Everything written about XRO, grouped by what you are trying to do. The developer reference at the bottom is the part you will not find elsewhere.
All of the following is verified against the live services rather than copied from a specification. Where XRO differs from Nano, it is called out.
Sends Access-Control-Allow-Origin: *, so a browser on any origin can
query it with no backend in between. JSON in, JSON out, the standard Nano RPC
shape. It is action-whitelisted: anything not listed below returns
{"error":"action not permitted"}.
| Permitted | Notes |
|---|---|
block_count | Totals, cemented and unchecked. |
telemetry | Account count, peers, uptime, and active_difficulty. |
confirmation_quorum | Online stake and the quorum delta. The basis for any decentralisation measure. |
representatives / representatives_online | Pass weight: "true" for weights. |
available_supply | |
version | Node, protocol and store versions. |
account_info | Takes representative, pending, weight flags. |
account_history | |
block_info / blocks_info | Use json_block: "true". |
accounts_frontiers, frontier_count |
| Blocked | What that rules out |
|---|---|
ledger | You cannot enumerate accounts, so a rich list is impossible client-side. |
confirmation_history | No network-wide recent-blocks feed. A real explorer needs its own indexer. |
peers, stats, active_difficulty | |
wallet_*, block_create, keepalive | All control actions. |
Raw amounts are 1030 per XRO. That is far past 253, where a JavaScript number stops being exact, and past what a 64-bit integer column holds. Keep every ledger amount as a string or a BigInt from the JSON through to the formatted output. Converting to a float anywhere in between silently loses precision on ordinary balances.
subtype is top level on a block_info response,
not inside contents. Reading contents.subtype gives
undefined and no error.
Work threshold. XRO enforces
0xfffffe0000000000, which is Nano's receive threshold, not its
send threshold. Work generated against Nano's send difficulty is accepted, but work
validated against it will reject blocks the network considers fine. Confirm against
telemetry.active_difficulty.
Upgrades from a browser origin and accepts the standard subscription message:
{"action":"subscribe","topic":"confirmation"}. Be aware the chain is
quiet, so a live feed can sit silent for minutes. Design the empty state to say
idle rather than look broken.
Both use exact-origin CORS allowlists rather than a wildcard, so
a new origin is refused until it is added server-side. The folding endpoints take
?address= or ?token=, and
/api/config exposes dry_run as the machine-readable
"are payouts running" flag.
/api/leaderboard publishes points_to_xro_ratio but
not the income share or reserve that the payout curve actually
uses, so the nominal rate it implies is higher than what folders receive. Treat it
as a ceiling.
The Folding@home API itself cannot be read from a browser.
api.foldingathome.org returns Vary: Origin but no
allow-origin header, so team points have to come from the folding service instead.