Endpoints & Regions

Use the regional base URLs below. All integration traffic is POST {base}/submit (create or sell) or GET {base}/ping.

Regional base URLs

Each region is an HTTPS origin whose path ends with /deploy. Requests use POST {base}/submit and GET {base}/ping (latency / health).

Sniper / sniper_wallets: send those requests to the NA-East base (https://nyc.j7tracker.io/deploy) even if you use another region for other calls.

POST /submit

• Body: JSON. Browsers often use Content-Type: text/plain;charset=UTF-8 with a JSON string to skip an extra CORS preflight; non-browser clients may use application/json.
• Auth (required): either
  • Authorization: Bearer <jwt>, or
  • the same JWT in the JSON field session_id.
• type: only create_token or sell_token are accepted on this route.
• username: taken from the JWT; any username in the body is overwritten to match the token.
• Timeout: up to 30 seconds for a final response, then 504 with optional last_status if partial status messages were received.

GET /ping

Returns plain text ok. No JWT or body — safe for simple GET from browsers (CORS is enabled on regional deploy hosts).

Keep-alive best practice (lower latency on /submit)

For integrations that care about time-to-first-byte on deploy (extensions, bots, custom clients), treat GET {base}/ping as a warm-path signal to the same regional base you use for POST {base}/submit:

1. Ping the region you deploy to — not only NA-East unless that is your chosen base (except sniper traffic, which must use NA-East per the table above).
2. Call /ping soon after startup, then on a steady interval while the integration is active (e.g. every 15–30 seconds). The J7Tracker app refreshes the selected region on about a 20s interval for the same reason.
3. Why it helps: repeated HTTPS requests reuse TCP and TLS session state where the stack allows it, so the next /submit is less likely to pay a full cold handshake. /ping is tiny, so cost is low.
4. Measure RTT — use round-trip time to /ping to pick or validate the best region (see the regional table).

If the client goes idle for a long time, one /ping before an important /submit is still better than nothing.

Security

• Use HTTPS in production.
• Never log or expose api_key or JWTs.
• api_key must be the encrypted key from J7Tracker (see How to get an API key), never a raw private key.