capper.win API

Read a day’s matches

Public reads need no account or API key (the interactive app at /app does need a verified account). Use Accept: application/json. The API groups fixtures by country, then league. Each fixture includes its internal id and a url for the HTML match page.

curl --get 'https://capper.win/api/v2/list' \
  --header 'Accept: application/json' \
  --data-urlencode 'date=2026-10-01' \
  --data-urlencode 'tz=Europe/Kyiv' \
  --data-urlencode 'market=total_goals'

• date: a calendar date in YYYY-MM-DD. Defaults to today in the requested timezone.
• tz: an IANA timezone, such as Europe/Kyiv, America/Chicago or UTC. Defaults to Europe/Kyiv.
• market: total_goals, corners, match_winner, double_chance or handicap. Defaults to total_goals.

A day includes its local midnight and excludes the next midnight. The response echoes the resolved date and market. Unknown markets and timezones fall back to their defaults; unparseable date strings fall back to today. Send valid scalar parameters rather than relying on these fallbacks.

Read fixtures at countries[].leagues[].fixtures[]. An empty countries array means no matching fixtures. Result markets omit fixtures with no predictions. These endpoints return the complete selected set without pagination. Use the internal fixture ID, not the upstream football provider’s ID, for favorites.

Prediction access and results

Free model picks are public. Premium picks on upcoming or live matches require a session with an active entitlement. Finished matches expose their predictions publicly. Hidden providers are excluded; tipsters use public codenames for non-admin viewers.

A locked prediction contains locked: true, its provider and highlight flags. Its pick, line, label, odds and result are omitted. An unlocked prediction has locked: false and a readable label such as Over 2.5. Bookmaker odds are null for non-admin viewers.

• hit: the prediction won.
• miss: the prediction lost.
• push: the stake was returned.
• pending: the prediction has not been settled.

An empty predictions array means no pick is available for this market. predictions_eta, when present, is an estimate for a scheduled prediction, not a guarantee. Scores and results can lag the match; the daily API can trigger a guarded live refresh. Forecasts are informational only and no outcome is guaranteed.

Sessions and favorites

Account operations use the same cookie session as the website. There is no API-key or delegated OAuth-token flow. Use an existing account that you are authorized to access; registration is available on the sign-up page.

1. Call GET /api/auth/csrf-cookie and retain all response cookies in a cookie jar.
2. URL-decode the current XSRF-TOKEN cookie. Send it as X-XSRF-TOKEN with the cookies on every POST or DELETE request.
3. Call POST /api/auth/login with JSON {"email":"[email protected]","password":"your-password"}. Retain the rotated cookies and refresh your CSRF header from the new cookie.
4. Use GET /api/auth/user to confirm the session and user.premium to check access.
5. Choose a fixture ID from the feed. Call POST /api/v2/favorites/{fixture} with cookies and CSRF header, without a body. Repeating this call is safe.
6. Read GET /api/v2/favorites or GET /api/v2/favorites/feed. Remove a favorite with DELETE /api/v2/favorites/{fixture}, also with cookies and CSRF header.
7. Call POST /api/auth/logout with cookies and CSRF header when finished.

Browser clients should use same-origin requests with credentials. Non-browser clients must maintain the cookie jar themselves. Login, logout and CSRF initialization can update cookies; always use their latest values.

Errors and request limits

API errors return JSON with a message. Validation errors also contain an errors object keyed by field. HTTP status codes indicate what to do next:

• 401: sign in or restore your session.
• 403: the account lacks permission for the requested operation. With email_unverified: true, the signed-in account has not confirmed its email yet: open the link from the verification mail, or drop the session cookie for public reads.
• 404: check the endpoint and identifier.
• 405: use the documented HTTP method.
• 419: refresh the CSRF cookie and header before retrying the write.
• 422: correct the fields in errors. Login also uses this status after five failed attempts per email/IP within a minute; follow the retry message.
• 429: wait the number of seconds specified by Retry-After.
• 5xx: a server failure; retry reads with backoff.

The public feed limit is 120 requests per minute per IP, shared by the daily feed, leagues, public prediction pages and other feed-throttled routes. X-RateLimit-Limit and X-RateLimit-Remaining report the allowance. Avoid polling unchanged historical data.

Consumer endpoints

This reference covers the fixture feed, leagues, favorites and existing-account sessions. Billing, registration, statistics and administrative interfaces are outside this OpenAPI contract.