> ## Documentation Index
> Fetch the complete documentation index at: https://docs.testnet.dev.adipredictstreet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List whitelisted withdrawal addresses

> All whitelist entries for the acting wallet, newest first. An empty list means the whitelist is not configured — withdrawals are then unrestricted by destination.



## OpenAPI

````yaml /api-reference/openapi.json get /api/me/withdrawal-security/whitelist
openapi: 3.1.0
info:
  title: PredictStreet core-api
  description: >-
    Client-facing HTTP gateway for the PredictStreet prediction-market platform.
    This spec is hand-written against the NestJS controllers and DTOs in
    core-api/src/modules/. For the source-of-truth live spec, run
    `./scripts/pull-openapi.sh` against a running core-api (NestJS exposes it at
    /api/docs-json). **Partner kinds.** Every authenticated endpoint resolves a
    request's *effective wallet* from the partner row. `single_wallet` partners
    bind to one `associatedWallet` set at creation. `multi_wallet` partners
    declare the actor on every request via an `X-User-Wallet: 0x<40-hex>`
    header. See the [Partner kinds](/auth/api-keys#partner-kinds) doc for the
    full contract.
  version: '2026-06-16'
  contact:
    name: PredictStreet partners
    email: partners@predictstreet.com
servers:
  - url: https://core.api.dev.predictstreet.sde.adifoundation.ai
    description: Testnet (partner integrator API — final domain TBD)
security: []
tags:
  - name: Deposits
    description: >-
      Gasless USDC deposit relay - submit a signed EIP-2612 permit and the
      platform broadcasts the on-chain deposit for you (no gas).
  - name: Events
    description: >-
      Polymarket-style event grouping with football metadata (group, stage,
      teams, tags).
  - name: Tags
    description: Curated tag taxonomy used to filter events.
  - name: Markets
    description: 'Public market data: list, detail, orderbook, trades, OHLC.'
  - name: Orders
    description: >-
      Signed-order place / cancel / read. Requires `X-Api-Key` with
      `orders:read` / `orders:write` scope; every write additionally requires an
      EIP-712 signature over the order.
  - name: Portfolio
    description: >-
      Balances, positions, trades, fees, vault info for the key's
      `associatedWallet`. Requires `X-Api-Key` with `portfolio:read` scope.
  - name: Matches
    description: >-
      admin.matches aggregate — groups several events into one fixture/card (1X2
      + first-scorer + over-under under one matchup).
  - name: Vault
    description: >-
      Backend co-signatures for ERC-1155 split / merge, and recovery for
      off-chain locks when the corresponding chain tx never confirmed. Requires
      `X-Api-Key` with `vault:write` scope plus an EIP-712 signature over the
      operation.
  - name: Leaderboard
    description: Public ranked leaderboard across PnL / volume buckets.
  - name: Search
    description: Global search across users, events, and matches.
  - name: Withdrawal Security
    description: >-
      Self-service withdrawal 2FA (TOTP) and withdrawal-address whitelist. Same
      endpoints serve the frontend (Privy JWT) and API-key integrators.
      Mutations need `vault:write`, reads `portfolio:read`. Both are opt-in per
      wallet and only gate withdrawals once the platform enables
      withdrawal-security enforcement.
paths:
  /api/me/withdrawal-security/whitelist:
    get:
      tags:
        - Withdrawal Security
      summary: List whitelisted withdrawal addresses
      description: >-
        All whitelist entries for the acting wallet, newest first. An empty list
        means the whitelist is not configured — withdrawals are then
        unrestricted by destination.
      operationId: WithdrawalSecurity_listWhitelist
      parameters:
        - $ref: '#/components/parameters/UserWalletHeader'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WhitelistListResponse'
      security:
        - ApiKeyAuth:
            - portfolio:read
components:
  parameters:
    UserWalletHeader:
      name: X-User-Wallet
      in: header
      required: false
      description: >-
        **Required for `multi_wallet` partners on every authenticated request;
        ignored for `single_wallet`.** Declares the acting end-user wallet for
        this request — drives KYC checks, balances/positions/orders attribution,
        rate-limit buckets, and audit. Lower-cased server-side. Missing on a
        multi_wallet key → 401 `api_key_user_wallet_required`; malformed → 401
        `api_key_user_wallet_invalid`. The on-chain `CTFExchange`/`Vault`
        contracts still verify EIP-712 signer ↔ vault binding, so loosening
        API-layer attribution is safe by construction.
      schema:
        $ref: '#/components/schemas/EthereumAddress'
      example: '0x1234567890abcdef1234567890abcdef12345678'
  schemas:
    WhitelistListResponse:
      type: object
      required:
        - addresses
      properties:
        addresses:
          type: array
          items:
            $ref: '#/components/schemas/WhitelistEntry'
    EthereumAddress:
      type: string
      pattern: ^0x[a-fA-F0-9]{40}$
      example: '0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb3'
    WhitelistEntry:
      type: object
      required:
        - id
        - address
        - label
        - createdAt
      properties:
        id:
          type: string
          format: uuid
          description: Entry id — pass to DELETE …/whitelist/{id}.
        address:
          type: string
          description: Destination EVM address, normalised lowercase.
          example: '0x1234567890abcdef1234567890abcdef12345678'
        label:
          type:
            - string
            - 'null'
          description: Optional user label, or null.
          example: My Ledger
        createdAt:
          type: string
          format: date-time
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key
      description: >-
        Partner / integrator key — format `ps_live_<keyId>_<secret>`. Issued by
        PredictStreet ops via the admin panel; never self-service. Never ship to
        a browser. `multi_wallet` partners must additionally send
        `X-User-Wallet: 0x<40-hex>` on every authenticated request to declare
        the acting wallet. See the [API keys guide](/auth/api-keys) for scope
        taxonomy, partner kinds, rate limits, and rotation procedure.

````