> ## Documentation Index > Fetch the complete documentation index at: https://docs.adipredictstreet.com/llms.txt > Use this file to discover all available pages before exploring further. # Add a whitelisted withdrawal address > Adds a destination to the whitelist. Once the wallet has ≥1 entry, withdrawals are allowed ONLY to listed addresses (opt-in — empty list = unrestricted). Entries are usable immediately (no cooldown). Cap 50/wallet. Rate-limited 30/min/wallet. ## OpenAPI ````yaml /api-reference/openapi.json post /api/me/withdrawal-security/whitelist openapi: 3.1.0 info: title: PredictStreet API description: >- Client-facing HTTP API for the PredictStreet prediction-market platform. **Partner kinds.** Every authenticated endpoint except the partner-level platform reads (`/api/platform/status`, `/notices`, `/maintenance`) resolves a request's *effective wallet* from the partner row. `single_wallet` partners bind to one `associatedWallet` set at creation. `multi_wallet` partners declare the actor on every request via an `X-User-Wallet: 0x<40-hex>` header. See the [Partner kinds](/auth/api-keys#partner-kinds) doc for the full contract. version: '2026-06-16' contact: name: PredictStreet partners email: partners@predictstreet.com servers: - url: https://core-api.adipredictstreet.com description: Production — replace with the API host issued at partner onboarding. security: [] tags: - name: Deposits description: >- Gasless USDC deposit relay - submit a signed EIP-2612 permit and the platform broadcasts the on-chain deposit for you (no gas). - name: Events description: >- Polymarket-style event grouping with football metadata (group, stage, teams, tags). - name: Tags description: Curated tag taxonomy used to filter events. - name: Markets description: 'Public market data: list, detail, orderbook, trades, OHLC.' - name: Crypto description: >- Crypto price markets: the underlying-asset price curve and Up/Down series navigation. The markets themselves are ordinary binary markets — list them through /api/markets and /api/events. - name: Orders description: >- Signed-order place / cancel / read. Requires `X-Api-Key` with `orders:read` / `orders:write` scope; every write additionally requires an EIP-712 signature over the order. - name: Portfolio description: >- Balances, positions, trades, fees, vault info for the key's `associatedWallet`. Requires `X-Api-Key` with `portfolio:read` scope. - name: Matches description: >- A match groups several events into one fixture/card (1X2 + first-scorer + over-under under one matchup). - name: Vault description: >- Backend co-signatures for ERC-1155 split / merge, and recovery for off-chain locks when the corresponding chain tx never confirmed. Requires `X-Api-Key` with `vault:write` scope plus an EIP-712 signature over the operation. - name: Leaderboard description: Public ranked leaderboard across PnL / volume buckets. - name: Search description: Global search across users, events, and matches. - name: Withdrawal Security description: >- Self-service withdrawal 2FA (TOTP) and withdrawal-address whitelist. Same endpoints serve the web app (user sessions) and API-key integrators. Mutations need `vault:write`, reads `portfolio:read`. Both are opt-in per wallet and only gate withdrawals once the platform enables withdrawal-security enforcement. - name: Platform description: >- Platform reference data and state. The contract registry and the fee configuration are public and need no key. The freeze flag (`/status`), active notices (`/notices`) and maintenance windows (`/maintenance`) need a partner API key in `X-Api-Key`. paths: /api/me/withdrawal-security/whitelist: post: tags: - Withdrawal Security summary: Add a whitelisted withdrawal address description: >- Adds a destination to the whitelist. Once the wallet has ≥1 entry, withdrawals are allowed ONLY to listed addresses (opt-in — empty list = unrestricted). Entries are usable immediately (no cooldown). Cap 50/wallet. Rate-limited 30/min/wallet. operationId: WithdrawalSecurity_addWhitelist parameters: - $ref: '#/components/parameters/UserWalletHeader' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AddWhitelistBody' responses: '201': description: Created. content: application/json: schema: $ref: '#/components/schemas/WhitelistEntry' '400': description: '`invalid_address` (not a 0x+40-hex EVM address).' content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- `address_already_whitelisted`, `whitelist_limit_reached` (50/wallet), or `account_provisioning` (acting wallet not yet provisioned — retry shortly). content: application/json: schema: $ref: '#/components/schemas/Error' security: - ApiKey: - vault:write components: parameters: UserWalletHeader: name: X-User-Wallet in: header required: false description: >- **Required for `multi_wallet` partners on every authenticated request; ignored for `single_wallet`.** Declares the acting end-user wallet for this request — drives KYC checks, balances/positions/orders attribution, rate-limit buckets, and audit. Lower-cased server-side. Missing on a multi_wallet key → 401 `api_key_user_wallet_required`; malformed → 401 `api_key_user_wallet_invalid`. The on-chain `CTFExchange`/`Vault` contracts still verify EIP-712 signer ↔ vault binding, so loosening API-layer attribution is safe by construction. schema: $ref: '#/components/schemas/EthereumAddress' example: '0x1234567890abcdef1234567890abcdef12345678' schemas: AddWhitelistBody: type: object required: - address properties: address: type: string description: >- Destination EVM address (`0x` + 40 hex). Any case accepted; stored lowercase. example: '0x1234567890abcdef1234567890abcdef12345678' label: type: string maxLength: 100 description: Optional user label, e.g. "My Ledger". example: My Ledger WhitelistEntry: type: object required: - id - address - label - createdAt properties: id: type: string format: uuid description: Entry id — pass to DELETE …/whitelist/{id}. address: type: string description: Destination EVM address, normalised lowercase. example: '0x1234567890abcdef1234567890abcdef12345678' label: type: - string - 'null' description: Optional user label, or null. example: My Ledger createdAt: type: string format: date-time Error: type: object description: >- Error body returned by every API error (same shape as `ErrorEnvelope`). Branch on `error.code`, not on `message`. required: - status - error properties: status: type: integer description: HTTP status, repeated in the body. example: 404 error: type: object required: - code - message properties: code: type: string description: >- Machine-readable code (e.g. `market_not_found`, `event_not_found`, `invalid_limit`). message: type: string trace_id: type: string description: Request trace id; quote it to support. May be absent. retryAfterSec: type: integer description: >- Seconds to wait before retrying, when the server says so (also sent as the `Retry-After` header). retryable: type: boolean description: >- Whether the same request may be sent again as it is. Absent when the server does not say. details: type: object additionalProperties: true description: >- Extra structured context thrown with the error, e.g. `slug`, `allowed`, `auditId`. EthereumAddress: type: string pattern: ^0x[a-fA-F0-9]{40}$ example: '0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb3' securitySchemes: ApiKey: type: apiKey in: header name: X-Api-Key description: >- Partner / integrator key — format `ps_live__`. Partner keys are issued by PredictStreet; a user can also create keys bound to their own wallet from their account settings in the web app. Never ship to a browser. `multi_wallet` partners must additionally send `X-User-Wallet: 0x<40-hex>` on every authenticated request to declare the acting wallet. See the [API keys guide](/auth/api-keys) for scope taxonomy, partner kinds, rate limits, and rotation procedure. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.