Indexer API

The Go service continuously ingests recognized Trust Stack events into PostgreSQL and exposes bounded read endpoints. It is a discovery and integration layer, not a transaction signer.

Public reads

The public surface includes health/readiness, operation discovery, token-lock and vesting reads, and product-specific indexed collections used by the dApp and marketing proof pages.

Representative operations endpoints:

GET /v1/operations
GET /v1/operations/{eventHash}

List endpoints enforce bounded limits, deterministic ordering, validated filters, and pagination. Treat response schemas as versioned contracts; the canonical OpenAPI document lives at apps/indexer-api/api/openapi.yaml.

Ingestion checks

• configured chain ID must match the Supra response header;
• only exact registered package/module/event types are accepted;
• unknown fields and malformed values fail strict parsing;
• addresses and unsigned integers are canonicalized;
• the event hash is cross-checked against its emission proof;
• database writes are idempotent.

Partner APIs

Authenticated partners may create idempotent operation intents and manage a bounded set of webhook destinations. API credentials and encrypted signing secrets are server-side only. Reusing an idempotency key with different semantics returns a conflict rather than silently changing the request.

Webhook delivery

Deliveries are durable and at least once. Each destination receives an event-hash idempotency key, timestamp, and HMAC-SHA256 signature. Retries are capped. Redirects, proxy environment variables, private networks, loopback, link-local, carrier-grade NAT, documentation ranges, and DNS rebinding targets are rejected.

Consumers must verify the signature, enforce a timestamp window, and deduplicate by event hash.