POST /api/v1/token-metadata accepts multipart/form-data with required name, symbol, initial_supply, and either image or image_url. Optional fields are description, website_url, x_url, telegram_url, and discord_url.
Images may be PNG, JPEG, WebP, or GIF up to 5 MB. Remote images must use public HTTPS; private, loopback, and link-local targets are rejected. Name is limited to 64 bytes, symbol to 16 bytes, and description to 1,000 bytes.
POST /api/v1/token-metadata/{draft}/finalize accepts a JSON token address, transaction hash, and creator signature. It binds only a creator-owned draft to a matching canonical indexed launch. A confirmed launch that is not indexed yet returns 409 not_indexed; clients may retry the same finalization after indexing advances.
GET /objects/* serves stored objects with immutable caching. Metadata and linked content remain creator-supplied and untrusted.