: The best executable price on one side. Public and free.
• getSpread — read: The bid-ask spread for one token. Public and free.
• getTickSize — read: The minimum price increment for one token. Public and free.
• getNegRisk — read: Whether a token belongs to a mutually-exclusive group. Public and free.
• getPricesHistory — read: Historical price series for one token. Public and free.
• getTradeHistory — read: Your executed trades. NEEDS L2 CREDENTIALS — signed with the HMAC scheme.
• getOpenOrders — read: Your resting orders. NEEDS L2 CREDENTIALS.
• createApiKey — write: 🔴 CANNOT RUN FROM THIS CONNECTOR. Mints the L2 credentials every authenticated operation needs — but it is authorised by an EIP-712 signature from the trading wallet, which this engine cannot produce (see the file header). Declared so the gap is visible rather than looking like a missing feature. Mint the key with Polymarket's own client, then paste the three values into this connection.
• createOrder — write: 🔴 DECLARED BUT NOT CALLABLE FROM THIS ENGINE, AND IT SPENDS REAL MONEY WHERE IT IS. A Polymarket order carries an EIP-712 signature over the order struct, made with the trading wallet's private key — secp256k1 over a keccak256 typed-data hash. This repo has no Ethereum signing library, and hand-rolling secp256k1 to move funds would be indefensible. The HMAC scheme signs the REQUEST, not the ORDER, so this returns 401. It is here so the gap is documented rather than discovered; Kalshi's trading path is complete and does work.
• cancelOrder — destructive: Cancel one resting order. NEEDS L2 CREDENTIALS. Cancels only what has not yet matched.
• cancelAllOrders — destructive: 🔴 CANCELS EVERY RESTING ORDER ACROSS EVERY MARKET. NEEDS L2 CREDENTIALS. There is no filter and no undo — the panic button, not a cleanup tool.

Questions

Do I have to bring my own API keys?

You can, and that lane is free for ever — pass your key on the request or store it against your account, and we are one proxy hop. The paid lane is the other direction: we call 226 providers with our credentials so you never register anywhere. Both go through the same client and the same operation names.

What happens to a key I store here?

It is sealed with AES-256-GCM before it reaches the database and is only ever opened to make the call you asked for. It is scoped to your account, it is never logged, and deleting the connection deletes it. For an OAuth provider we hold a refresh token instead, and revoking the link at the provider stops the calls here immediately.

What happens when a provider changes its API?

The operation contract is declared, so a response that no longer matches is a refusal rather than a silently wrong answer. The contract does not coerce types — a field declared a number that arrives as a string is rejected at the edge, on the way in and on the way out.