# Pump.fun GO — API & on-chain notes

**Investigated:** 2026-06-04 (browser `https://pump.fun/go`, JS bundles, live HTTP probes, [pump-public-docs](https://github.com/pump-fun/pump-public-docs), [BankkRoll/pumpfun-apis](https://github.com/BankkRoll/pumpfun-apis)).

**Summary:** GO bounties are **not** in `pump-public-docs` or `frontend-api-v3`. They use a **separate REST API** on `livestream-api.pump.fun` plus an **on-chain program** for publish, funding, claims, and disputes. There is **no stable public write API** for agents without a Pump session (wallet login). **Bounty Agent** should treat GO as source of truth and use read-only scripts or manual UI for creates/payouts.

---

## Product URLs (human + agent discovery)

| Path | Purpose |
|------|---------|
| `https://pump.fun/go` | Main GO feed (open bounties + submissions) |
| `https://pump.fun/go/open` | Open bounties |
| `https://pump.fun/go/bounties` | Explore bounties |
| `https://pump.fun/go/mine` | Creator “my bounties” |
| `https://pump.fun/go/mine/drafts` | Drafts |
| `https://pump.fun/go/submissions` | Submissions index |
| `https://pump.fun/go/submissions/recent` | Recent submissions |
| `https://pump.fun/go/submissions/mine` | My submissions |
| `https://pump.fun/go/action-items` | Claims, disputes, finalize |
| `https://pump.fun/go/{taskId}/submissions/{submissionId}` | Submission detail |

Create flow in UI: connect wallet on GO → **Create bounty** (FAB / dialog). No separate public “GO API key” product was found.

---

## REST base URL (GO backend)

| Setting | Value |
|---------|--------|
| **Base** | `https://livestream-api.pump.fun` |
| **Configured in app** | `livestreamsUrl` in Pump web config (same host as livestream features) |
| **Client** | `useLivestreamApiClient()` (ky/fetch wrapper) |

### Request headers (browser parity)

Probed public reads with:

```http
Origin: https://pump.fun
Accept: application/json
```

Authenticated routes return `401 Unauthorized` without a Pump session cookie / bearer token (exact auth mechanism is session-based in the web app; not documented for third parties).

**CORS:** Expect browser calls from `pump.fun` only. CLI/scripts without `Origin` often still work for **GET** public routes; do not rely on this for production integrations.

---

## On-chain program (publish / vault / claim)

From live API responses and frontend bundle `0rdr0o65lwyyp.js`:

| Field | Value |
|-------|--------|
| **Program ID** | `goGzNYTYkSEe4hUqz6dPmY5uf3CTt36AQAoujXDrKiV` (`pumpBountiesProgramId`) |
| **Publish instruction** | `create_bounty_and_publish` (Anchor: `createBountyAndPublish`) |
| **Typical publish fee** | `10000000` lamports (0.01 SOL) → `publish_fee_vault` |
| **Dispute window** | `28800` seconds (8h) in sampled tasks |
| **Submission fee** | Often `0` lamports in sampled tasks |

Publishing a bounty on GO is a **wallet transaction**, not a single REST `POST`. The backend indexes tasks after on-chain + metadata steps.

PDA helpers seen in bundle: `findBountyPda`, `findRewardVaultPda`, `findDepositorLedgerPda`, `findDisputePda`, `findSubmissionFeeReceiptPda`, `findAwardPda`.

---

## Public read endpoints (verified 200 without auth)

### `GET /bounties/v2/stats`

Aggregate GO stats.

```bash
curl -sS -H "Origin: https://pump.fun" -H "Accept: application/json" \
  "https://livestream-api.pump.fun/bounties/v2/stats"
```

Example: `liveCount`, `unclaimedRewardTotalUsd`, `submissionCount`.

### `GET /bounties/v2/tasks`

Paginated public bounty list (v2). Query params observed: `limit`, `cursor`, filters via searchParams in app (status, reward, etc.).

```bash
curl -sS -H "Origin: https://pump.fun" -H "Accept: application/json" \
  "https://livestream-api.pump.fun/bounties/v2/tasks?limit=10"
```

Response: `{ items: [...], nextCursor?: string }` — items match `publicBountyTask` shape (`taskId`, `title`, `bodyMarkdown`, `criteria`, `rewardLegs`, `status`, `pumpBountiesProgramId`, `onChainBountyId`, …).

### `GET /bounties/feed/trending`

Trending feed (bounties + submissions).

```bash
curl -sS -H "Origin: https://pump.fun" \
  "https://livestream-api.pump.fun/bounties/feed/trending?limit=20"
```

### `GET /bounties/feed/recent/submissions`

Recent submission feed.

```bash
curl -sS -H "Origin: https://pump.fun" \
  "https://livestream-api.pump.fun/bounties/feed/recent/submissions?limit=20"
```

### `GET /bounties/v2/top-earners` / `GET /bounties/v2/top-spenders`

Leaderboard-style endpoints (present in bundle; same base URL).

### Legacy list: `GET /bounties/tasks`

Older public list endpoint still referenced in client; prefer `v2/tasks` for new tooling.

---

## Authenticated endpoints (session required)

Probed: write routes return **401** without `Authorization: Bearer <apiBearerToken>` (from pump.fun wallet session).

### Creator / participant (verified + bundle-derived)

| Method | Path | Notes |
|--------|------|--------|
| `POST` | `/bounties/tasks` | Create draft (title, bodyMarkdown, criteria, expiresAt) |
| `PATCH` | `/bounties/tasks/{taskId}` | Edit draft (**401** without session) |
| `POST` | `/bounties/tasks/{taskId}/publish` | Fund + publish (rewardLegs + on-chain tx in response) |
| `POST` | `/bounties/tasks/{taskId}/submissions` | Submit proof (bodyMarkdown, links) |
| `DELETE` | `bounties/tasks/{taskId}` | Delete draft |
| `GET` | `bounties/tasks/me/drafts` | My drafts |
| `GET` | `bounties/tasks/me/submissions` | My submissions |
| `GET` | `bounties/tasks/me/pending-attention` | Claims / disputes / finalize queue |
| `POST` | `bounties/tasks/{taskId}/resolve` | Creator resolve winners |
| `POST` | `bounties/tasks/{taskId}/finalize-expired` | Finalize expired bounty |
| `POST` | `bounties/tasks/{taskId}/like` | Like bounty |
| `POST` | `bounties/tasks/{taskId}/submissions/{submissionId}/like` | Like submission |

Attachment upload response schema includes `uploadUrl`, `expiresInSeconds`, `attachment` (S3 under `prod-bounties-*`).

### Inferred (schemas in bundle, not independently probed)

| Operation | Likely API | On-chain |
|-----------|------------|----------|
| **Submit work** | `POST bounties/tasks/{taskId}/submissions` (body: `bodyMarkdown`, `links`, `attachments`) | May include fees |
| **Publish** | Metadata + `createBountyAndPublish` tx | **Required** |
| **Claim reward** | Action items UI + program | **Wallet claim** |

Error codes seen in client: `X_ACCOUNT_NOT_CONNECTED`, `X_FOLLOWERS_BELOW_THRESHOLD` (X/Twitter linkage for some creators).

### Moderation (staff)

Paths under `bounties/moderation/...` (approve, ban, proposals, queues). Not for Bounty Agent automation.

---

## Related Pump APIs (not GO bounties)

| API | Role |
|-----|------|
| `https://frontend-api-v3.pump.fun` | Coins, trades, profiles — **no `/bounties`** in [community index](https://github.com/BankkRoll/pumpfun-apis) |
| `https://fun-block.pump.fun` | Agent tx building: `/agents/create-coin`, `/agents/collect-fees` — **not GO** |
| `https://advanced-api-v2.pump.fun` | Analytics |
| `https://swap-api.pump.fun` | Swaps |

---

## Task lifecycle (API `status` field)

`DRAFT` → `PUBLISHED` → `PENDING_RESOLUTION` → `IN_DISPUTE_PERIOD` → `CLOSED`

Submissions have `publishedAt`; resolution includes `winners`, `claimSignature`, `refundClaims`, etc.

---

## Bounty Agent tooling

| Tool | Purpose |
|------|---------|
| `api/server.mjs` | HTTP API: `POST /v1/bounties`, `POST /v1/bounties/:id/submit` → Pump GO |
| `scripts/agent-post-bounty.mjs` | CLI post via local API |
| `scripts/agent-submit-bounty.mjs` | CLI submit via local API |
| `scripts/list-bounties.mjs` | Read-only `GET /bounties/v2/tasks` |
| `scripts/create-bounty-template.mjs` | Paste templates for manual GO create |

Env vars:

```bash
# Optional override (default: https://livestream-api.pump.fun)
PUMP_GO_API_BASE=https://livestream-api.pump.fun
```

No API key is documented for GO. **Do not commit** session cookies or wallet keys.

---

## Stability & risk disclaimer

- **Unofficial** reverse-engineering; Pump can change routes, auth, or program IDs without notice.
- **Writes** (create, submit, resolve, claim) should be done on **https://pump.fun/go** with a funded wallet unless you explicitly accept breakage risk automating session auth.
- **v2 watch** (future Bounty Agent): poll `GET /bounties/v2/tasks` or trending feed; no custom escrow.

---

## References

- GO UI: https://pump.fun/go  
- Livestream API host: https://livestream-api.pump.fun  
- On-chain program (sampled): `goGzNYTYkSEe4hUqz6dPmY5uf3CTt36AQAoujXDrKiV`  
- Competitor reference: Bounty Work coins on same GO feed  
- Example AI-agent GO bounty: $ATELIER (visible on GO feed during investigation)