> ## Documentation Index
> Fetch the complete documentation index at: https://docs.elata.bio/llms.txt
> Use this file to discover all available pages before exploring further.

# List holders

> Paginated list of app token holders, ranked by balance.

<Note>**Status: proposed.** This endpoint is designed here but not yet implemented on `app.elata.bio/api`.</Note>


## OpenAPI

````yaml /api-reference/openapi.yaml GET /apps/{tokenAddress}/holders
openapi: 3.1.0
info:
  title: Elata App Store API
  version: 0.1.0
  description: |
    REST API for the Elata App Store at `app.elata.bio`.

    This spec is the source of truth for the public HTTP surface that powers
    third-party app discovery, launch flows, market widgets, user portfolio
    views, rewards claims, and runtime config.

    ### Status legend

    Every operation in this spec carries an `x-elata-status` extension:

    - `stable` — implemented today on `app.elata.bio/api`. Safe to depend on.
    - `proposed` — designed here, **not yet implemented**. Spec is the contract
      the backend should build against. Subject to change.
    - `planned` — acknowledged but not yet designed. Reserved namespace.

    ### Rate limits

    | Endpoint class | Limit       |
    | -------------- | ----------- |
    | Read endpoints | 100 req/min |
    | Heavy queries  | 10 req/min  |

    Production builds should bring their own RPC provider for direct
    on-chain reads (Alchemy, Infura, QuickNode).
  contact:
    name: Elata Biosciences
    url: https://github.com/elata-biosciences
servers:
  - url: https://app.elata.bio/api
    description: Production
security:
  - {}
  - siweBearer: []
tags:
  - name: Apps
    description: App discovery and detail.
  - name: Preflight
    description: Pre-launch validation for builders before sending transactions.
  - name: Market
    description: Token prices, candles, bonding-curve state, leaderboards.
  - name: Portfolio
    description: Per-wallet holdings, history, and P&L.
  - name: Rewards
    description: Claimable rewards across protocol and per-app distributors.
  - name: Config
    description: Runtime configuration for SDKs and AI agents.
paths:
  /apps/{tokenAddress}/holders:
    get:
      tags:
        - Apps
      summary: List app token holders
      operationId: listAppHolders
      parameters:
        - $ref: '#/components/parameters/TokenAddress'
        - $ref: '#/components/parameters/Cursor'
        - $ref: '#/components/parameters/Limit'
      responses:
        '200':
          description: Holders ranked by balance.
          content:
            application/json:
              schema:
                type: object
                properties:
                  holders:
                    type: array
                    items:
                      $ref: '#/components/schemas/Holder'
                  nextCursor:
                    type: string
                    nullable: true
components:
  parameters:
    TokenAddress:
      in: path
      name: tokenAddress
      required: true
      schema:
        type: string
        pattern: ^0x[a-fA-F0-9]{40}$
      description: ERC-20 address of the app token.
    Cursor:
      in: query
      name: cursor
      schema:
        type: string
      description: Opaque pagination cursor returned by the previous page.
    Limit:
      in: query
      name: limit
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 25
  schemas:
    Holder:
      type: object
      properties:
        address:
          type: string
        balance:
          type: string
          description: Raw uint256 token balance as a decimal string.
        sharePct:
          type: number
          format: float
  securitySchemes:
    siweBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        SIWE-issued JWT, scoped to a wallet address. Obtain via Sign-In With
        Ethereum (EIP-4361) against `app.elata.bio`. Required for personalized
        Portfolio and Rewards endpoints. The `sub` claim is the wallet address;
        a request whose path `{address}` does not match the `sub` is rejected.

````