Platform & ecosystem API

The remaining route groups — roughly 50 mounts under /api. This page is a directory rather than an endpoint reference; most of these modules document themselves in ad-hoc markdown inside bz-backend.

Mount table: bz-backend/routes/index.js.

Full mount table

Mount	Route file	Domain
/api/common	common.routes.js	Shared utilities
/api/app	appRoutes.js	App metadata
/api/auth	authRoutes.js	Login, SIWE, tokens
/api/user	userRoutes.js	Users, usernames, referrals
/api/admin	admin.routes.js	Admin
/api/defi	defi.routes.js	Trading, providers, fiat, perps, DCA, Autopilot
/api/transaction	transactionRoutes.js	Generic transactions
/api/balance	balance.routes.js	Balances
/api/wallet	wallet.routes.js	Wallet operations
/api/graph	graph.routes.js	Chart data
/api/cmc	cmc.routes.js	CoinMarketCap proxy
/api/currency	proxy.routes.js	Currency proxy
/api/bridge	bridge.js	Bridge helpers
/api/qubetics	qubeticsRoutes.js	Qubetics chain
/api/liquidity	liquidityRoutes.js	Liquidity (product unshipped)
/api/payment	paymentRoutes.js	Payments
/api/product	productRoutes.js	Product catalogue
/api/cart	cartRoutes.js	Cart
/api/marketplace	marketplaceRoutes.js	NFT marketplace
/api/nft	nftRoutes.js + nftMetadataRoutes.js	NFTs — mounted twice
/api/mint	mintRoutes.js	Minting
/api/pinata	pinataRoutes.js	IPFS pinning (mounted separately, not via routes/index.js)
/api/staking	stakingRoutes.js	Token staking
/api/rocket	rocketRoutes.js	BlazRocket
/api/blazbob	blazBobRoutes.js	BlazBob
/api/reward	rewardRoutes.js	Rewards
/api/rewards	rewardsRoutes.js	Rewards hub
/api/claim	claimRoutes.js	Claims
/api/task	dailyTaskRoutes.js	Daily tasks
/api/daily-updates	dailyUpdateRoutes.js	Update log
/api/entryPass	entryPassRoutes.js	Entry pass NFT
/api/game	gameRoutes.js	Games
/api/prediction	predictionRoutes.js	Prediction markets
/api/poker	pokerRoutes.js	Poker
/api/dao	daoRoutes.js	DAO
/api/presale	presaleRoutes.js	Presale
/api/presale/admin	presaleAdminRoutes.js	Presale admin
/api/whitelist	whitelist.routes.js	Whitelists
/api/clippers	clippersRoutes.js	Clippers — also at /api/v1/clippers
/api/smm	smmRoutes.js	Social media management
/api/blogs	blogRoutes.js	Blog
/api/threads	threadRoutes.js	Forums
/api/chats	chatRoutes.js	User-to-user chat
/api/questions	questionRoutes.js	Q&A
/api/support	supportRoutes.js	Support tickets
/api/supportForDasboard	supportRoutesForDashboard.js	Dashboard support — typo in the live path
/api/submit	submit.routes.js	Submissions
/api/notifications	notificationsRoutes.js	In-app notifications
/api/fcm	fcmNotificationRoutes.js	Push (Firebase)
/api/ses	sesEmail.routes.js	Email (AWS SES)
/api/bulk-email	bulkEmail.routes.js	Bulk email
/api/webhooks	webhookRoutes.js	Inbound webhooks
/api/video	video.routes.js	Video
/api/ext	extension.routes.js	Browser extension
/api/lightLink	lightLinkRoutes.js	LightLink chain
/api/lightLinkReward	lightLinkRewardRoutes.js	Bridge-usage campaigns
/api/ca	caRoutes.js	Smart-contract accounts
/api/migration	migrationRoutes.js	Migrations
/api/kanban	kanbanRoutes.js	Internal kanban
/api/misc	miscRoutes.js	Miscellaneous
/api/debug-stats	inline	Debug — no middleware

System settings

The platform's feature-flag and limit store. Prefer it over a new config collection.

await SystemSetting.getValue('audit_free_limit_per_wallet')      // default 3
await SystemSetting.setValue('audit_free_limit_per_wallet', 5)
await SystemSetting.getByCategory('limits')

Categories: bridge, security, network, fees, limits, general. Model: models/systemSettingModel.js.

Four Autopilot settings are seeded by scripts/seed-autopilot-settings.js.

Env var vs system setting

Changing an env var needs SSH and a restart. Changing a system setting is a database write. Use env vars for secrets and infrastructure; use system settings for limits and flags.

Rewards & staking

GET /api/rocket/status returns, per staked rocket: tokenId, level, isStaked, stakedAt, lastClaimTime, streakDays, longestStreak, plus:

Field	Meaning
claimablePoints	Available now
currentRatePerHour	Base plus active bonuses
maxDailyCap / remainingDailyCap	Daily ceiling and headroom
nextClaimAvailableIn	Minutes; 0 = ready
rocketImage, upgradeImages	Rendered assets per upgrade slot

POST /api/rocket/claim with { rocketId }. Auth: Bearer token.

Claims are entirely off-chain

Zero gas, instant balance update. NFT ownership and staking state are on-chain; points accrual is a backend calculation. That is what makes daily claiming viable at small amounts — and it means the platform is trusted for the points ledger.

Frontend rule: enable the claim button when nextClaimAvailableIn === 0 and claimablePoints > 0.

In-repo docs: ROCKET_REWARDS_README.md, ROCKET_CLAIMING_PROCESS_README.md, ROCKET_UPGRADE_GUIDE_ANNOUNCEMENT.md, blazbob_staking_guide_hemi.md, REWARDS_HUB_REVAMP_PLAN_2026-06.md.

Prediction markets

Tuned entirely by environment variable:

Variable	Effect
PREDICTION_MIN_STAKE, PREDICTION_MAX_STAKE	Bet bounds
PREDICTION_DAILY_LIMIT	Per-user daily cap
PREDICTION_LOCK_BEFORE_END_SECONDS	Betting cutoff
PREDICTION_{MIN,MAX}_{UP,DOWN}_POOL	Pool bounds
PREDICTION_SEED_ENABLED, PREDICTION_FAKE_PARTICIPANTS	Synthetic seeding

PREDICTION_FAKE_PARTICIPANTS seeds synthetic participants

Whatever the product rationale, know it exists before making any claim about market depth or participation.

Settlement: services/predictionCron.js via initPredictionCron().

Poker

contracts/poker/PokerManager.sol on-chain; table state and dealing in the backend; hand history in models/pokerHandHistory.js. Realtime over a Socket.io namespace.

Variable	Effect
POKER_PLATFORM_FEE_ENABLED, POKER_PLATFORM_FEE_BPS	Rake
POKER_FEE_TO, POKER_ESCROW_TO	Destinations

In-repo docs: poker.md, pokerFrontend.md, SOCKET_DEBUG_GUIDE.md.

Analytics APIs

Two dedicated specs at the defi-set root:

Document	Covers
TOKEN_PAYMENT_ANALYTICS_API.md	tokenPaymentModel analytics
TRANSACTION_V2_ANALYTICS_API.md	transactionV2Model analytics

Microservice routing toggles

Several modules can be proxied to separate services rather than handled in-process:

REWARDS_HUB_FORCE_PROXY, REWARDS_HUB_PROXY_GROUPS, REWARDS_HUB_PROXY_PREFIXES, REWARDS_ADMIN_FORCE_PROXY, REWARDS_ADMIN_PROXY_GROUPS, REWARDS_ADMIN_NATIVE_WRITE_GROUPS, THREADS_FORCE_PROXY, THREADS_PROXY_GROUPS, USE_LEGACY_REWARDS.

The monolith is partly split already

microservices-backend/, new-backend/ and gateway/ exist in the tree, and these flags route traffic away from the in-process handlers. None of those directories is mounted by routes/index.js — so the split is configuration-driven and partial. Check the flags before assuming where a request is served.

Socket.io

Four namespaces, not HTTP:

Namespace	Purpose
default	Chat and payments (chatAndPay.service.js)
priceNamespace	Price streaming
predictionNamespace	Prediction market updates
poker	Table state (pokerSocketHandler.js)

Auth: middleware/authSocketMiddleware.js. Redis adapter when available. See runtime topology.

Quest platform integrations

Variable	Platform
GALXE_API_KEY	Galxe — galxe.com is CORS-allowlisted
ZEALY_API_KEY	Zealy
INTRACT_API_KEY	Intract
SMM_API_KEY	Social media management

Route bugs to know

Bug	Detail
/api/supportForDasboard	Typo in a live path. Fixing it breaks whatever consumes it
/api/nft mounted twice	nftRoutes then nftMetadataRoutes — the second only serves paths the first does not claim
/api/clippers and /api/v1/clippers	Same route file, two mounts
GET /api/debug-stats	Registered before all middleware, deliberately. It is unauthenticated

Where the real documentation lives

For the ecosystem layer, these in-repo files are the authority:

bz-backend/
  ROCKET_REWARDS_README.md            ROCKET_CLAIMING_PROCESS_README.md
  ROCKET_UPGRADE_GUIDE_ANNOUNCEMENT.md
  blazbob_staking_guide_hemi.md       blazbob_unstaking_guide_hemi.md
  REWARDS_HUB_REVAMP_PLAN_2026-06.md  MODULE_BUSINESS_AUDIT_2026-06.md
  MARKETPLACE_INTEGRATION.md          CLIPPERS_API_SPEC.md
  FRONTEND_BLAZBOB_INTEGRATION.md     ROCKET_UPGRADE_GUIDE_ANNOUNCEMENT.md
  poker.md  pokerFrontend.md          SOCKET_DEBUG_GUIDE.md
  claimAll.md                         BACKEND_GUIDE_DAILY_UPDATES.md
  postman/                            docs/  examples/

postman/ holds request collections, which are often faster than reading a controller.