DFB API v2 is a single HTTP API in front of DFB swap routing, pool registry, vault strategies, and on-chain readers. Integrators see one contract; users never interact with v2 directly except through your app.

​
Integration model

┌─────────────────────────────────────────────────────────┐
│  Your app (mobile, web, custodial backend)              │
│  · UX, auth, wallet or custody                          │
└───────────────────────────┬─────────────────────────────┘
                            │ HTTPS /v2/*
┌───────────────────────────▼─────────────────────────────┐
│  DFB API v2                                             │
│  · Discovery · Quotes · Unsigned transactions · Reads   │
└───────────────────────────┬─────────────────────────────┘
                            │
         ┌──────────────────┼──────────────────┐
         ▼                  ▼                  ▼
   Swap routing        Pool / vault        On-chain reads
   & tx building       registry            (portfolio)
         │                  │                  │
         └──────────────────┴──────────────────┘
                            ▼
                    Blockchain networks

​
Product modules

ModuleWhat integrators use it for
DiscoveryNetworks, tokens, providers, pool/vault catalogs
SwapsToken swaps with executable quotes and swap transactions
PoolsList LP opportunities; add/remove liquidity (actions rolling out)
VaultsList strategies; deposit/withdraw (actions rolling out)
BridgesCross-chain moves (planned)
PortfolioBatch wallet balances; positions (rolling out)

​
Stateless quotes

The API does not store quote state in a database. Each quoteId is a signed, self-contained token with expiry. Any API instance can validate it — important for reliability and horizontal scale. Your app should treat quotes as short-lived: refresh before showing a final confirmation screen.

​
Security model for integrators

Public endpoints do not require integrator API keys. Protect your own backend as usual; do not expose custody keys to the client.
v2 never submits transactions with user keys. You control signing and broadcast — custodial or non-custodial.
Per-IP limits protect the shared API. High-volume integrators should discuss capacity with DFB.
Browser calls require an allowlisted origin. Server-to-server calls from your backend are unaffected.

​
Documentation

ResourcePurpose
This siteConcepts, workflows, integration guide, roadmap
API Reference tabInteractive OpenAPI — all routes and schemas
https://api.dfb.network/docsRedoc view of the same contract

​
TypeScript SDK

A first-party TypeScript SDK is on the roadmap to reduce boilerplate for quote/action flows in React, React Native, and Node backends. Until then, use OpenAPI-generated clients or direct fetch/axios calls — see Integration guide.