---
title: "Open one lootbox"
method: POST
path: "/exchanges/predictfun/activities/{code}/boxes/{box_id}/open"
tags: ["Onboarding"]
---

# Open one lootbox

`POST /exchanges/predictfun/activities/{code}/boxes/{box_id}/open`

## Request

- Base URL: `https://execution.kairos.trade`
- URL: `https://execution.kairos.trade/exchanges/predictfun/activities/{code}/boxes/{box_id}/open`
- Auth: API key in header `X-Client-Id` and API key in header `X-Api-Key` and API key in header `X-Api-Secret`

Opens one revealed box once box opening has unlocked. `opened` is false when an earlier request already opened it; `box` is the box either way, so retrying is safe.
> **Error shape.** Minimal `{"error": "...", "code": "..."}` (`OrderSimpleErrorResponse`).
**Rate limited** at 60 requests/minute per user (bucket `predictfun-lootbox-item`, shared by the one-match reveal and one-box open routes), fail-closed.
**Auth.** API keys and delegations need `trade:execute` (a cold venue session is minted by signing a login challenge with the user's wallet) and the `predictfun` platform access flag.

## Path parameters

- `code` string, required
- `box_id` string, required

## Response `200`

Open one lootbox.

- OrderPredictfunLootboxOpenOne
  - `opened` boolean, required: False when an earlier request already opened the box.
  - `box` OrderPredictfunLootboxBox, required
    - `id` string, required
    - `matchId` string, required
    - `matchTitle` string, required
    - `teams` OrderPredictfunLootboxTeam[], required
      - `name` string, nullable, required
      - `shortName` string, nullable, required
      - `logoUrl` string, nullable, required
    - `boxTypeId` string, required
    - `opened` boolean, required
    - `revealedAt` string, nullable, required
    - `openedAt` string, nullable, required
    - `prizeType` string, nullable, required: Known once the box is opened.
    - `reward` OrderPredictfunRewardAmount, required: An amount in base units; divide by `10^decimals` to display.
      - `rewardType` 'TOKEN' | 'PREDICT_POINTS', required
      - `symbol` string, nullable
      - `decimals` integer, required
      - `amount` string, required

## Other responses

- `400`: `INVALID_ID` — the path id is not 1-128 letters, digits, `_` or `-`; it is never sent to the venue.
- `401`: No valid credential presented — missing/invalid API-key headers or an invalid/expired session token.
- `403`: `PLATFORM_API_ACCESS_DENIED` — the credential lacks `trade:execute` or `predictfun` access.
- `404`: `NO_CREDENTIALS` — the caller has no Predict.fun wallet; `ACTIVITY_NOT_FOUND` — the campaign is not one this deployment enrolls accounts in.
- `409`: `BOXES_LOCKED` — box opening has not unlocked yet; or `SIGNING_RESYNC_REQUIRED` — the wallet's signing delegation must be re-established before the venue session can be minted.
- `429`: `RATE_LIMITED` — more than 60 single-box or single-match requests in a minute. No `Retry-After` header.
- `502`: `PREDICTFUN_API_ERROR` — Predict.fun rejected or failed a call.
- `503`: `NOT_CONFIGURED` — Predict.fun is not configured on this deployment, or API-key access could not be checked (fails closed).

---

[API](https://skmtc.dev/kairos/apis/kairos-order-execution-api.md) - [All operations](https://skmtc.dev/kairos/apis/kairos-order-execution-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kairos/apis/kairos-order-execution-api/revisions/9ba7d463d505?raw)