> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dev.symbiosis.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Get the open requests for a venue and asset.



## OpenAPI

````yaml /openapi.yaml get /rfq/request
openapi: 3.1.0
info:
  title: Symbiosis API
  description: >-
    The Symbiosis REST API.


    ## Authentication


    Endpoints accept one of two credentials:


    - **Session token** — `Authorization: Bearer <token>`, from `POST
    /auth/login`.

    - **API key (HMAC)** — three headers on every request:
      - `APIKEY`: the API key id, from `POST /auth/api-keys`.
      - `X-Hmac-Timestamp`: current Unix time in milliseconds.
      - `X-Hmac-Signature`: Base64-encoded HMAC-SHA256 of
        `timestamp_ms "\n" METHOD "\n" PATH_AND_QUERY "\n" BODY`, keyed with the API key
        secret. `PATH_AND_QUERY` is the full request target including the query string.

    ## Wire formats


    Token amounts (`U256`) serialize in responses as 0x-prefixed hex strings;
    requests accept decimal strings, 0x-prefixed hex strings, or JSON numbers.
    Asset ids and addresses are 0x-prefixed hex strings. Prices are integers
    scaled by 1e6.
  version: 0.1.0
servers:
  - url: https://api.symbiosis.markets
security: []
tags:
  - name: auth
    description: Accounts, sessions, API keys, and websocket tickets.
  - name: custody
    description: Deposit addresses, balances, and withdrawals.
  - name: rfq
    description: Quote requests, quotes, and matching.
paths:
  /rfq/request:
    get:
      tags:
        - rfq
      summary: Get the open requests for a venue and asset.
      operationId: get_open_requests
      parameters:
        - in: query
          name: asset_id
          schema:
            type:
              - string
              - 'null'
          style: form
        - in: query
          name: venue_id
          schema:
            anyOf:
              - $ref: '#/components/schemas/Venue'
              - type: 'null'
          style: form
        - in: header
          name: X-Hmac-Timestamp
          description: >-
            Unix milliseconds used in the signed message. Required with
            `APIKEY`.
          schema:
            type: string
          style: simple
        - in: header
          name: X-Hmac-Signature
          description: >-
            Base64 HMAC-SHA256 over `timestamp_ms \n METHOD \n PATH_AND_QUERY \n
            BODY`. Required with `APIKEY`.
          schema:
            type: string
          style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRequestsResponse'
        '401':
          description: Invalid, missing, or mis-signed credentials.
        '403':
          description: Authenticated, but the credential lacks the required scope.
      security:
        - SessionBearer: []
        - ApiKeyHmac: []
components:
  schemas:
    Venue:
      description: The supported markets of the system.
      type: string
      enum:
        - polymarket
        - kalshi
        - limitless
    GetRequestsResponse:
      type: object
      properties:
        requests:
          type: array
          items:
            $ref: '#/components/schemas/PublicQuoteRequest'
      required:
        - requests
    PublicQuoteRequest:
      description: |-
        A quote request as disclosed to the market.

         Carries the requester's `user_id` only when they opted into disclosure. Every subscriber to a
         market's RFQ stream receives one of these per request, so carrying the requester by default
         would tell every competing market maker who is asking for a price — which, for a
         block-execution venue, is exactly the confidentiality the product exists to provide.

         The requester is still recorded on `quote_requests`, still returned to the requester themselves
         by `/get-requests`, and still disclosed to the quoter on a match, where the counterparty is
         necessarily known.
      type: object
      properties:
        amount:
          type: string
        asset_id:
          type: string
        request_id:
          $ref: '#/components/schemas/RequestId'
        side:
          $ref: '#/components/schemas/Side'
        user_id:
          type:
            - string
            - 'null'
          format: uuid
        venue_id:
          $ref: '#/components/schemas/Venue'
      required:
        - request_id
        - asset_id
        - venue_id
        - amount
        - side
    RequestId:
      type: string
      format: uuid
    Side:
      type: string
      enum:
        - Bid
        - Ask
  securitySchemes:
    SessionBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Session token from `POST /auth/login`.
    ApiKeyHmac:
      type: apiKey
      in: header
      name: APIKEY
      description: >-
        API key id; must be accompanied by `X-Hmac-Timestamp` and
        `X-Hmac-Signature`. See the API description for the signing scheme.

````