# Get public API stats
Source: https://docs.nshield.org/api-reference/monitoring/get-public-api-stats

/reference/public-openapi.json get /v1/monitoring/public-api/stats
Returns metadata-only request counters, route latency summaries, error codes, and the Firebase-compatible api_request event schema for the current public API container process. For durable history, consume the structured public API request logs.



# Scrape public API metrics
Source: https://docs.nshield.org/api-reference/monitoring/scrape-public-api-metrics

/reference/public-openapi.json get /v1/monitoring/public-api/metrics
Returns Prometheus text metrics for public API request counts, errors, rate limits, and latency summaries from the current public API container process.



# Check Nova Bridge status
Source: https://docs.nshield.org/api-reference/nova-bridge/check-nova-bridge-status

/reference/public-openapi.json get /v1/bridge/hyperliquid-perps/status
Checks the current status for a Solana and Hyperliquid Perps route request.



# List Nova Bridge routes
Source: https://docs.nshield.org/api-reference/nova-bridge/list-nova-bridge-routes

/reference/public-openapi.json get /v1/bridge/routes
Lists the public Relay-backed Nova Bridge discovery, quote, and status routes.



# Send Solana assets to Hyperliquid Perps
Source: https://docs.nshield.org/api-reference/nova-bridge/send-solana-assets-to-hyperliquid-perps

/reference/public-openapi.json post /v1/bridge/solana-to-hyperliquid-perps
Builds a wallet-ready Nova Bridge route that moves SOL or USDC from Solana into Hyperliquid Perps as USDC.



# Withdraw Hyperliquid Perps USDC to Solana
Source: https://docs.nshield.org/api-reference/nova-bridge/withdraw-hyperliquid-perps-usdc-to-solana

/reference/public-openapi.json post /v1/bridge/hyperliquid-perps-to-solana
Builds a wallet-ready Nova Bridge route that moves USDC from Hyperliquid Perps back to Solana as SOL or USDC.



# Check dapp risk
Source: https://docs.nshield.org/api-reference/security-model/check-dapp-risk

/reference/public-openapi.json post /v1/security/dapp-risk
Screens an app URL or domain before you open it inside a wallet, browser, or agent flow.



# Check token risk
Source: https://docs.nshield.org/api-reference/security-model/check-token-risk

/reference/public-openapi.json post /v1/security/token-risk
Scores a token for common launch, liquidity, metadata, and trust risks before you show it to users.



# Check wallet risk
Source: https://docs.nshield.org/api-reference/security-model/check-wallet-risk

/reference/public-openapi.json post /v1/security/wallet-risk
Scores a public wallet for activity quality, suspicious patterns, recency, and trading behavior.



# Preview a transaction
Source: https://docs.nshield.org/api-reference/security-model/preview-a-transaction

/reference/public-openapi.json post /v1/security/transaction-preview
Explains what a transaction is expected to do before a user signs it.



# Screen an address
Source: https://docs.nshield.org/api-reference/security-model/screen-an-address

/reference/public-openapi.json post /v1/security/address-screen
Checks whether an address should be allowed, warned, or blocked in your product.



# Get token chart
Source: https://docs.nshield.org/api-reference/token-data/get-token-chart

/reference/public-openapi.json get /v1/data/tokens/{mint}/chart
Returns price and volume points for a token.



# Get token details
Source: https://docs.nshield.org/api-reference/token-data/get-token-details

/reference/public-openapi.json get /v1/data/tokens/{mint}
Returns a product-ready token profile.



# Get token prices
Source: https://docs.nshield.org/api-reference/token-data/get-token-prices

/reference/public-openapi.json post /v1/data/tokens/prices
Returns current prices for one or more token mints.



# List trending tokens
Source: https://docs.nshield.org/api-reference/token-data/list-trending-tokens

/reference/public-openapi.json get /v1/data/tokens/trending
Returns tokens gaining attention by volume, wallet activity, and market movement.



# Search tokens
Source: https://docs.nshield.org/api-reference/token-data/search-tokens

/reference/public-openapi.json get /v1/data/tokens/search
Searches tokens by symbol, name, or mint address.



# List recent trades
Source: https://docs.nshield.org/api-reference/trader-data/list-recent-trades

/reference/public-openapi.json get /v1/data/trades/feed
Returns a filtered feed of notable public trades.



# List token signals
Source: https://docs.nshield.org/api-reference/trader-data/list-token-signals

/reference/public-openapi.json get /v1/data/signals/tokens
Returns tokens with notable wallet movement, volume changes, or risk shifts.



# List top traders
Source: https://docs.nshield.org/api-reference/trader-data/list-top-traders

/reference/public-openapi.json get /v1/data/traders/leaderboard
Ranks public wallets by trading performance, activity, or signal quality.



# Get wallet overview
Source: https://docs.nshield.org/api-reference/wallet-data/get-wallet-overview

/reference/public-openapi.json get /v1/data/wallets/{address}
Returns the high-level profile and portfolio summary for a public wallet.



# List wallet activity
Source: https://docs.nshield.org/api-reference/wallet-data/list-wallet-activity

/reference/public-openapi.json get /v1/data/wallets/{address}/activity
Returns recent public activity for a wallet in a simple feed shape.



# List wallet tokens
Source: https://docs.nshield.org/api-reference/wallet-data/list-wallet-tokens

/reference/public-openapi.json get /v1/data/wallets/{address}/tokens
Returns token holdings for a public wallet.



# List wallet trades
Source: https://docs.nshield.org/api-reference/wallet-data/list-wallet-trades

/reference/public-openapi.json get /v1/data/wallets/{address}/trades
Returns recent trades for a public wallet.



# Security & Vulnerability Disclosure
Source: https://docs.nshield.org/bug-bounty

Responsible vulnerability disclosure policy for Nova Wallet, Nova-owned public APIs, and Nova-owned documentation.

Nova welcomes responsible disclosure of security vulnerabilities that create a real, exploitable risk to Nova users or Nova-owned production systems.

Nova Wallet is a **non-custodial iOS wallet**. Nova does not custody user funds and does not have access to user seed phrases, private keys, passcodes, backup codes, recovery phrases, or signing authority. Do not submit secrets to Nova and do not attempt to access funds, accounts, wallets, devices, or data that you do not own.

This policy is a vulnerability disclosure program with optional, discretionary rewards. Submitting a report does not guarantee a reward, response, public credit, or continued participation in the program.

## Scope

**In scope**

Reports are in scope only when they affect current, production Nova-owned assets and demonstrate a concrete security impact.

| Asset                                           | In scope examples                                                                                                                                                                                                         |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Nova Wallet for iOS                             | Vulnerabilities in the latest public App Store version that could compromise wallet integrity, transaction review, local authorization, local data protection, or user security.                                          |
| Nova-owned public APIs                          | Exploitable vulnerabilities in Nova-owned production API services, including documented public APIs, that bypass a real security boundary or expose non-public Nova data.                                                 |
| Nova-owned documentation and developer surfaces | Vulnerabilities in `docs.nshield.org` or other Nova-owned documentation surfaces that create a real user security risk, such as account compromise, stored cross-site scripting with impact, or unauthorized data access. |
| Official Nova-owned domains                     | Security issues on domains controlled by Nova, when the affected system is production and the impact is reproducible.                                                                                                     |

Testing must use only accounts, wallets, devices, API requests, data, and funds that you own or are explicitly authorized to use.

**Out of scope**

The following are out of scope and are not eligible for rewards:

| Category                                  | Examples                                                                                                                                                                                                                                                                                                                                  |
| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Unsupported or unreleased features        | Reports about products, flows, assets, contracts, endpoints, or features that Nova does not currently publish as supported production surfaces.                                                                                                                                                                                           |
| Public API abuse                          | Nova public APIs are intentionally open. Calling open endpoints, scraping public-chain data, high-volume access, docs playground use, endpoint enumeration, missing API-key complaints, rate-limit complaints, quota exhaustion, or hypothetical abuse of public data is not a vulnerability without a concrete security boundary bypass. |
| Phishing and impersonation                | Phishing pages, fake apps, fake support accounts, scam tokens, malicious links, social engineering, impersonation, and brand abuse are not accepted as vulnerability reports. Do not send live phishing links to Nova.                                                                                                                    |
| Third-party systems                       | Apple, App Store, iOS, Solana, validators, RPC providers, cloud providers, wallet providers, bridges, exchanges, onramp providers, analytics providers, SDKs, and other non-Nova systems. Report those issues to the relevant third party.                                                                                                |
| User-controlled or public blockchain data | Public wallet activity, token metadata, public token mints, public transaction history, public market data, or third-party on-chain behavior unless a Nova-owned system creates a separate security issue.                                                                                                                                |
| UI, UX, content, and product feedback     | Visual issues, copy changes, broken links without security impact, missing features, support requests, product suggestions, and compliance opinions.                                                                                                                                                                                      |
| Low-impact web findings                   | Missing or non-ideal security headers, cookie flags without exploitability, clickjacking without sensitive action impact, version banners, SPF/DKIM/DMARC observations, TLS preference issues, or scanner-only findings without a working exploit.                                                                                        |
| Non-security reliability issues           | Performance, availability, stale data, failed requests, crashes, errors, or downtime without a demonstrated security impact.                                                                                                                                                                                                              |
| Theoretical or unactionable reports       | AI-generated reports without human validation, broad scanner output, missing reproduction steps, speculative impact, or reports that do not identify a specific affected Nova asset.                                                                                                                                                      |
| Already known or duplicate issues         | Publicly disclosed, already reported, already known, already accepted, or duplicate findings.                                                                                                                                                                                                                                             |

## Prohibited Conduct

The following activity is not authorized by this policy and may disqualify a report:

* Phishing, social engineering, vishing, smishing, impersonation, or attempts to trick Nova users, employees, contractors, partners, or support channels.
* Sending live phishing links, malware, credential-harvesting pages, malicious attachments, or links that could harm Nova users or staff. Use screenshots, inert text, sanitized domains, or a safe proof of concept instead.
* Denial of service, DDoS, stress testing, destructive testing, spam, mass account creation, bulk automation, credential stuffing, brute force attacks, or rate-limit abuse.
* Accessing, copying, storing, modifying, deleting, transferring, freezing, signing with, or attempting to control funds, wallets, devices, accounts, credentials, tokens, logs, or data that you do not own.
* Attempting to obtain, use, or submit seed phrases, private keys, recovery phrases, passcodes, backup codes, signing payloads, session tokens, API credentials, or other secrets.
* Persistence, lateral movement, privilege escalation beyond what is necessary to demonstrate the issue, data exfiltration, extortion, threats, harassment, or unlawful conduct.
* Testing against third-party services, infrastructure, apps, networks, providers, or people without their explicit written authorization.

If you encounter non-public data, secrets, credentials, private user information, or access you did not expect, stop testing immediately, avoid copying or sharing the data, and submit a report through the official channel.

## Submission Process

All vulnerability reports must be submitted through the official form. We do not accept vulnerability reports through social media, public GitHub issues, support chats, app reviews, or unofficial channels.

**Security Submission Form**
[https://tally.so/r/dWEX0A](https://tally.so/r/dWEX0A)

Include:

* Affected Nova-owned asset, URL, endpoint, app version, and device or OS version when relevant.
* Clear reproduction steps and expected versus observed behavior.
* A proof of concept that is safe, minimal, and non-destructive.
* The security boundary bypassed and the real-world user or Nova impact.
* Relevant timestamps, request IDs, transaction signatures, public wallet addresses, screenshots, logs, or videos where useful.
* Confirmation that you used only your own accounts, wallets, devices, data, and funds.

Do not include seed phrases, private keys, passcodes, backup codes, recovery phrases, real user credentials, live phishing links, malware, or secrets in a report.

Incomplete, spammy, automated, AI-generated, or non-actionable submissions may be closed without response.

## Rewards

Nova may offer monetary rewards for valid reports at Nova's sole discretion.

To be eligible for consideration, a report must:

* Be the first complete and actionable report Nova receives for the issue.
* Demonstrate an exploitable security vulnerability with real-world impact to Nova users or Nova-owned production systems.
* Affect an in-scope, current production Nova asset.
* Include reliable reproduction steps and a safe proof of concept.
* Be reported privately through the official submission form.
* Comply with this policy from discovery through disclosure.

Rewards are:

* Not guaranteed.
* Severity-based and determined solely by Nova.
* Paid only after validation and, when needed, remediation.
* Not paid for duplicates, known issues, public disclosures before authorization, out-of-scope findings, prohibited conduct, or reports that only describe abuse of open public APIs.
* Subject to sanctions, tax, payment, identity, and legal restrictions where applicable.

Nova may decline, reduce, or withhold rewards or public credit for reports that violate this policy, contain unsafe content, are repeatedly ineligible, are submitted in bad faith, or cannot be legally paid.

## Disclosure Rules

Do not publicly disclose, discuss, sell, transfer, or share vulnerability details before Nova confirms that a fix has been deployed or explicitly authorizes disclosure in writing.

For user protection, Nova may not publicly confirm, discuss, or disclose security issues until investigation is complete and any necessary updates are generally available.

Public disclosure before authorization, repeated reopening of final decisions, harassment, threats, spam, or attempts to pressure Nova may disqualify a report and end participation in this program.

## Legal Safe Harbor

Nova supports good-faith security research that follows this policy.

If you:

* Act in good faith,
* Stay within the scope and conduct limits above,
* Avoid privacy violations, service disruption, data exfiltration, social engineering, phishing, and harm to users,
* Stop testing and report promptly if you encounter non-public data or unexpected access, and
* Report the issue privately through the official submission form,

then Nova will not initiate legal action against you for accidental, good-faith violations of this policy that are directly related to your in-scope research.

This safe harbor does not apply to:

* Activity outside this policy,
* Activity against third-party systems, people, infrastructure, providers, or assets,
* Unlawful conduct,
* Intentional harm,
* Phishing or social engineering,
* Public disclosure before authorization,
* Extortion, threats, harassment, or coercion,
* Accessing, copying, retaining, sharing, altering, or destroying data that is not yours, or
* Attempts to move, access, freeze, sign with, or control funds or wallets that are not yours.

Nova cannot authorize research against third-party systems and cannot bind third parties, law enforcement, regulators, app stores, infrastructure providers, blockchain networks, or other entities.

Nova may update, pause, or terminate this policy at any time. Changes will not retroactively remove safe harbor for good-faith research that complied with the policy in effect at the time of testing.


# API Surface
Source: https://docs.nshield.org/concepts/api-surface

The public API is split into security, bridge, and token and wallet intelligence APIs.

Nova's public API has three main surfaces.

## Security Model

Security APIs help developers decide what is safe to show, explain, or act on.

* Token risk
* Wallet risk
* Dapp risk
* Transaction preview
* Address screening

These endpoints are designed for wallets, dashboards, bots, agents, trading tools, and token discovery products.

## Nova Bridge

Nova Bridge APIs build Solana to Hyperliquid Perps and Hyperliquid Perps to Solana route plans.

* Supported route discovery
* Wallet-ready route steps
* Route status checks

Use this surface when your product needs to help users move SOL or USDC between Solana and Hyperliquid Perps.

## Token & Wallet Intelligence

Token & Wallet Intelligence APIs give developers clean on-chain context for Solana products.

* Token search and trending tokens
* Token prices and charts
* Wallet profiles and holdings
* Wallet trades and activity
* Trader leaderboards and feeds

## Safe Usage

Use public wallet addresses, token mints, transaction signatures, and URLs. Nova public APIs do not need private keys, seed phrases, recovery phrases, passcodes, backup codes, or signing payloads.


# Access & Rate Limits
Source: https://docs.nshield.org/concepts/authentication

Public Nova API requests are open and protected by rate limits.

Public Nova API requests do not require an API key or `Authorization` header:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/data/tokens/search?query=bonk"
```

## Open Public Access

The public API is intended for browser playgrounds, docs examples, demos, and lightweight integrations. Send public-chain identifiers only.

## Public User Context

When an endpoint needs user context, pass the public wallet address:

```json theme={"dark"}
{
  "walletAddress": "9xQeWvG816bUx9EPfQ5D9b8fRGyJitf8F6f4fH6QJjAo"
}
```

That keeps the playground easy to understand and safe to expose.

## Rate Limits

Nova uses layered rate limits:

* Per IP
* Per IP for docs playground traffic
* Per endpoint
* Per high-cost capability, such as wallet trade history or Nova Bridge route plans

If a request is limited, Nova returns `429` with retry guidance.

## Safe Use

Do not send private keys, seed phrases, recovery phrases, passcodes, backup codes, or signing payloads. Wallet approvals and signing stay in the wallet.


# Safe Public Inputs
Source: https://docs.nshield.org/concepts/disabled-and-private

Use public-chain context with Nova APIs. Keep wallet secrets out of every request.

Nova APIs are built around public blockchain context: wallet addresses, token mints, transaction signatures, and public app URLs.

Send one of those identifiers and Nova returns security context, token data, wallet intelligence, or market signals without needing private wallet material.

## Good Inputs

Use these for normal analysis:

* Public wallet addresses
* Token mints
* Transaction signatures
* Public app or dapp URLs
* Plain-language questions

## Never Send Wallet Secrets

Nova does not need:

* Seed phrases or recovery phrases
* Private keys
* Mnemonics
* Passcodes
* Backup codes
* Signing requests or signing payloads

Wallet approvals and signing belong in the wallet app, not in an API request.

## Before You Act

Nova can explain risk, context, and next steps. When a flow can move funds, the wallet should show the transaction details and approval step before anything is signed.

Read the approval carefully before signing.

## Playground

Paste a public address or mint and inspect the response. Nova handles rate limits, request caps, and abuse protection at the platform layer.


# Nova Bridge
Source: https://docs.nshield.org/concepts/nova-bridge

Move SOL or USDC between Solana and Hyperliquid Perps with Nova's public bridge API.

Nova Bridge is the public API for routes between Solana and Hyperliquid Perps.

Use it when your app needs to:

* Send SOL or USDC from Solana into Hyperliquid Perps
* Move Hyperliquid USDC back to Solana
* Show wallet-ready route plans before the user approves anything
* Track route status after the user submits the transaction

## Base URL

```text theme={"dark"}
https://api-nova.tech
```

No API key is required. Public requests are protected by rate limits, request caps, and abuse monitoring.

## Routes

| Route                                         | Input                     | Output                    |
| --------------------------------------------- | ------------------------- | ------------------------- |
| `POST /v1/bridge/solana-to-hyperliquid-perps` | SOL or USDC on Solana     | USDC on Hyperliquid Perps |
| `POST /v1/bridge/hyperliquid-perps-to-solana` | USDC on Hyperliquid Perps | SOL or USDC on Solana     |

## Send SOL To Hyperliquid Perps

```bash theme={"dark"}
curl "https://api-nova.tech/v1/bridge/solana-to-hyperliquid-perps" \
  -H "Content-Type: application/json" \
  -d '{
    "solanaAddress": "9xQeWvG816bUx9EPfQ5D9b8fRGyJitf8F6f4fH6QJjAo",
    "hyperliquidAddress": "0xf3d63166f0ca56c3c1a3508fce03ff0cf3fb691e",
    "amount": "0.1",
    "asset": "SOL"
  }'
```

The response includes a `requestId`, route details, and a `routePlan` with wallet-executable steps. Your app should show the plan to the user and let the wallet handle approval and signing.

## Bring USDC Back To Solana

```bash theme={"dark"}
curl "https://api-nova.tech/v1/bridge/hyperliquid-perps-to-solana" \
  -H "Content-Type: application/json" \
  -d '{
    "hyperliquidAddress": "0xf3d63166f0ca56c3c1a3508fce03ff0cf3fb691e",
    "solanaAddress": "9xQeWvG816bUx9EPfQ5D9b8fRGyJitf8F6f4fH6QJjAo",
    "amountUsdc": "25",
    "receive": "SOL"
  }'
```

## Check Status

```bash theme={"dark"}
curl "https://api-nova.tech/v1/bridge/hyperliquid-perps/status?requestId=0xrequest"
```

Status responses include the current route state and any indexed transaction hashes once available.

<Note>
  Nova Bridge only needs public addresses and amount details. Do not send seed phrases, private keys, passcodes, backup codes, or signing payloads.
</Note>


# Public API Monitoring
Source: https://docs.nshield.org/concepts/public-api-monitoring

Metadata-only request stats, scrapeable metrics, and Firebase-compatible events for Nova public APIs.

Nova public API monitoring is built for dashboards, agents, and simple uptime checks.

The API emits one structured `api_request` event per completed request and keeps current-process counters for route volume, status codes, errors, rate limits, and latency. Events are metadata-only and do not include request bodies, query values, wallet addresses, token mints, transaction payloads, signed transactions, or secrets.

## JSON Stats

Use stats when an agent, script, or dashboard needs an easy JSON summary:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/monitoring/public-api/stats?includeRecent=true&limit=20"
```

The response includes:

* Total requests, successes, errors, rate limits, and latency percentiles
* Per-route counters using stable route templates
* Error-code counts such as `RATE_LIMITED`, `NOT_FOUND`, or provider-specific public errors
* A Firebase-compatible event schema
* Optional recent sanitized events

These stats reset when the public API container restarts. For long-term history, consume the structured logs or scrape metrics into your monitoring stack.

## Metrics

Use metrics when Prometheus-compatible tooling or uptime monitors need a text endpoint:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/monitoring/public-api/metrics"
```

The endpoint exposes:

* `nova_public_api_requests_total`
* `nova_public_api_errors_total`
* `nova_public_api_rate_limited_total`
* `nova_public_api_request_latency_avg_ms`
* `nova_public_api_request_latency_p95_ms`

Labels are limited to method, route template, status, status class, and error code so the series stay small and stable.

## Firebase Event Shape

Structured request logs include a Firebase-ready event:

```json theme={"dark"}
{
  "name": "api_request",
  "params": {
    "api_service": "nova_public_api",
    "api_method": "GET",
    "api_route": "/v1/data/tokens/search",
    "api_status": 200,
    "api_status_class": "2xx",
    "api_latency_ms": 42,
    "api_success": 1,
    "api_error_code": "none",
    "api_rate_bucket": "standard",
    "api_client_type": "docs",
    "api_country": "US",
    "api_edge_region": "unknown",
    "api_deploy_sha": "unknown"
  }
}
```

All event names and parameter names are lowercase, underscore-separated, and under Firebase naming limits. Keep this exact shape when forwarding logs into Firebase Analytics, BigQuery, or an AI monitoring pipeline.

## What To Watch

Practical alerts for this API:

* Error rate by `api_route` and `api_error_code`
* `RATE_LIMITED` spikes by route
* P95 latency by route
* Sudden changes in `api_client_type`
* Monitoring endpoint availability

For AI-friendly operations, fetch the stats endpoint first, then drill into route-level errors or latency before checking raw logs.


# Security Overview
Source: https://docs.nshield.org/concepts/security-model

Public APIs for token, wallet, dapp, and transaction context.

Security Model is first because developers need clear context before they show a token, wallet, dapp, or transaction to users.

Nova security APIs are public developer APIs protected by rate limits, request caps, and abuse monitoring.

## Security APIs

| API                 | What it answers                                                                |
| ------------------- | ------------------------------------------------------------------------------ |
| Token risk          | Is this token verified, suspicious, mutable, illiquid, or unsafe to highlight? |
| Wallet risk         | Does this wallet look active, suspicious, fresh, dormant, or high-signal?      |
| Dapp risk           | Is this URL or app domain safe to open inside a wallet or browser?             |
| Transaction preview | What will this transaction likely do before a user signs?                      |
| Address screening   | Is this address risky, sanctioned, spammy, or worth warning about?             |

## Public Playground Safety

The docs playground can call demo endpoints without exposing Nova's backend setup.

Every playground request should still use:

* IP rate limits
* Request body caps
* Response size caps
* High-cost endpoint quotas
* Redacted logs

When a request needs user context, use the public wallet address.

## Safe Inputs

Use public wallet addresses, token mints, transaction signatures, and URLs. Do not send private keys, seed phrases, recovery phrases, passcodes, backup codes, or signing payloads.


# Error Codes
Source: https://docs.nshield.org/error-codes

Common Nova public API error codes and response format

Nova public API errors use a consistent envelope:

```json theme={"dark"}
{
  "error": {
    "code": "RATE_LIMITED",
    "message": "Too many requests. Please retry later."
  }
}
```

Some errors also include `requestId` when an upstream provider or internal request id is available.

## Client Errors

| Code                      | HTTP | Description                                                                                                                        |
| ------------------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------- |
| INVALID\_REQUEST          | 400  | Invalid or missing request parameters.                                                                                             |
| SECRET\_FIELD\_DISALLOWED | 400  | Public requests cannot include private keys, seed phrases, passcodes, backup codes, signing payloads, or raw transaction payloads. |

## Rate Limiting

| Code          | HTTP | Description                                                         |
| ------------- | ---- | ------------------------------------------------------------------- |
| RATE\_LIMITED | 429  | Too many requests. Retry after the public rate-limit window resets. |

## Disabled Or Not Found

| Code                    | HTTP | Description                                                                  |
| ----------------------- | ---- | ---------------------------------------------------------------------------- |
| NOT\_FOUND              | 404  | Route not found on the Nova public API.                                      |
| PUBLIC\_NYOMI\_DISABLED | 410  | The public Nyomi API is disabled while agentic runtime ownership is rebuilt. |
| AGENTIC\_V1\_DISABLED   | 410  | Legacy `/v1/chat/*` and `/v1/agent/*` routes are disabled.                   |

## Upstream Or Capability Errors

| Code                             | HTTP | Description                                         |
| -------------------------------- | ---- | --------------------------------------------------- |
| BRIDGE\_ROUTE\_UNAVAILABLE       | 503  | Nova Bridge could not build the requested route.    |
| BRIDGE\_STATUS\_UNAVAILABLE      | 503  | Nova Bridge status could not be loaded.             |
| TOKEN\_RISK\_UNAVAILABLE         | 503  | Token risk data is temporarily unavailable.         |
| TOKEN\_SEARCH\_UNAVAILABLE       | 503  | Token search is temporarily unavailable.            |
| TRENDING\_TOKENS\_UNAVAILABLE    | 503  | Trending token data is temporarily unavailable.     |
| TOKEN\_DETAILS\_UNAVAILABLE      | 503  | Token profile data is temporarily unavailable.      |
| TOKEN\_PRICES\_UNAVAILABLE       | 503  | Token price data is temporarily unavailable.        |
| TOKEN\_CHART\_UNAVAILABLE        | 503  | Token chart data is temporarily unavailable.        |
| WALLET\_OVERVIEW\_UNAVAILABLE    | 503  | Wallet overview data is temporarily unavailable.    |
| WALLET\_TOKENS\_UNAVAILABLE      | 503  | Wallet token holdings are temporarily unavailable.  |
| WALLET\_TRADES\_UNAVAILABLE      | 503  | Wallet trade history is temporarily unavailable.    |
| WALLET\_ACTIVITY\_UNAVAILABLE    | 503  | Wallet activity is temporarily unavailable.         |
| TRADER\_LEADERBOARD\_UNAVAILABLE | 503  | Trader leaderboard data is temporarily unavailable. |
| TRADE\_FEED\_UNAVAILABLE         | 503  | Trade feed data is temporarily unavailable.         |
| TOKEN\_SIGNALS\_UNAVAILABLE      | 503  | Token signal data is temporarily unavailable.       |

## Server Errors

| Code                    | HTTP | Description                                  |
| ----------------------- | ---- | -------------------------------------------- |
| OPENAPI\_UNAVAILABLE    | 500  | The public OpenAPI spec could not be loaded. |
| INTERNAL\_SERVER\_ERROR | 500  | Unhandled server error.                      |

## Safe Inputs

Use public wallet addresses, token mints, transaction signatures, and URLs. Do not send private keys, seed phrases, recovery phrases, passcodes, backup codes, signed transactions, raw transactions, or signing payloads.


# Security, Bridge, Token & Wallet API
Source: https://docs.nshield.org/index

Security checks, Solana to Hyperliquid Perps routes, and on-chain intelligence APIs for Solana products.

<CardGroup>
  <Card title="Security Model" icon="shield-check" href="/concepts/security-model">
    Score tokens, wallets, dapps, transactions, and addresses before they reach users.
  </Card>

  <Card title="Nova Bridge" icon="arrow-left-right" href="/concepts/nova-bridge">
    Move SOL or USDC between Solana and Hyperliquid Perps with wallet-ready route plans.
  </Card>

  <Card title="Token & Wallet Intelligence" icon="database" href="/reference/overview">
    Search tokens, inspect wallets, follow trades, and read market signals from one Solana API.
  </Card>
</CardGroup>

<CodeGroup>
  ```bash Token risk theme={"dark"}
  curl "https://api-nova.tech/v1/security/token-risk" \
    -H "Content-Type: application/json" \
    -d '{
      "mint": "So11111111111111111111111111111111111111112"
    }'
  ```

  ```json Response theme={"dark"}
  {
    "riskLevel": "low",
    "score": 12,
    "summary": "This token has normal metadata and verified-token signals.",
    "reasons": [
      { "code": "verified_asset", "message": "Known or verified token metadata was found." }
    ]
  }
  ```
</CodeGroup>

## Built for Solana product teams

Nova is built for wallets, dashboards, agents, and trading products that need clear answers before showing users a token, wallet, dapp, or transaction.

* Is this token safe enough to show?
* What does this wallet own?
* What did this wallet trade?
* What tokens are moving right now?
* Which addresses or apps need a warning?

Nova packages security context, Hyperliquid Perps routes, and on-chain intelligence into simple public endpoints with request caps, rate limits, and production-safe logging.

## API Sections

<CardGroup>
  <Card title="Security Model" icon="shield-check" href="/concepts/security-model">
    Risk checks for tokens, wallets, dapps, transactions, and addresses.
  </Card>

  <Card title="Nova Bridge" icon="arrow-left-right" href="/concepts/nova-bridge">
    Solana to Hyperliquid Perps and Hyperliquid Perps to Solana routes.
  </Card>

  <Card title="On-chain Intelligence" icon="database" href="/reference/overview">
    Token discovery, wallet intelligence, trades, leaderboards, prices, charts, and market signals.
  </Card>
</CardGroup>

## Get Started

<CardGroup>
  <Card title="Make your first request" icon="terminal" href="/quickstart">
    Try a branded playground request with a token mint or public wallet address.
  </Card>

  <Card title="Understand authentication" icon="key-round" href="/concepts/authentication">
    Public API requests are open and protected by strict rate limits.
  </Card>

  <Card title="Choose an API surface" icon="panel-top" href="/concepts/api-surface">
    Start with security APIs, Nova Bridge, or data intelligence APIs.
  </Card>

  <Card title="Review safe inputs" icon="shield-check" href="/concepts/disabled-and-private">
    Use public-chain identifiers only: addresses, mints, signatures, and app URLs.
  </Card>
</CardGroup>

<Note>
  Nova works with public-chain identifiers. Keep recovery phrases, private keys, passcodes, and backup codes out of requests; wallet approvals and signing stay in the wallet.
</Note>


# Canada Users
Source: https://docs.nshield.org/ios/canada-users

Availability information for Nova Wallet users in Canada

## Canada Availability

Nova Wallet is available in Canada.

Canadian users can use wallet features, portfolio views, sends, receives, security checks, and swaps where the selected provider supports the requested assets.

Nova applies the same global swap policy in Canada as in every other country and does not add a Canada country-level block. A provider can still reject an individual route under its own asset, liquidity, or compliance requirements.


# Compliance & Availability
Source: https://docs.nshield.org/ios/compliance

App Store distribution and provider availability

## Overview

App Store distribution and provider-level transaction availability are different. Storefront settings, NOVA configuration, provider terms, and applicable requirements can change; confirm the current App Store and in-app result before relying on a route.

## App Store Availability

Nova Wallet is **available in Canada and the United Kingdom**. Users there can use wallet features, portfolio views, sends, receives, security checks, and swaps where the selected provider supports the requested assets.

### Mainland China

Nova Wallet is **not available in mainland China**. App Store distribution and all Nova Wallet features are unavailable there, including app access, swaps, Nova Bridge, fiat providers, Privacy Cash, portfolio views, and other app services.

The app is **disabled** in the following 13 countries:

| Country        | Status        |
| -------------- | ------------- |
| Belarus        | Not Available |
| Russia         | Not Available |
| Ukraine        | Not Available |
| Algeria        | Not Available |
| India          | Not Available |
| Iraq           | Not Available |
| Libya          | Not Available |
| Yemen          | Not Available |
| Bolivia        | Not Available |
| Mainland China | Not Available |
| Japan          | Not Available |
| Nepal          | Not Available |
| Pakistan       | Not Available |

The app is available in all other countries not listed above. App Store distribution is separate from swap routing policy.

## Swap Feature Availability

Nova does not apply a country-level swap block. Swaps are enabled globally, including in Canada and the United Kingdom. Request-IP country data is used for telemetry and provider context only; it does not disable Nova's swap surfaces.

A selected provider may still reject an individual request under its own asset, liquidity, sanctions-target, or compliance controls. That provider response applies to the specific route and does not create a Nova country block.

## Current-information boundary

* **App Store distribution**: Check the storefront associated with your Apple Account
* **Provider routes**: Asset, liquidity, account, sanctions, and compliance checks can affect individual requests
* **Updates**: Provider coverage may change over time
* **Contact**: For compliance questions, contact [hi@nshield.org](mailto:hi@nshield.org)

## Notes

* Wallet functionality (send/receive) is available in all jurisdictions where the app is available, including Canada and the United Kingdom
* Mainland China is a full app-unavailability jurisdiction; feature-level availability does not apply there
* Nova has no country-level swap restriction; provider-level route decisions remain separate
* This information is updated regularly to reflect current compliance requirements


# Fiat Provider Availability
Source: https://docs.nshield.org/ios/fiat-onramp

Review the current provider, quote, identity checks, fees, and regional limits before buying or selling crypto

## How fiat routes work

NOVA may show quotes from supported third-party fiat providers. The selected provider—not NOVA—hosts the payment flow, determines identity-verification requirements, accepts or rejects the order, and applies its current terms, payment-method coverage, fees, limits, and regional restrictions.

A provider name appearing in the app or in older documentation does not establish that the provider is available for your asset, payment method, account, or location today.

## Review before continuing

1. Confirm the provider name and hosted domain.
2. Check the fiat amount, crypto amount, exchange rate, every displayed fee, and the destination wallet address.
3. Read the provider's current terms, privacy notice, refund or cancellation policy, and eligibility rules.
4. Complete identity checks only on the provider's authentic hosted flow.
5. Keep the provider order identifier and follow its status until the provider and destination network report completion.

## Availability and pricing

Provider coverage can vary by country, state or province, asset, fiat currency, payment method, order size, risk review, sanctions screening, and changing provider policy. Check the current in-app quote and provider checkout rather than relying on a copied country or license table.

The quote may include provider, payment, card, bank, spread, network, or service costs. A displayed estimate can expire or change before purchase. Stop if the provider, destination, amounts, or fees do not match what you intended.

## Security boundary

NOVA does not need your recovery phrase or private key for a hosted fiat order. Never enter either into a provider checkout, support form, email, or chat. A completed payment, provider acceptance, asset broadcast, network confirmation, and final wallet balance are separate states.

## Need help?

For a payment, verification, refund, or provider-account issue, use the provider's support channel and order identifier. For a NOVA app-routing issue, use the in-app support form or email [hi@nshield.org](mailto:hi@nshield.org) without sending wallet secrets.


# iOS Help Center
Source: https://docs.nshield.org/ios/help-center

Support topics for Nova Wallet on iOS

Nova Wallet keeps common iOS support topics in one place so the sidebar stays focused and app-review links continue to resolve.

## Support

In Nova Wallet, open **Settings > Support > Help Center** for in-app help and support options.

<AccordionGroup>
  <Accordion title="Contact support" icon="message-circle">
    Use the in-app support form when possible so your request includes the right app context.

    If you cannot access the form, email [hi@nshield.org](mailto:hi@nshield.org).
  </Accordion>

  <Accordion title="Network fees" icon="coins">
    Solana transactions require a small network fee paid in SOL. Nova shows the estimated fee before you submit a transaction.

    Network fees go to the Solana network. Nova product fees, when shown in-app, are listed separately before confirmation.
  </Accordion>

  <Accordion title="Transaction status" icon="activity">
    Transaction details show the state NOVA has observed. A prepared request, provider acceptance, signed submission, confirmation, and finality are different states.

    A timeout or missing status is not proof of failure. Before retrying a value-moving action, check the exact signature, provider status, destination balance, and current network explorer record to avoid a duplicate submission.
  </Accordion>

  <Accordion title="Watch-only wallets" icon="eye">
    Watch-only wallets let you monitor a public Solana address without importing keys.

    They are read-only. You can view balances, holdings, and activity, but you cannot sign messages or send transactions from a watch-only wallet.
  </Accordion>

  <Accordion title="Swaps and slippage" icon="repeat-2">
    Slippage tolerance controls how much the execution price may move before a swap fails.

    There is no universal safe value. Review the input, expected and minimum output, route, fees, price impact, and current tolerance before signing. An unexpectedly high requirement is a reason to stop and investigate, not merely widen the limit.

    Current availability depends on NOVA configuration and the selected provider's asset, liquidity, account, and compliance requirements. Check the in-app route rather than relying on an older country statement.
  </Accordion>

  <Accordion title="Solana order automations" icon="timer">
    Nova supports early-access limit, take-profit, stop-loss, and take-profit plus stop-loss orders for selected Solana assets.

    Learn what stays in your wallet, what permission you grant, how a fill works, and why a crossed target is not a guaranteed execution in [Solana Order Automations](/ios/solana-order-automations).
  </Accordion>

  <Accordion title="Token verification" icon="badge-check">
    Nova displays token and wallet risk signals when available. These checks can flag suspicious metadata, risky authorities, low-liquidity behavior, or other indicators.

    A checkmark or low-risk result does not prove that a token is authentic, liquid, sellable, or safe. Verify the exact chain and mint or contract address with an authoritative project source, and treat warnings as a reason to stop and investigate.
  </Accordion>

  <Accordion title="Safari extension" icon="compass">
    Nova's Safari extension lets you connect to supported Solana apps from Safari.

    The scanner applies local origin checks and sends the normalized site origin—not the full page path—to NOVA's dApp and phishing services. A scan can be incomplete, stale, unavailable, or wrong. Verify the origin and every approval independently.
  </Accordion>

  <Accordion title="Recovery phrase safety" icon="key-round">
    Your recovery phrase controls access to your wallet. Nova support will never ask for it.

    Keep an offline backup or use NOVA's explicit encrypted-backup flow. Never place the phrase in unencrypted cloud storage, chat, email, notes, websites, or support forms. If it may be exposed, assume the wallet is compromised and move assets to a new phrase as soon as it is safe to do so.
  </Accordion>
</AccordionGroup>

## Dated product evidence

* [Privacy-preserving Solana wallet comparison](https://www.nov.ag/best-private-solana-wallets-iphone.html)
* [Safari Solana wallet comparison](https://www.nov.ag/best-solana-wallets-safari-iphone.html)
* [Transaction-preview comparison](https://www.nov.ag/best-solana-wallets-transaction-simulation-iphone.html)
* [NOVA wallet fact record](https://www.nov.ag/nova-wallet-facts.json)


# Privacy-Preserving Solana Transfers
Source: https://docs.nshield.org/ios/private-cash

Understand supported private-transfer flows, observable data, fees, and limits

## What are privacy-preserving transfers?

NOVA provides supported Solana transfer routes designed to reduce the direct public link between the source and destination. This is a narrower claim than complete anonymity or “zero trace.” Solana remains a public ledger, and amounts, timing, provider records, network data, or later wallet activity may reveal relationships.

## Review flow

1. Choose a supported privacy-preserving transfer route.
2. Enter and verify the destination and amount.
3. Review route availability, fees, provider terms, and any displayed limits.
4. Authorize the exact wallet request shown by NOVA.
5. Follow the in-app status until the route reports completion. A prepared request, accepted provider job, broadcast transaction, and finalized transaction are different states.

## What may remain observable?

* Public funding, withdrawal, or destination activity used by the selected route
* Transaction amounts and timing that can support correlation
* Wallet activity before or after the private-transfer flow
* Network and service metadata handled under the applicable provider policies

## Fees and availability

Network, route, provider, and service fees can vary. Review the current in-app breakdown before signing; an older percentage in documentation is not a quote. Asset, amount, provider, region, and liquidity limits may also apply.

## Safety and legal limits

Privacy-preserving transfers do not make a bad destination safe, reverse an incorrect transfer, or protect a compromised recovery phrase. Verify the address and terms, start with a small amount when testing a new route, and comply with applicable laws.

Compare current public evidence in the [private Solana wallet guide](https://www.nov.ag/best-private-solana-wallets-iphone.html).


# Solana Order Automations
Source: https://docs.nshield.org/ios/solana-order-automations

How Nova's wallet-native limit, take-profit, stop-loss, and OCO orders work, including permissions, fees, and early-access limits.

Nova Order Automations are Nova's early, first-of-its-kind wallet-native system for limit, take-profit, stop-loss, and take-profit plus stop-loss orders on Solana.

You choose the amount and target, review the terms, and sign the order in Nova. Your tokens stay in your wallet's token account until a successful fill moves them as part of one atomic Solana transaction.

<Note>
  **Early access:** Order Automations are live technology with limited rollout and asset coverage. Once Nova shows an order as active from finalized chain state, Solana has recorded its rules. That does not guarantee that Nova will detect the target or complete a fill. Start with an amount you can monitor and use the current in-app review as the source of truth.
</Note>

## What you can automate

| Order                   | What Nova attempts                                                                                                |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Limit                   | Swap at your selected target or better.                                                                           |
| Take profit             | Sell when the selected asset reaches or exceeds your target.                                                      |
| Stop loss               | Sell when the selected asset reaches or falls below your target.                                                  |
| Take profit + stop loss | Watch both targets. The first successful full fill completes the order and prevents the other leg from executing. |

Order Automations are for spot swaps. They are not perpetual positions, margin orders, or guaranteed-price orders.

## What wallet-native means

Nova does not ask you to deposit tokens into a trading vault. The tokens remain in a token account owned by your wallet until execution.

When you sign an order, you grant Nova's on-chain executor a limited token allowance for the total amount reserved by your active orders. This is real spending permission, but it is not custody or an unlimited approval. Think of it as a narrow automation rulebook:

* Your wallet signs the create, edit, cancel, and cleanup actions.
* Nova never receives your recovery phrase or private key.
* The on-chain program binds the allowance to your wallet, source token account, mint, and reserved amount.
* Each order commits to its input, output, destination, amount, expiry, trigger, and minimum-output protection.
* A keeper can attempt the fill you defined, but it cannot redirect the output or rewrite the order.

Nova's current mainnet executor program is:

```text theme={"dark"}
AutokaWGtLnKZZYFZPrbQWMgohv91DyA4A8BPuzVqaJV
```

## How a fill works

1. **You create the order.** Nova builds the order locally, simulates it, shows the review, and asks your wallet to sign.
2. **Solana records the rules.** Nova waits for the owner-signed mutation to finalize, then verifies the canonical on-chain order before monitoring it.
3. **Nova watches the condition.** Price updates wake an isolated keeper, while periodic checks provide a fallback.
4. **The keeper verifies again.** It reloads finalized order state, requests a current Jupiter route, validates the route, and simulates the complete fill.
5. **The on-chain program decides.** It checks the signed commitment, accounts, allowance, amount, expiry, trigger, route, fee, and minimum output.
6. **Everything succeeds or nothing changes.** The input transfer, swap, output settlement, fee, and order-state update happen atomically. Nova does not partially fill an order.

The API's price observation is a signal to attempt execution, not permission to bypass the rules you signed.

## How Nova checks trigger prices

Nova uses two trigger models depending on the asset:

* **On-chain oracle triggers:** For supported markets, the executor can verify a Pyth price threshold on-chain, including freshness and confidence limits.
* **Keeper-timed triggers:** For other supported assets, Nova's isolated keeper decides when the displayed market price reaches the target. The on-chain program still enforces the exact pair, amount, destination, approved route, expiry, fee, and output floor. It does not independently prove the off-chain market price.

This distinction matters most for take-profit and stop-loss orders on long-tail assets. Review the target and execution protection separately: the target decides when Nova attempts the order, while the minimum output and current liquidity decide whether the swap can complete.

## Why a crossed target may not fill

A target price is not a reservation of liquidity. An order can remain open or fail to execute when:

* the price touches the target too briefly to observe and complete the transaction;
* Jupiter cannot provide a valid route for the full amount;
* the price moves beyond the allowed execution protection before landing;
* the source balance is too low, or the token account is frozen, closed, or delegated differently;
* another active order or wallet transaction uses the same available balance;
* the token no longer passes Nova's supported-asset policy;
* Solana, RPC, price, routing, or keeper infrastructure has a delay or outage; or
* the order expires, you cancel it, or another transaction finalizes first.

Nova prefers a failed attempt over a partial fill or a fill outside the rules enforced by the executor.

## Fees and network costs

Nova's Order Automation fee is **0.50% of a successful fill**. It is one Nova fee, not an additional fee stacked on top of a second Jupiter platform fee. There is no Nova protocol fee for creating, editing, canceling, expiring, or unsuccessfully attempting an order.

The quoted route can also include decentralized-exchange or liquidity-pool trading fees, price impact, and movement within your execution protection. These affect how much you receive, but they are not additional Nova fees.

Solana network fees and account rent are separate. They can apply when you create, edit, cancel, or clean up an order. Some rent may be recoverable when order accounts are closed. Review the exact current amounts in Nova before signing.

## Supported assets and wallets

* Order Automations are available only on Solana and only for assets and pairs Nova currently supports.
* Nova uses wrapped SOL inside the token-account flow.
* Nova supports standard SPL tokens and a narrow set of simple Token-2022 assets. It rejects tokens with freeze authority, transfer fees, hooks, or untested extensions.
* You need a signing wallet. Watch-only and demo wallets cannot create or change orders.
* Minimum order sizes, active-order limits, asset coverage, and rollout access can change as Nova gathers early-access evidence.

If Nova cannot safely validate the asset, accounts, route, or order state, it stops instead of guessing.

## Your controls

You can edit or cancel an active order with a new wallet signature. A cancellation is complete only after Solana finalizes it; hiding a row or closing the app does not cancel an on-chain order.

If order setup stops before it finishes, Nova may show **Resume** or **Clean Up Order Setup**. Use those actions to finish or safely unwind the recorded setup instead of creating the same order again.

You still control the source token account and can move or spend its balance. Doing so may leave an order unable to fill until you cancel, edit, fund, or clean it up.

## Plain-language early-access disclosure

Order Automations combine a mobile wallet, an on-chain program, market data, Jupiter routing, an isolated keeper, Solana RPC, and network finality. That design keeps control in your wallet and adds strong transaction-level checks, but it also has more moving parts than a normal swap.

Nova continues to test reliability, route coverage, recovery, and monitoring. Do not treat an open order, a target crossing, an accepted request, or a submitted transaction as a completed trade. Check the finalized order history and wallet balance.

Order Automations are execution tools, not financial advice, custody, or a promise of price or execution.

<Card title="Download Nova" icon="download" href="https://apps.apple.com/us/app/nova-solana-wallet/id6753857720">
  Create and manage supported Solana Order Automations from a signing wallet in Nova.
</Card>


# UK Users
Source: https://docs.nshield.org/ios/uk-users

Important risk information for UK users regarding cryptoasset investments

## UK Risk Summary

**Estimated reading time: 2 min**

Nova Wallet is available in the United Kingdom, including swaps where the selected provider supports the requested assets. Nova applies the same global swap policy in the United Kingdom as in every other country and does not add a UK country-level block.

Due to the potential for losses, the Financial Conduct Authority (FCA) considers this investment to be high risk.

***

## What are the key risks?

### 1. You could lose all the money you invest

* The performance of most cryptoassets can be highly volatile, with their value dropping as quickly as it can rise. You should be prepared to lose all the money you invest in cryptoassets.
* The cryptoasset market is largely unregulated. There is a risk of losing money or any cryptoassets you purchase due to risks such as cyber-attacks, financial crime and firm failure.

### 2. You should not expect to be protected if something goes wrong

* The Financial Services Compensation Scheme (FSCS) doesn't protect this type of investment because it's not a 'specified investment' under the UK regulatory regime – in other words, this type of investment isn't recognised as the sort of investment that the FSCS can protect. [Learn more by using the FSCS investment protection checker](https://www.fscs.org.uk/check/investment-protection-checker/).
* The Financial Ombudsman Service (FOS) will not be able to consider complaints related to this firm. [Learn more about FOS protection](https://www.financial-ombudsman.org.uk/).

### 3. You may not be able to sell your investment when you want to

* There is no guarantee that investments in cryptoassets can be easily sold at any given time. The ability to sell a cryptoasset depends on various factors, including the supply and demand in the market at that time.
* Operational failings such as technology outages, cyber-attacks and comingling of funds could cause unwanted delay and you may be unable to sell your cryptoassets at the time you want.

### 4. Cryptoasset investments can be complex

* Investments in cryptoassets can be complex, making it difficult to understand the risks associated with the investment.
* You should do your own research before investing. If something sounds too good to be true, it probably is.

### 5. Don't put all your eggs in one basket

* Putting all your money into a single type of investment is risky. Spreading your money across different investments makes you less dependent on any one to do well.
* A good rule of thumb is not to invest more than 10% of your money in high-risk investments.

If you are interested in learning more about how to protect yourself, visit the [FCA's website](https://www.fca.org.uk/investsmart).

For further information about cryptoassets, visit the [FCA's website](https://www.fca.org.uk/consumers/cryptoassets).

***

## Asset Category Overviews

Crypto-assets differ significantly in design, purpose, legal treatment, and risk exposure. Understanding these distinctions is essential for informed decision-making. The following summaries outline the principal risk considerations for major categories of digital assets.

### Stablecoins

Stablecoins are crypto-assets whose value is pegged to fiat currency or other reserve assets.

| Risk                  | Description                                                     |
| --------------------- | --------------------------------------------------------------- |
| **Counterparty risk** | Third party may become insolvent or fail to maintain collateral |
| **Redemption risk**   | May not be redeemable during market volatility                  |
| **Collateral risk**   | Backing assets could decline in value                           |
| **FX risk**           | Exposure to currency exchange rate movements                    |
| **Algorithm risk**    | Stability mechanisms could fail catastrophically                |

### DeFi Tokens

DeFi tokens are crypto-assets linked to decentralized finance protocols built on blockchain technology.

| Risk                    | Description                                                  |
| ----------------------- | ------------------------------------------------------------ |
| **Smart contract risk** | Coding errors can be exploited causing significant losses    |
| **Regulatory risk**     | New regulations may impact legality or value of protocols    |
| **Rug-pulls**           | Developers may abandon projects and withdraw funds           |
| **Oracle risk**         | External data manipulation can cause unintended outcomes     |
| **Complexity**          | Difficult for users to fully understand mechanisms and risks |

### Wrapped Tokens

Wrapped tokens are tokenized representations of other crypto-assets created for cross-chain compatibility.

| Risk                    | Description                                                             |
| ----------------------- | ----------------------------------------------------------------------- |
| **Smart contract risk** | Contract vulnerabilities could be exploited leading to loss of funds    |
| **Collateral risk**     | Mechanisms ensuring asset backing may fail                              |
| **Custodial risk**      | Third party holding underlying assets may become insolvent or be hacked |
| **Bridging risk**       | Technical issues may prevent transfers between blockchains              |
| **Pricing disparity**   | Price may diverge from underlying asset value                           |

### Meme Coins

Meme coins are crypto-assets whose value is driven primarily by community interest and online trends.

| Risk                     | Description                                                                                    |
| ------------------------ | ---------------------------------------------------------------------------------------------- |
| **Volatility risk**      | Extreme and unpredictable price fluctuations driven by social media and celebrity endorsements |
| **Lack of utility**      | No intrinsic value or practical use case                                                       |
| **Market manipulation**  | Susceptible to pump-and-dump schemes with artificial price inflation                           |
| **Lack of transparency** | Limited information on development teams and goals                                             |
| **Emotional investing**  | Strong reactions lead to impulsive, loss-amplifying decisions                                  |

### Staked Assets

Staked assets are crypto-assets locked on blockchain protocols to secure networks and earn rewards.

| Risk                    | Description                                                                                           |
| ----------------------- | ----------------------------------------------------------------------------------------------------- |
| **Slashing risk**       | Network may penalize your validator for errors, causing loss of assets                                |
| **Liquidity risk**      | Assets locked for extended periods cannot be accessed or sold quickly                                 |
| **APY not guaranteed**  | Reward rates are determined by protocols and fluctuate over time                                      |
| **Protocol risk**       | Network updates and changes may introduce new vulnerabilities or unforeseen outcomes                  |
| **Smart contract risk** | Vulnerabilities in staking contracts could be exploited, resulting in loss of staked funds or rewards |

***

If you are interested in learning more about how to protect yourself, visit the [FCA's website](https://www.fca.org.uk/investsmart).

For further information about cryptoassets, visit the [FCA's website](https://www.fca.org.uk/consumers/cryptoassets).


# Quickstart
Source: https://docs.nshield.org/quickstart

Try Nova with a token risk check, Solana to Hyperliquid Perps route, token search, and public wallet intelligence request.

Use this public base URL:

```text theme={"dark"}
https://api-nova.tech
```

## 1. Make A Public Request

Public API requests do not require an API key:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/data/tokens/search?query=bonk"
```

The docs playground uses the same simple shape. For user context, pass a public wallet address.

## 2. Start With Security

Check a token before you show it:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/security/token-risk" \
  -H "Content-Type: application/json" \
  -d '{ "mint": "So11111111111111111111111111111111111111112" }'
```

## 3. Send SOL To Hyperliquid Perps

Build a wallet-ready route from Solana into Hyperliquid Perps:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/bridge/solana-to-hyperliquid-perps" \
  -H "Content-Type: application/json" \
  -d '{
    "solanaAddress": "9xQeWvG816bUx9EPfQ5D9b8fRGyJitf8F6f4fH6QJjAo",
    "hyperliquidAddress": "0xf3d63166f0ca56c3c1a3508fce03ff0cf3fb691e",
    "amount": "0.1",
    "asset": "SOL"
  }'
```

Use `POST /v1/bridge/hyperliquid-perps-to-solana` to bring Hyperliquid Perps USDC back to Solana.

## 4. Add Wallet Data

Load a wallet by public address:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/data/wallets/9xQeWvG816bUx9EPfQ5D9b8fRGyJitf8F6f4fH6QJjAo"
```

Search tokens when you need discovery:

```bash theme={"dark"}
curl "https://api-nova.tech/v1/data/tokens/search?query=bonk"
```

## 5. Add Market Context

```bash theme={"dark"}
curl "https://api-nova.tech/v1/data/tokens/trending"
```

Use public wallet addresses, token mints, transaction signatures, or URLs. Do not send private keys, seed phrases, recovery phrases, passcodes, backup codes, or signing payloads.

## 6. Respect Limits

Every endpoint has practical rate limits and request limits so the playground stays fast and reliable.


# Token & Wallet Intelligence
Source: https://docs.nshield.org/reference/overview

On-chain intelligence APIs for Solana token discovery, wallet profiles, trades, prices, charts, and market signals.

Token & Wallet Intelligence is Nova's public on-chain data layer.

Use it when your app needs clean answers about tokens, wallets, trades, or market movement without building a whole indexing stack first.

The main identifiers are simple: public wallet addresses, token mints, and transaction signatures.

## What It Includes

| Area        | What it gives you                                           |
| ----------- | ----------------------------------------------------------- |
| Token Data  | Search, trending tokens, token profiles, prices, and charts |
| Wallet Data | Wallet overview, holdings, trades, and recent activity      |
| Trader Data | Leaderboards, live trade feed, and token signals            |

## Base URL

```text theme={"dark"}
https://api-nova.tech
```

Public endpoints do not require an API key or Authorization header. They are protected with rate limits, request caps, and abuse monitoring.

## What To Build

Token & Wallet Intelligence is useful for:

* Token discovery pages
* Wallet intelligence tools
* Trading dashboards
* Copy-trading research
* Wallet-aware agents
* Portfolio summaries
* Market alerts

Start with wallet overview, token search, trending tokens, or market signals. Send a public wallet address or token mint and return a Nova response in your app.