Jupiter developer docs: pages changed or added since May

| **Requires backend signing** | Integrator is required to proxy the request to their backend in order to sign the transaction (partially signed by user) before sending to `/execute` |

The backend signs client-supplied bytes with a funded payer key. A malicious client can swap in instructions that drain the payer.

Tell the backend to compare the transaction byte for byte against the one cached by requestId, or to parse it and refuse anything that debits the payer beyond fees and rent.

renew by updating the order before it expires via the [update endpoint]

The update body (trigger.yaml:926-943) has no expiresAt field. Orders expire even though the integrator thinks they renewed them.

Add expiresAt to the update endpoint, or document cancel-and-recreate.

slippageBps: "10000",

A real-funds swap is executed with no price protection, which invites sandwich attacks and very bad fills.

Use a bounded value, explain the risk, and check the quoted output before signing.

const confirmation = await rpc
  .confirmTransaction(signature, {

The kit RPC client has no confirmTransaction method. The sample throws after the transaction has already been sent, so the developer has no confirmation path.

Use the kit's send-and-confirm factory, or poll getSignatureStatuses until lastValidBlockHeight passes.

const { token } = await fetch(`${BASE}/auth/verify`, { ...
  body: JSON.stringify({ type: "message", walletPubkey: owner, signature: bs58.encode(signature) }) })

The authentication page says access_only is deprecated and will be removed. These rewritten quick starts omit authMode and read token. Any integration copied from them stops working when the mode is removed. The "24h JWT" comments at lines 60 and 78 repeat the old model.

Send authMode: "access_refresh", read accessToken/refreshToken/expiresAt, and add refresh-on-401 handling. You can also link to the migration section.

The token is valid for 24 hours. There is no refresh endpoint: when it expires, repeat the challenge-response flow.

This contradicts the authentication page and the spec, which document /auth/refresh, /logout and /logout-all. Integrators following this page build a flow that forces wallet re-signing and never adopts the new mode.

Describe the 15-minute access token with a rotating refresh token. Update the diagram label "token · JWT 24h", and mention access_only only as deprecated.

**Authentication errors** (401) mean the JWT has expired. Re-authenticate with a new challenge-response flow rather than retrying the same token.

With 15-minute access tokens, this sends users through a wallet signature every 15 minutes. It contradicts authentication.md:223 and :314 ("refresh once and retry").

On a 401, call /auth/refresh once and retry. Start a new challenge only if the refresh itself returns 401.

**`access_only` is deprecated (2026-07-21) and will be removed.** ... Nothing breaks today

Integrators cannot plan the migration window, and the old mode is still the default.

Publish the enforcement date and the date the default flips to access_refresh.

const signedTx = await wallet.signTransaction(
  VersionedTransaction.deserialize(Buffer.from(challenge.transaction, 'base64'))
);

The page's own security note says to verify the challenge before signing, but the sample signs blindly. A tampered challenge transaction would be signed.

Before signing, confirm that the transaction holds only the memo instruction, that the user is the fee payer and that it has no transfers. For the message variant, confirm the wallet and timestamp.

const signedTransaction = await wallet.signTransaction(transaction);
...
signedTransaction: Buffer.from(signedTransaction.serialize()).toString('base64'),

A user cancel or a silent rejection surfaces as an unhandled exception mid-flow.

Wrap the call in try/catch, and stop before confirm-cancel or deposit when the user rejects.

const transaction = VersionedTransaction.deserialize(
  Buffer.from(claimResponse.transaction, 'base64')

The new note says some markets return a "no claim required" message and no transaction. Buffer.from(undefined) throws, which aborts the loop, so no later position is claimed.

Check that claimResponse.transaction is a string before deserializing. Skip and log any other response.

-| Follow | `POST /follow/{pubkey}` | Follow a trader |
-| Unfollow | `DELETE /unfollow/{pubkey}` | Unfollow a trader |

Several breaking changes were made silently: follow endpoints removed, the claim blockhash moved into txMeta, and status values dropped. Stale text remains, such as "follow traders" at prediction/position-data.md:310, so existing clients break without warning.

Publish a change note that lists each breaking change and its date, and remove the stale references.

const tx = VersionedTransaction.deserialize(Buffer.from(build.transaction, "base64"));
tx.sign([wallet]);

The integrator never confirms that the fee payer and transfer source are their own wallet, or that requiredSigners are covered.

Add a short pre-sign check of fee payer, transfer source and required signers.

outputMint: market.outcomeMint,

The page documents the outcome token as Token-2022 and the API exposes outcomeTokenProgram, but the sample trusts the returned mint unchecked.

Check that outcomeTokenProgram is the Token-2022 program and that the mint is the expected one before building the swap.

The Liquidity Layer accounts are validated inside the Liquidity Layer CPI; you don't verify them yourself.
let cpi_ctx = CpiContext::new(ctx.accounts.dex_program.to_account_info(), cpi_accounts);

If an integrator's program accepts a caller-supplied dex_program or token program, that program is never checked. In the PDA-signing variant, the program's signature can then be spent on a malicious program, which risks the funds the PDA controls.

State that the DEX, Liquidity Layer, oracle and token programs must be constrained to their published ids, for example Program<'info, Dex> or an address = constraint. Show these constraints in the example accounts struct.

| Old API gateway (including `lite-api`) progressively deprecated | When new gateway is stable.

Integrators cannot plan the cut-over.

Publish a warning window and an enforcement date.

The legacy REST endpoint `POST https://api.jup.ag/tx/v1/submit` still accepts the same signed transactions, but `tx.jup.ag` is the recommended path going forward.

There is no sunset date, the new path requires an API key, and swap.md:28 and :32 still name /submit.

Publish the deprecation timeline, state the key requirement, and update the stale references.

example: gasTzr94Pmp4Gf8vknQnqxeYxdgwFjbgdJa4msYRpnB

The gasless page uses this same address as the marker for automatic sponsorship. A copied request is ambiguous and cannot be co-signed by the integrator.

Use a placeholder such as YOUR_PAYER_WALLET.

const blockhashInfo = await connection.getLatestBlockhashAndContext({ commitment: "confirmed" });
...
lastValidBlockHeight: blockhashInfo.value.lastValidBlockHeight,

The API now returns txMeta.blockhash and txMeta.lastValidBlockHeight for the signed transaction. Confirming against a later blockhash reports expiry later than it really happens.

Confirm with the response's txMeta values.

Poll the history endpoint to track order state; the states differ by family.

With a 1 RPS shared plan, unbounded polling consumes the rate budget.

State an interval with backoff, the terminal states per order family and a maximum duration.

if (res.status === 401) {
  await refreshTokens();          // updates accessToken/refreshToken, or re-authenticates on 401

Each request that gets a 401 starts its own refresh with the same rotating refresh token. The page says that reusing a refresh token outside a short grace window revokes the whole session, so parallel requests can log the user out. refreshTokens() is also left undefined.

Share one in-flight refresh promise that every caller awaits. Store the new pair atomically, and coordinate across tabs if the tokens are persisted.

-          type: number
-          description: Unix timestamp (seconds) when the market resolved (null if pending)
-        metadata:

Parsers written against the old contract fail on the same /prediction/v1 path. The new spec allows string | number, which leaves clients guessing.

Pick one type, add new keys rather than repurpose old ones, and announce the change.

description: YES-side levels sorted by price ascending.

The baseline said "descending". Code that reads yes[0] as the best price now reads the worst level.

State which end holds the best bid, and announce the change. Prefer a new field to reversing an existing one.

"id": 425993,

The spec now types id as a string ("order-1906029"). Clients built from the example parse it as an integer and fail.

Update the example and the field table to string ids.

realizedPnlUsd:
  type: number
  description: Realized PnL in micro USD (i64 as number)

Sibling amounts are strings, and forecast.md tells readers never to use Number for amounts. Values above 2^53 lose precision.

Return the amount as a string.

maxQuoteAmount:
  type: number

The fee endpoint returns base-unit amounts as strings, but this request takes a number with no stated unit, which risks precision and unit errors.

Accept a base-unit string and state the unit.

Vault and position IDs are scoped to a market. The same `vaultId` refers to a different vault in `main` than in `ethena`

A position id alone is ambiguous, and an operate call that omits market silently uses main.

Echo market in every vault, position and operate response. Document it in the operate payload table.

description: Atomic JUP output from the craft quote (CraftTxnResponse.amount), echoed back so revenue tracks the actual JUP collected on swap paths.

The server already has requestId, so a client-supplied value can be wrong or forged.

Look the value up server-side by requestId, and reject mismatches.

> Jupiter's flagship swap API: ... Start here for most swap integrations.
  **Ultra Swap API** is no longer actively maintained and has been superseded by [Swap V2](/docs/swap).

New integrators are told to start on an unmaintained API.

Rewrite the tagline and intro to point to Swap V2 and the migration guide.

| **Price-based recurring** | Create price-based recurring orders that execute when certain market conditions are met. |
...orderStatus=history&recurringType=price

The sub-pages say price-based orders are no longer supported and that price is deprecated, yet the overview and the history sample use them.

Remove or mark the price-based rows and steps, and use recurringType=time in the sample.

const submitRes = await fetch("https://api.jup.ag/tx/v1/submit", {
...
const { signature } = await submitRes.json();

The submit page names tx.jup.ag as the recommended path, and the REST body is no longer documented anywhere. The sample also never checks submitRes.ok, so an error yields signature === undefined.

Switch to the tx.jup.ag sample from the submit page, or label these samples legacy. Check the response status.

| Grace period ends and new payment method needs to be already set up | 30th June 2026 |
You must choose a paid plan before the grace period ends or your rate limit will drop to the Free tier (1 RPS).

The docs are dated 2026-10-11. Readers cannot tell what limit applies to them now.

Rewrite in the past tense and state the current limits for keys that were not migrated.

You can create via [scripts](/docs/ultra/add-fees-to-ultra) or [Referral Dashboard](https://referral.jup.ag).

Current guidance routes readers into the deprecated section.

Link to the current referral setup.

| FETCH-FAILED | `mcp.md` | 404 | yes | sitemap | URL listed in current sitemap.xml but returns HTTP 404

The sitemap entry leads crawlers and readers to a dead page.

Remove the entry or redirect it to the MCP pages, and add a release check that every indexed URL returns 200.

It found 19 live pages that are in no index: the deprecated Ultra section ... plus `skill`.

The indexes and the live site disagree, so AI tools and search miss the pages or index them without a deprecation label.

List them with an "unmaintained" label, or unpublish them and redirect.

Portfolio (6 pages ...) all redirect to `get-started`: the Portfolio API docs are gone.

No page in the delta mentions the retirement. (The changelog moved out of the docs and was not checked.)

Add a retirement notice that gives the date and the alternatives.

-| `/ultra/v1/order` | 1 |
-| `/tokens/v2/content` | 1 |

Users of still-documented endpoints cannot find what those calls cost.

Keep a labelled group for these endpoints while their pages remain live.

| Recurring | Dollar-cost averaging (DCA) strategies |

It contradicts the move of DCA to the Trigger API.

Point the DCA row to Trigger.

* **`open`** orders can be updated or cancelled. Updates and cancellation are only valid from this state.
* **`expired`** orders ... retrieved with the same cancel flow (see below).

Integrators may block withdrawal of expired orders, which strands the user's funds in the vault UI.

List every state that accepts cancel (open, expired, and mid-cancel), and say that confirm-cancel may be retried.

Call this once per wallet. Subsequent calls return the existing vault.
'409': description: Vault already exists

Clients that follow the description treat the 409 as fatal.

Document the 409 together with the returned vault details, matching deposit.md:45 and errors.md:65.

Choose the order account to deposit by making a post request to the `/priceDeposit` endpoint

Following the text on a funds-moving flow builds a deposit, not a withdrawal.

Use /priceWithdraw and "withdraw from".

| `created` | Order account created on-chain, waiting to be filled |
| `status` | `pending`, `filled`, or `failed` |

Clients that switch on pending never match. The spec enum and prediction.md:117 disagree as well.

Use one status set everywhere: created, partiallyfilled, filled, failed.

| `contracts` | string | No | Number of contracts to purchase |
(spec line 687: Legacy whole-contract sell quantity (only when `isBuy` is `false`))

Buy requests are sized wrongly or rejected.

Size buys with depositAmount, and document the sell-only quantity fields.

description: Relative execute path. Resolves to `https://api.jup.ag/prediction/v1/execute`.
example: /api/v1/execute

A client that resolves the example calls a URL that does not exist.

Make the example match the description, and state the base URL.

`${PREDICTION_API}/events?provider=bisonfi&category=crypto&tag=15m&includeMarkets=true`

The filter is ignored, and the sample returns every crypto event.

Use tags=15m.

| `filledContracts` | Number of contracts executed |

The same page warns that unsuffixed contract fields are floored. Accounting built on them is wrong for fractional fills.

Document the *Micro and *Decimal fields and mark the plain fields as legacy.

result:
  type: string
  nullable: true
  enum: ["yes", "no"]

In OpenAPI 3.0 the enum must include null, and nullable next to a bare oneOf has no effect. Generated clients reject every open market.

Add null to the enum and give resolveAt a single nullable type.

- polymarket / - gx / - bisonfi        (Market response)
- kalshi / - polymarket / - bisonfi    (GET /events filter)

Typed clients fail when a returned value is not in the response enum.

Share one provider schema.

you may face many tokens where price is not available or returns null.
Tokens without a reliable price are **omitted entirely** from the response.

Code that checks for null throws on the missing key.

Rewrite the caution to tell readers to check whether the key is present.

const response = await fetch("https://api.jup.ag/tokens/v1", {
const remaining = Number(response.headers.get("x-ratelimit-remaining"));

/tokens/v1 is not a documented route. When the header is missing, Number(null) is 0, so every call sleeps 1 s. The request is also never retried after a 429.

Use a real /tokens/v2 route, apply the check only when the header is present, and retry with a cap.

| Vault config and state | - | `getAllVaults`, `getVaultByVaultId` | - |
| Borrow vaults and user positions | `vaults`, `positions` endpoints | ...

Readers are steered to the SDK for data the REST API now serves. The recommendation table at lines 113-116 repeats the error.

Add the REST endpoints to the row and the recommendations.

confirmed:
  type: integer          (examples: confirmed: true)
- Unix timestamp of when the invite will expire   (example: "2025-03-22T10:30:00.000Z")

Generated clients fail to parse responses that match the examples.

Make confirmed a boolean and describe expiry as an ISO-8601 string, or change the examples to match the types.

- fee
- If not provided, the default fee will be 100 basis points (1%)

Callers that omit fee on the strength of the description get a 400.

Make fee optional, or delete the default text.

with only 5 to 10 bps of the swap amount as a fee.
| New Tokens (within 24 hours token age) | 50 |

Fee quotes built from the summary are wrong for new tokens and for free pairs.

State the real range and point to the table.

Use the `/order` response fields (`inputAmountResult`, `outputAmountResult`)

These fields belong to the /execute response, and /build users call neither endpoint.

Tell /build users to parse token balance changes.

const wallet = Keypair.fromSecretKey(bs58.decode(process.env.PRIVATE_KEY || '')));

There is an extra ) and bs58 is never imported, so the snippet fails on copy-paste.

Fix the parentheses and add import bs58 from 'bs58'.

'taker=jdocuPgEAjMfihABsPgKEvYtsmMzjUHeq9LX4Hvs7f3&' +

The signature does not match the required signer, so execution fails.

Use taker=${wallet.publicKey.toBase58()} and a payer placeholder.

if (simulation.value.err) console.error("Simulation failed:", simulation.value.err);

A transaction known to fail is broadcast with preflight skipped, and the user pays the fee.

Stop when the simulation returns an error.

for (let i = 0; i < 40; i++) {
  await new Promise((r) => setTimeout(r, 1500));

After about 60 s the loop ends with no error, so "not landed" looks like success.

Throw after the loop, or poll until the block height passes lastValidBlockHeight.

cleanupInstruction:
  $ref: "#/components/schemas/Instruction"
  nullable: true

OpenAPI 3.0 ignores siblings of $ref, so null, which is returned on the main /build path, fails strict validation. tokens.yaml:406-417 has the same problem.

Wrap the reference in allOf, as tipInstruction already does.

| CHANGED | `ai.md` | 2,379 | yes | sitemap | +3/-3 lines |
| CHANGED | `ai/index.md` | 2,379 | yes | llms.txt+llms-full | +3/-3 lines |

The copies are in step today, but every edit must be made twice.

Generate one copy from the other, or redirect one to the other.

| **Transaction size** | Must not exceed the Solana transaction size limit (1232 bytes) |

swap/advanced/transaction-versions.md:13 promotes v1 transactions of up to 4096 bytes. It is unclear whether those can be submitted here.

State whether larger v1 transactions are accepted.