API

Buildix can POST events to your own server: Entry Signals, their outcome four hours later, your alerts and, on Whale and API, Copy Signals. Register an endpoint in Dashboard → Alerts (5 endpoints on Pro, 20 on Whale and API). Each endpoint gets a signing secret, shown once, that you can rotate.

• entry_signal.created: a new Entry Signal matching an Entry Signal alert that uses the endpoint (same pairs, timeframe and minimum grade as the Telegram and email channel). Pro and above. On HIP-3 markets (symbols such as xyz:NVDA) a signal whose bar falls outside the market's trading session is sent with its grade lowered one step and two extra fields in data: session ("closed") and grade_before_session. Crypto signals and open-session signals never carry them.
• signal.outcome: four hours after each delivered signal, the move in the signal's direction, the best and worst excursion and which level was touched first. Computed from the 5m bars Buildix already holds, with the same price rule as the public channel follow up.
• alert.triggered: an alert (price, screener, sweep, delta flip, drawing) whose webhook URL is a registered endpoint. data carries the same fields as the previous flat payload, plus alert_kind.
• whale.copy_signal: a move of a tracked wallet that passes one of your Copy Signal filters. Whale and API. Fixed text, limits, filters, payload and templates in Copy Signal webhooks.
• test: sent by the Send test event button.

Every event has the same envelope. id is stable: a retry of the same event carries the same id, so store it and ignore duplicates. New fields may be added to data; a breaking change would ship as version "2".

{
  "id": "evt_9f2c41d0b6a84e5f8c1d2e3f4a5b6c7d",
  "type": "entry_signal.created",
  "version": "1",
  "created_at": "2026-09-26T10:15:04.211Z",
  "data": {
    "signal_id": "BTC-15m-1758880800000-long",
    "symbol": "BTC",
    "timeframe": "15m",
    "side": "long",
    "grade": "A",
    "score": 0.81,
    "bar_time": "2026-09-26T10:00:00.000Z",
    "regime": "trend_up",
    "confirmed": true,
    "flow_source": "trades",
    "logics": { "liquidity_grab": true, "flow_rejection": true, "absorption": false,
                "cvd_divergence": true, "structure_shift": false, "level_confluence": true },
    "plan": { "entry": 64210.5, "stop": 63880.0, "t1": 64706.0, "t2": 65201.5, "r_t1": 1.5, "r_t2": 3 },
    "price_at_signal": 64215.0,
    "chart_url": "https://www.buildix.trade/pair/BTC"
  }
}

{
  "id": "evt_0b7e...",
  "type": "signal.outcome",
  "version": "1",
  "created_at": "2026-09-26T14:15:30.002Z",
  "data": {
    "entry_event_id": "evt_9f2c41d0b6a84e5f8c1d2e3f4a5b6c7d",
    "signal_id": "BTC-15m-1758880800000-long",
    "symbol": "BTC", "timeframe": "15m", "side": "long", "grade": "A",
    "horizon": "4h",
    "signaled_at": "2026-09-26T10:15:04.211Z",
    "evaluated_at": "2026-09-26T14:15:30.002Z",
    "price_at_signal": 64215.0,
    "price_after": 64890.0,
    "move_pct": 1.0512,
    "max_favorable_pct": 1.4201,
    "max_adverse_pct": -0.3105,
    "first_level_hit": "t1",
    "t2_hit": false
  }
}

first_level_hit is stop, t1, none, or both_same_bar when one 5m bar spans both levels and the order inside the bar is unknown.

Content-Type: application/json
X-Buildix-Event: entry_signal.created
X-Buildix-Event-Id: evt_9f2c41d0b6a84e5f8c1d2e3f4a5b6c7d
X-Buildix-Delivery: <uuid of this delivery>
X-Buildix-Attempt: 1
X-Buildix-Timestamp: 1758881704
X-Buildix-Signature: v1=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>

Compute the HMAC over the timestamp, a dot and the raw request body exactly as received, and compare in constant time. Reject a timestamp more than 300 seconds away from your clock (replay protection) and an event id you already handled. For 24 hours after a rotation the header carries two entries, v1=<new>,v1=<old>: accept the request when any entry matches.

// Node 18+ (Express). Verify on the RAW body, before JSON parsing.
import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.BUILDIX_WEBHOOK_SECRET; // whsec_...
const TOLERANCE_S = 300;
const seen = new Set(); // use your database in production

function verify(rawBody, timestamp, signatureHeader) {
  if (!timestamp || !signatureHeader) return false;
  const ts = Number(timestamp);
  if (!Number.isInteger(ts) || Math.abs(Date.now() / 1000 - ts) > TOLERANCE_S) return false;
  const expected = crypto.createHmac('sha256', SECRET).update(`${ts}.${rawBody}`).digest();
  return signatureHeader.split(',').some((part) => {
    const [scheme, hex] = part.trim().split('=');
    if (scheme !== 'v1' || !/^[0-9a-f]{64}$/.test(hex || '')) return false;
    return crypto.timingSafeEqual(Buffer.from(hex, 'hex'), expected);
  });
}

const app = express();
app.post('/buildix', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body.toString('utf8');
  if (!verify(raw, req.get('X-Buildix-Timestamp'), req.get('X-Buildix-Signature'))) {
    return res.status(401).end();
  }
  const event = JSON.parse(raw);
  if (seen.has(event.id)) return res.status(200).end(); // retry of an event already handled
  seen.add(event.id);
  res.status(200).end(); // answer fast, work after
  // handle event.type / event.data here
});
app.listen(3000);

# Python 3.10+ (Flask). Verify on the RAW body, before JSON parsing.
import hashlib, hmac, json, os, time
from flask import Flask, request, abort

SECRET = os.environ["BUILDIX_WEBHOOK_SECRET"].encode()  # whsec_...
TOLERANCE_S = 300
seen = set()  # use your database in production

def verify(raw: bytes, timestamp: str | None, signature_header: str | None) -> bool:
    if not timestamp or not signature_header or not timestamp.isdigit():
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_S:
        return False
    expected = hmac.new(SECRET, f"{timestamp}.".encode() + raw, hashlib.sha256).hexdigest()
    for part in signature_header.split(","):
        scheme, _, value = part.strip().partition("=")
        if scheme == "v1" and hmac.compare_digest(value, expected):
            return True
    return False

app = Flask(__name__)

@app.post("/buildix")
def buildix():
    raw = request.get_data()
    if not verify(raw, request.headers.get("X-Buildix-Timestamp"), request.headers.get("X-Buildix-Signature")):
        abort(401)
    event = json.loads(raw)
    if event["id"] in seen:
        return "", 200  # retry of an event already handled
    seen.add(event["id"])
    # handle event["type"] / event["data"] here
    return "", 200

• https only, port 443, public addresses only (checked on every delivery), redirects are not followed, 5 second timeout, request body up to 64 KB. Answer with any 2xx as soon as you have stored the event.
• A failed delivery is retried after 1 min, 5 min, 30 min, 2 h (5 attempts in total). A 410, or a 404 from Discord or Slack, means the webhook is gone and the endpoint is disabled at once.
• After 20 failed deliveries in a row spanning at least 24 hours the endpoint is disabled; you get an in-app notification and an email, and you can turn it back on from the dashboard.
• Limits: an alert sends at most one webhook every 5 minutes, whatever its cooldown (email, Telegram and in-app keep the alert's own cooldown). When 50 deliveries of an endpoint are already waiting for a retry, new events for that endpoint are dropped until the backlog clears (older ones keep their retries; the delivery log shows one backlog line per hour). An account receives at most 2,000 webhook events per day (Europe/Rome day).
• Discord and Slack incoming webhook URLs receive a formatted message (embed or blocks) instead of the raw JSON.
• The dashboard shows the last 50 deliveries of each endpoint (kept 3 days). Send test event is limited to 5 per minute and 20 per day.
• An alert webhook URL that is not registered as an endpoint keeps receiving the previous flat, unsigned JSON. Register the same URL to switch it to the signed envelope.

Buildix sends data. Execution, sizing and risk are yours.

• A signal is a position change of at least $50,000 notional between two reads of the wallet by the whale monitor, not a fill. It reaches you minutes after the wallet traded: tier A wallets are read every 10 minutes, tier B every 30. detection.delay_s is the mean detection delay of that wallet (delay_basis: "poll_meta"), or 600 with note: "assumed 10 min" when Buildix has no poll data for it. detected_at is when Buildix saw the change.
• entry_px is the wallet's average entry, mark_px the coin's mark at detection; notional fields are size x entry price.
• Market makers are excluded. Trader Score history is reliable since 2026-09-30; every score carries its coverage (covered_since, n_episodes, coverage_complete).
• Capacity is the visible order book only (top 20 levels per side) at the last hourly refresh, not at the moment of the move.
• conviction and trade_plan are null when there is not enough data; the trade plan declares its own coverage.
• The first attempt waits 2 seconds for your answer (retries 5 seconds). A failed delivery is retried after 1 min, 5 min, 30 min, 2 h (5 attempts in all): check detected_at and drop signals that are too old for your strategy.
• After 20 failed deliveries in a row over at least 24 hours the endpoint is disabled and you get a notification and an email; an HTTP 410 answer disables it at once.
• At most 25 Copy Signal events per monitor run across all accounts, 10 per account; at most 2,000 webhook events per account per day (all event types); when 50 deliveries of one endpoint wait for a retry, new events for it are dropped until they clear.

1. Dashboard > Alerts > Webhook endpoints: add your https URL and copy the signing secret (shown once).
2. Whale Tracker > Top Traders > Copy Signal webhooks: add up to 5 filters (Whale) or 20 (API). Each filter sends to one endpoint; saving it subscribes that endpoint to whale.copy_signal.

POST <your URL>
Content-Type: application/json
X-Buildix-Event: whale.copy_signal
X-Buildix-Event-Id: evt_...        (same on every retry: deduplicate on it)
X-Buildix-Delivery: <uuid of this delivery>
X-Buildix-Attempt: 1
X-Buildix-Timestamp: <unix seconds of this attempt>
X-Buildix-Signature: v1=<hex HMAC-SHA256(secret, timestamp + "." + raw body)>

Reject a timestamp more than 300 seconds from your clock (replay protection). For 24 hours after a secret rotation the header carries two v1= entries: accept the request when any matches. Answer 2xx fast and do the slow work after answering.

{
  "id": "evt_cdbf49868beedb8c0e1eb5cb3fa45df5",
  "type": "whale.copy_signal",
  "version": "1",
  "created_at": "2026-10-30T14:14:46.020Z",
  "data": {
    "signal": "copy",
    "notice": "Buildix sends data. Execution, sizing and risk are yours.",
    "move": {
      "address": "0xf08193e61aedd3139bcb0c95c773e3c65de9e39e", "label": null, "coin": "ZEC",
      "action": "open", "action_raw": "opened_long",
      "side_before": null, "side_after": "long", "side_basis": "action",
      "size_before": 0, "size_after": 3312.06,
      "notional_before_usd": 0, "notional_after_usd": 4077537.345492,
      "entry_px": 1231.1182, "mark_px": 1224.3, "leverage": 10,
      "detected_at": "2026-10-30T14:14:44.128Z"
    },
    "legs": [{ "action": "open", "side": "long" }],
    "trader": {
      "score": 51.2, "confidence": "low", "provisional": true, "closed_episodes": 1,
      "style": { "kind": "swing", "badge": "Swing trader, HYPE/ZEC, 7x median, long-biased" },
      "coverage": { "covered_since": "2026-10-17T00:00:00Z", "n_episodes": 1, "n_days": 14, "coverage_complete": false },
      "scores_computed_at": "2026-10-30T18:14:48.515Z"
    },
    "conviction": null,
    "trade_plan": null,
    "capacity": {
      "coin": "ZEC", "visible_depth": true, "book_at": "2026-10-30T17:54:34Z",
      "k10": { "slippage_bps": 2.2, "copyable": true },
      "k100": { "slippage_bps": 3.4, "copyable": true },
      "m1": { "slippage_bps": 10.2, "copyable": true }
    },
    "funding_1h": 0.0000125,
    "detection": { "delay_s": 300, "delay_basis": "poll_meta", "note": null,
      "poll_tier": "A", "poll_interval_s": 600, "detect_gap_s": null,
      "detected_at": "2026-10-30T14:14:44.128Z" },
    "matched_filters": ["cf_3f9a2c1d7b6e4a50"]
  }
}

import hashlib, hmac, time

def verify_buildix(secret: str, raw_body: bytes, ts: str, sig_header: str, tolerance_s: int = 300) -> bool:
    if not ts or not ts.isdigit() or abs(time.time() - int(ts)) > tolerance_s:
        return False
    expected = hmac.new(secret.encode(), ts.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    for part in (sig_header or "").split(","):
        scheme, _, value = part.strip().partition("=")
        if scheme == "v1" and hmac.compare_digest(value, expected):
            return True
    return False

import crypto from 'node:crypto';

export function verifyBuildix(secret, rawBody /* Buffer */, ts, sigHeader, toleranceS = 300) {
  if (!/^\d+$/.test(ts || '') || Math.abs(Date.now() / 1000 - Number(ts)) > toleranceS) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${ts}.`).update(rawBody).digest('hex');
  return (sigHeader || '').split(',').some((part) => {
    const [scheme, value] = part.trim().split('=');
    return scheme === 'v1' && value && value.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(value), Buffer.from(expected));
  });
}

Receives the webhook, verifies it, answers at once and hands each signal to your own trading code. Sizing, risk limits and the exchange key stay in your code.

# pip install flask
import json, os, queue, threading, time
from datetime import datetime
from flask import Flask, request, abort

SECRET = os.environ["BUILDIX_WEBHOOK_SECRET"]   # whsec_..., shown once in Dashboard > Alerts
MAX_SIGNAL_AGE_S = 15 * 60                       # your choice: ignore older signals (retries can arrive late)
jobs: "queue.Queue[dict]" = queue.Queue()
seen: dict[str, float] = {}                      # event id -> time; use Redis or a DB in production

app = Flask(__name__)

@app.post("/buildix")
def buildix():
    raw = request.get_data()                     # exact bytes, before any JSON parsing
    if not verify_buildix(SECRET, raw, request.headers.get("X-Buildix-Timestamp", ""),
                          request.headers.get("X-Buildix-Signature", "")):
        abort(401)
    event = json.loads(raw)
    if event["id"] in seen or event["type"] != "whale.copy_signal":
        return "", 200                           # duplicate (retry) or another event type
    seen[event["id"]] = time.time()
    jobs.put(event["data"])                      # answer fast, work after
    return "", 200

def worker():
    while True:
        data = jobs.get()
        detected = datetime.fromisoformat(data["move"]["detected_at"].replace("Z", "+00:00")).timestamp()
        if time.time() - detected > MAX_SIGNAL_AGE_S:
            continue
        # Your code from here: your sizing, your risk limits, your exchange key.
        # e.g. hybridpro.on_copy_signal(coin=data["move"]["coin"], legs=data["legs"], signal=data["signal"],
        #      score=(data["trader"] or {}).get("score"), capacity=data["capacity"], funding_1h=data["funding_1h"])
        print("copy signal", data["signal"], data["move"]["coin"], data["legs"])

threading.Thread(target=worker, daemon=True).start()
# verify_buildix: see "Verify the signature, Python" above.

Buildix MCP (API mode, your Buildix API key) gives the agent the data: get_trader_score, get_trade_plan, get_exit_radar, get_top_traders, get_smart_money_consensus, get_fade_list, get_dumb_money_index. Orders go through a separate exchange tool that you run on your own machine with your own exchange key: Buildix never sees that key and never places an order. MCP does not push events: new moves reach the agent through the webhook above (Template 1) or the pull feed below.

claude mcp add --transport http buildix https://www.buildix.trade/api/mcp --header "Authorization: Bearer bx_..."

Example prompt:

When I paste a Copy Signal, and every 30 minutes for the wallets I follow: call get_trader_score for the wallet and skip it unless confidence is medium or high. Call get_trade_plan for the wallet and coin: skip the entry when the plan is collecting or the mark is already past chase_limit_px. Call get_exit_radar for the coin and skip it when high-score wallets are leaving that side. Otherwise propose an order with my exchange tool: at most 1% of my equity per position, never more than 3 open positions, stop at stop_ref_px. Ask me before sending any order and log every decision with the signal id.

GET /api/v1/whale-moves (Whale, API key) accepts the same filters: coins, exclude_coins, side, actions, min_score, min_confidence, conviction_min, copyable, exclude_against_funding, exclude_fade or fade. With these filters a response scans at most 1,500 rows, so it can hold fewer rows than limit (even none) while has_more is true: keep following next_cursor. See the endpoint tab above for every field.