capper.win API

Read a day’s matches

Public reads need no account or API key (the interactive app at /app does need a verified account). Use Accept: application/json. The API groups fixtures by country, then league. Each fixture includes its internal id and a url for the HTML match page.

curl --get 'https://capper.win/api/v2/list' \
  --header 'Accept: application/json' \
  --data-urlencode 'date=2026-10-26' \
  --data-urlencode 'tz=Europe/Kyiv' \
  --data-urlencode 'market=total_goals'

• date: a calendar date in YYYY-MM-DD. Defaults to today in the requested timezone.
• tz: an IANA timezone, such as Europe/Kyiv, America/Chicago or UTC. Defaults to Europe/Kyiv.
• market: total_goals, corners, team_total, match_winner, double_chance, handicap or btts. Defaults to total_goals. Basketball has total_points, team_total, match_winner and handicap, with total_points as its default. Hockey has total_goals, team_total, match_winner and handicap, with total_goals as its default.
• sport: football, basketball or hockey. Defaults to football when absent or empty, so existing clients keep today’s response; an unknown value returns 404 with {"error":"unknown_sport"}. Also accepted by /api/v2/leagues and /api/v2/favorites/feed. GET /api/v2/sports lists the sports with their market keys and the day’s fixture count.

A day includes its local midnight and excludes the next midnight. The response echoes the resolved date and market. Unknown markets and timezones fall back to their defaults; unparseable date strings fall back to today. Send valid scalar parameters rather than relying on these fallbacks.

Read fixtures at countries[].leagues[].fixtures[]. An empty countries array means no matching fixtures. Result markets omit fixtures with no predictions. These endpoints return the complete selected set without pagination. Use the internal fixture ID, not the upstream football provider’s ID, for favorites.

Every fixture names its sport and carries a short team name in home.short and away.short (null when unknown). For basketball, home.goals and away.goals hold the points including overtime, a live game names its quarter in period (Q1–Q4, OT, HT, BT), and periods lists the points per quarter and in overtime for each side. A basketball game never ends in a draw. For hockey, home.goals and away.goals hold the final goals including overtime and, after a shootout, the winner’s one shootout goal; a live game names its period in period (P1–P3, OT, PT, BT), periods lists the goals per period (three entries), in overtime and, after a shootout, each side’s shootout tally in so, and a hockey game never ends in a draw either.

Prediction access and results

Picks on upcoming or live matches require a session with an active premium entitlement. Finished matches expose their predictions publicly. Hidden providers are excluded; tipsters use public codenames for non-admin viewers.

A locked prediction contains locked: true, its provider and highlight flags. Its pick, line, label, odds and result are omitted. An unlocked prediction has locked: false and a readable label such as Over 2.5. Bookmaker odds (odd) are sent to signed-in viewers and are null for anonymous requests.

• hit: the prediction won.
• miss: the prediction lost.
• push: the stake was returned.
• pending: the prediction has not been settled.

An empty predictions array means no pick is available for this market. predictions_eta, when present, is an estimate for a scheduled prediction, not a guarantee. Scores and results can lag the match; the daily API can trigger a guarded live refresh. Forecasts are informational only and no outcome is guaranteed.

Sessions and favorites

Account operations use the same cookie session as the website. There is no API-key or delegated OAuth-token flow. Use an existing account that you are authorized to access; registration is available on the sign-up page.

1. Call GET /api/auth/csrf-cookie and retain all response cookies in a cookie jar.
2. URL-decode the current XSRF-TOKEN cookie. Send it as X-XSRF-TOKEN with the cookies on every POST or DELETE request.
3. Call POST /api/auth/login with JSON {"email":"you@example.com","password":"your-password"}. Retain the rotated cookies and refresh your CSRF header from the new cookie.
4. Use GET /api/auth/user to confirm the session and user.premium to check access.
5. Choose a fixture ID from the feed. Call POST /api/v2/favorites/{fixture} with cookies and CSRF header, without a body. Repeating this call is safe.
6. Read GET /api/v2/favorites or GET /api/v2/favorites/feed. Remove a favorite with DELETE /api/v2/favorites/{fixture}, also with cookies and CSRF header.
7. Call POST /api/auth/logout with cookies and CSRF header when finished.

Browser clients should use same-origin requests with credentials. Non-browser clients must maintain the cookie jar themselves. Login, logout and CSRF initialization can update cookies; always use their latest values.

Errors and request limits

API errors return JSON with a message. Validation errors also contain an errors object keyed by field. HTTP status codes indicate what to do next:

• 401: sign in or restore your session.
• 403: the account lacks permission for the requested operation. With email_unverified: true, the signed-in account has not confirmed its email yet: open the link from the verification mail, or drop the session cookie for public reads.
• 404: check the endpoint and identifier.
• 405: use the documented HTTP method.
• 419: refresh the CSRF cookie and header before retrying the write.
• 422: correct the fields in errors. Login also uses this status after five failed attempts per email/IP within a minute; follow the retry message.
• 429: wait the number of seconds specified by Retry-After.
• 5xx: a server failure; retry reads with backoff.

The public feed limit is 120 requests per minute per IP, shared by the daily feed, leagues, public prediction pages and other feed-throttled routes. X-RateLimit-Limit and X-RateLimit-Remaining report the allowance. Avoid polling unchanged historical data.

Consumer endpoints

This reference covers the fixture feed, leagues, favorites and existing-account sessions. Billing, registration, statistics and administrative interfaces are outside this OpenAPI contract.