Protocol API &Intelligence Layer
Read-only REST API exposing real-time protocol state, vault positions, oracle state, pillar verdicts, and cryptographically hashed audit packages. Served from Arbitrum Sepolia. No authentication. No rate limiting beyond standard Vercel edge caching.
What this surface represents
This API exposes three distinct layers of protocol intelligence. Each layer has a different source of truth, a different trust model, and is suited to a different class of integration.
Real-time protocol state fetched from Arbitrum Sepolia on each cache miss. Block height, ETH/USD price, collateral ratio, oracle state, pillar verdicts, and the aggregated overall verdict.
Source of truth: live RPC call to deployed contracts.
Freshness: 30s cache · stale-while-revalidate 60s.
Use for: dashboards, monitors, alerting, keeper gating.
Per-vault collateral ratio and liquidation status computed server-side from raw chain data. Avoids oracle revert by not calling isLiquidatable() directly. Status classification is deterministic.
Source of truth: on-chain multicall + server-side computation.
Freshness: 30s cache · stale-while-revalidate 60s.
Use for: liquidation keepers, risk dashboards, position monitoring.
AUD_001 audit packages generated hourly by the NEXUS-120 Engine. Each package contains a complete protocol state snapshot, pillar verdicts, and a SHA-256 hash committed to a public GitHub repository.
Source of truth: NEXUS-120 Engine → public GitHub repo.
Freshness: 60s cache · packages generated hourly.
Use for: audit verification, compliance, historical analysis.
Reading overall_verdict
Every endpoint returns overall_verdict. Treat it as an operational signal with specific behavioral implications, not a simple health indicator. WARN is degraded — it is not insolvent. FAIL requires action. For full operational interpretation, see the Protocol Intelligence Layer →
All solvency conditions met. SOV_001 and SOV_003 passing. Oracle live. Protocol within defined safety parameters.
Integrations may proceed. No conditions require inspection.
SOV_001 passing. SOV_003 failing. Causes: oracle stale, CR approaching threshold, or testnet environment constraints. Protocol is not insolvent.
Inspect sov_003_fail_count to distinguish economic from environmental failures before restricting behavior.
SOV_001 failing. Primary solvency invariant breached — CR below 100%, vault paused under distress, or structural failure.
Integrations that depend on protocol solvency must halt or restrict behavior until PASS is restored.
The verdict is deterministically derived from three pillars. Aggregation: SOV_001 FAIL → FAIL · SOV_003 FAIL (SOV_001 passing) → WARN · all passing → PASS. SOV_005 does not affect overall_verdict.
economic, structural, or testnet_env — only economic failures carry real risk significance./api/receipts.Three read surfaces
All routes are served from the NEXUS site Vercel edge. Responses include standard Cache-Control headers — inspect the Age and Date headers to determine actual data freshness. Fetch server-side to avoid stale browser caches.
- Live dashboards displaying protocol health to users or operators.
- Monitoring systems that need a single endpoint for overall protocol state.
- Health check probes — poll overall_verdict and alert on FAIL.
- Any integration that must gate behavior on solvency state — check SOV_001 pass directly.
- oracle_stale: true means OracleModule.getPrice() reverted. Price is sourced from OracleModule.feed() via latestRoundData(). oracle_feed_address identifies the exact contract. CR is still valid — the fallback price is on-chain — but on-chain operations that call OracleModule will revert.
- price_source is "oracle" or "chainlink_fallback". When fallback is active, the underlying feed (oracle_feed_address) may itself return a stale price if it is not being updated — this is a deployment condition, not a code bug.
- Overall verdict WARN on testnet is driven by SOV_003 environmental failure. It does not mean the system is at economic risk unless sov_003_fail_count.economic > 0.
- vault_paused: true means user-facing operations are halted. This is a protocol-level pause, not an API error.
{
"block_number": 251388029,
"eth_price_usd": 1200.0,
"price_source": "chainlink_fallback",
"oracle_feed_address": "0x<OracleModule.feed() return value>",
"oracle_stale": true,
"total_collateral_eth": 8.125,
"total_collateral_usd": 9750.0,
"total_debt_nxusd": 8000.0,
"collateral_ratio": 1.21875,
"collateral_ratio_pct": 121.9,
"min_collateral_ratio_bps": 15000,
"liquidation_ratio_bps": 13000,
"vault_paused": false,
"liquidation_engine_paused": false,
"pillars": {
"SOV_001": { "pass": true, "note": "Economic Constitution — solvency gate" },
"SOV_003": { "pass": false, "note": "Capital Adequacy — testnet_env failure, zero economic" },
"SOV_005": { "pass": true, "note": "Risk Lattice — stress simulation" }
},
"overall_verdict": "WARN",
"verdict_reason": "SOV_003 FAIL: oracle stale (testnet environment). Zero economic failures.",
"verdict_source": "simplified_runtime",
"timestamp": "2026-03-20T12:00:00.000Z"
}// Minimal integration — live protocol state
const res = await fetch('https://nexus-finance.org/api/status')
const data = await res.json()
// Primary observability fields
console.log(data.overall_verdict) // "PASS" | "WARN" | "FAIL"
console.log(data.collateral_ratio_pct) // e.g. 121.9
console.log(data.oracle_stale) // bool — affects price reliability
console.log(data.pillars.SOV_001.pass) // false → halt integrations
// Check data freshness via response header
// Cache-Control: public, s-maxage=30, must-revalidate
// Note: overall_verdict is a simplified runtime check — see verdict_source field.
// For canonical audit verdict, use /api/receipts overall_verdict.isLiquidatable() is intentionally not called to avoid oracle revert.- Liquidation keepers — poll this endpoint to find liquidatable positions without direct RPC calls.
- Risk dashboards — display per-vault CR distribution and system exposure.
- Monitoring — alert when summary.liquidatable > 0 and oracle_stale = false.
- Analytics — track vault count, aggregate CR, and debt distribution over time.
- When oracle_stale is true, all vault status values are computed from Chainlink fallback. A vault classified as "liquidatable" in this state may not be executable on-chain because the contract itself will revert on oracle check.
- collateral_ratio and collateral_ratio_pct are null for vaults with zero debt. This represents an infinite CR — not an error or missing data.
- isLiquidatable() is not called. Status is derived purely from CR thresholds and protocol parameters. Discrepancy with on-chain state is possible if parameters changed after the last cache miss.
- Log scan starts at block 251,000,000. Depositors before this block will not appear if they have not re-deposited.
{
"block_number": 251388029,
"eth_price_usd": 1200.0,
"oracle_stale": true,
"price_source": "chainlink_fallback",
"protocol": {
"min_collateral_ratio_bps": 15000,
"liquidation_ratio_bps": 13000
},
"vaults": [
{
"address": "0xabc...111",
"collateral_eth": 8.125,
"debt_nxusd": 8000.0,
"collateral_value_usd": 9750.0,
"collateral_ratio": 1.21875,
"collateral_ratio_pct": 121.9,
"status": "oracle_stale"
}
],
"summary": {
"total": 2,
"safe": 0,
"active": 0,
"liquidatable": 1,
"oracle_stale": 1
},
"timestamp": "2026-03-20T12:00:00.000Z"
}// Liquidation keeper — find eligible positions
const res = await fetch('https://nexus-finance.org/api/vaults')
const data = await res.json()
// Filter by status — note: oracle_stale means CR is computed off fallback
const liquidatable = data.vaults.filter(v => v.status === 'liquidatable')
const atRisk = data.vaults.filter(v => v.status === 'active')
// Prefer to act only when oracle is reliable
if (!data.oracle_stale && liquidatable.length > 0) {
// Proceed to on-chain liquidation via KEEPER_ROLE
}
// Protocol thresholds (BPS → decimal)
const liqCr = data.protocol.liquidation_ratio_bps / 10000 // 1.30
const minCr = data.protocol.min_collateral_ratio_bps / 10000 // 1.50NEXUS120-Official/nexus-receipts/packages/- Audit systems that need to verify protocol state over a historical window.
- Verification tooling — re-derive the SHA-256 hash from the raw field and compare against package_hash.
- Trend analysis — track collateral_ratio_pct and sov_003_fail_count over time.
- Risk engines that need engine-generated snapshots rather than live RPC data.
- Compliance workflows requiring immutable, timestamped protocol state records.
- Packages are generated by an automated engine, not the smart contracts directly. The engine reads chain state, runs pillar logic, and commits results to GitHub. The chain state inside each package is a snapshot, not a real-time value.
- The raw field contains the original AUD_001 JSON exactly as committed to the repository. package_hash is a SHA-256 over this canonical JSON.
- sov_003_fail_count.economic is the critical signal. A value of 0 means no economic failure occurred — testnet_env failures are expected and carry no risk significance.
- Package frequency is hourly (GitHub Actions schedule). Gaps in the receipt timeline indicate engine downtime, not protocol failure.
[
{
"filename": "AUD_001_PACKAGE_20260320T120000Z.json",
"download_url": "https://raw.githubusercontent.com/NEXUS120-Official/nexus-receipts/main/packages/...",
"timestamp_utc": "2026-03-20T12:00:00Z",
"block_number": 251388029,
"eth_price_usd": 1200.0,
"price_source": "chainlink_fallback",
"collateral_ratio_pct": 121.9,
"total_collateral_eth": 8.125,
"total_debt_nxusd": 8000.0,
"oracle_stale": true,
"sov_001_verdict": "PASS",
"sov_003_verdict": "FAIL",
"sov_003_mode": "RECOVERY",
"sov_003_fail_count": {
"economic": 0,
"structural": 0,
"testnet_env": 6,
"total": 6
},
"sov_005_verdict": "PASS",
"overall_verdict": "WARN",
"verdict_rationale": "SOV_003 FAIL — testnet_env only. Zero economic or structural failures.",
"package_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"raw": { "...": "full AUD_001 JSON from nexus-receipts repo" }
}
]// Audit verification — read and verify recent packages
const res = await fetch('https://nexus-finance.org/api/receipts')
const packages = await res.json() // array, newest first — all available packages
const latest = packages[0]
// Verify integrity — recompute hash server-side against raw field
console.log(latest.package_hash) // "sha256:..."
console.log(latest.overall_verdict) // "PASS" | "WARN" | "FAIL"
// Distinguish fail categories — economic=0 means no real risk event
console.log(latest.sov_003_fail_count.economic) // 0 on healthy testnet
console.log(latest.sov_003_fail_count.testnet_env) // non-zero is expectedOracle & price source behavior
The protocol uses a two-layer price stack. All three REST endpoints implement the same fallback logic and expose oracle_stale and price_source so consumers can evaluate data reliability independently.
OracleModule.getPrice() — protocol-managed oracle with a freshness window enforced by maxDelay(). Returns price, updatedAt, and decimals. Reverts if the feed has not been updated within maxDelay seconds.AggregatorV3Interface.latestRoundData() directly on the Chainlink ETH/USD feed at 0xd30e2101a97dcbAeBCBC04F14C3f624E67A35165. Used when OracleModule reverts. No freshness enforcement is applied to the fallback.oracle_stale: true in the response.OracleModule is returning a valid price within its freshness window. CR computations on all endpoints use this price. On-chain operations — including isLiquidatable() and getPrice() — will not revert.
Integrations may rely on vault status values. Liquidation keeper execution is safe.
OracleModule has reverted. All API endpoints fall back to OracleModule.feed() via latestRoundData(). CR computations use the fallback price. Vault statuses are computed from this fallback and may not match what the smart contract would return. Any on-chain call that internally invokes OracleModule — such as isLiquidatable() — will revert.
This is the normal state on Arbitrum Sepolia testnet. API data is still valid for monitoring and analytics. Liquidation keeper execution requires caution.
Both OracleModule and the Chainlink fallback have failed or returned zero. CR computation is not possible. All vault statuses will be classified as oracle_stale. The API will return the best available data but eth_price_usd will be 0 or absent.
Do not use vault status or CR data for any decision-making. Alert and halt integrations until a reliable price source is restored.
Caching & revalidation
All endpoints use Vercel edge caching with stale-while-revalidate semantics. A response may be served from cache up to the stale window while a background revalidation is in flight. For latency-sensitive integrations, include a Cache-Control: no-store header on your request, or append a unique query string to bypass the CDN layer.
| Endpoint | s-maxage | stale-while-revalidate | Maximum age seen by client | Notes |
|---|---|---|---|---|
| /api/status | 30s | 60s | ~90s | Live chain data — at most 2 Arbitrum Sepolia block epochs stale |
| /api/vaults | 30s | 60s | ~90s | Log scan + multicall — expensive; do not bypass cache in hot loops |
| /api/receipts | 60s | 120s | ~180s | Source is hourly GitHub commits — higher cache TTL is appropriate |
Integration use cases
The following patterns represent the primary ways external systems are expected to integrate with this API. Each pattern identifies the primary endpoint, the key field to act on, and the behavioral constraint to observe.
Poll /api/vaults at the cache boundary (every 30s). Filter vaults where status === 'liquidatable'. Proceed to on-chain execution only when oracle_stale === false.
summary.liquidatable > 0 AND oracle_stale === falseFetch /api/status every 30s. Display overall_verdict, collateral_ratio_pct, and per-pillar pass/fail. Surface oracle_stale prominently when true — it affects all downstream data.
overall_verdict + pillars.SOV_001.passUse /api/status for live signals and /api/receipts for engine-verified historical snapshots. Combine collateral_ratio trend from receipts with live oracle_stale state to build a composite risk score.
sov_003_fail_count.economic trend across packagesSubscribe to overall_verdict transitions. Alert on WARN → FAIL or any state where pillars.SOV_001.pass === false. Suppress alerts for persistent WARN on testnet — it is environmental, not economic.
overall_verdict === 'FAIL' OR SOV_001.pass === falseFetch the latest packages and recompute SHA-256 from the raw field. Compare against package_hash. Inspect verdict_rationale and fail classification breakdown. Cross-reference with the public GitHub repo directly.
package_hash integrity + economic: 0Aggregate /api/receipts over time for CR trend and verdict history. Combine with /api/vaults snapshots for vault-level distribution analysis. All timestamps are ISO 8601 UTC and suitable for time-series storage.
timestamp_utc + collateral_ratio_pctContract read surfaces
All four contracts are deployed on Arbitrum Sepolia and callable directly via eth_call — no wallet or auth required. The REST API endpoints are built on top of these same read surfaces. Full ABIs and verified source are on the Contracts page →
0xF09AAD220C6c4d805cF6cE5561B546f51ADFBb030x515844Dd91956C749e33521B4f171dac4e04FE070xa1BD5AF1174140caB018e46eBCFEf1d005c3df840xF333d9ae2D70305758E714ecBeA938e9377a9f9DIntegration policy
These rules define the expected behavior of any system integrating with this API. They are not advisory — they reflect the protocol's safety model and the trust constraints of each data surface.
If pillars.SOV_001.pass === false, halt or restrict all protocol-dependent operations immediately. SOV_001 is the Economic Constitution — its failure indicates the primary solvency invariant has been breached. Do not wait for overall_verdict to confirm.
overall_verdict === "WARN" means SOV_003 is failing while SOV_001 is passing. The protocol is not insolvent. Persistent WARN on testnet is environment-driven (oracle stale). Inspect sov_003_fail_count.economic — if 0, no real risk event has occurred.
Do not execute on-chain liquidation logic when oracle_stale === true. When OracleModule is stale, isLiquidatable() will revert on-chain. Vault statuses in /api/vaults are computed from Chainlink fallback — they may not match contract-level eligibility. Wait for oracle_stale: false before submitting keeper transactions.
Check the Age and Date headers on every response. A response served from CDN cache may be up to 90s old. For latency-sensitive integrations, fetch server-side — not client-side — to avoid layered stale caches. If you need guaranteed freshness, append a unique query string or include Cache-Control: no-store.
When inspecting /api/receipts packages, the sov_003_fail_count breakdown is the primary risk signal. testnet_env failures are expected and carry no risk significance. economic: 0 across a historical window means the protocol has had no real economic stress events, even when overall_verdict is WARN.
/api/vaults performs a log scan and multicall against Arbitrum Sepolia on each cache miss. Do not bypass the cache or loop at sub-30s intervals. For real-time monitoring of overall protocol state, use /api/status instead.
Testnet behavior & known limitations
This API operates against Arbitrum Sepolia testnet. Several system behaviors are environment-driven and should not be interpreted as protocol failures. The following annotations are provided so integrations can correctly classify data they receive.
All contract source is verified on Arbiscan. All audit packages are SHA-256 hashed and immutably committed to the public nexus-receipts repository. Both are independent of this API.