# CS2 trade protection and inventory completeness

Two Steam rules affect recently acquired Counter-Strike 2 items:

- [Steam's trade protection](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD) lasts seven days **after an item is received in a trade**. The item is delivered immediately and can be used in-game, but cannot be transferred, consumed, or modified during that period.
- [Steam's inventory visibility rule](https://store.steampowered.com/news/app/730/view/4185606994270578440) says purchased and traded Counter-Strike items are not visible to **other users viewing the inventory** for ten days. This is a separate rule; a seven-day trade protection period and a ten-day public visibility delay must not be treated as the same timestamp.

## What a WOK inventory response establishes

By default, WOK reads a public CS2 inventory from Steam Community **context 2** (`/inventory/{steamid}/730/2`). `GET /v1/inventory?game=cs2` and its compatibility route `/steam/api/inventory?game=cs2` return items Steam exposed through that context. A complete, successfully paginated context-2 response proves only that WOK read the **visible context-2 items**; it cannot prove that no recently acquired, hidden items belong to the account. `no_cache=1` refreshes the public source and does not remove that visibility limit. Private inventories remain private.

The default native response marks this scope with `meta.coverage: "public_only"` and `meta.context_id: "2"`. The compatibility response uses `X-Wok-Inventory-Coverage: public_only`. `meta.steam_count_mismatch` or `X-Wok-Steam-Count-Mismatch: 1` means Steam's reported count differed from the verified number of returned items. It is a diagnostic, **not** proof of how many items are hidden or why they are absent.

The opt-in `try_first_seven_days_blocked_items=1` first obtains the public inventory, then makes bounded authenticated **partner trade-window context-2** and **context-16** reads. WOK compares asset IDs across all usable reads and may add candidates absent from the public response. The same asset ID is counted once; a partner record takes precedence if both authenticated views return it. These views can expose more items than the public view, but their contents do not prove that an extra item is in the seven-day Trade Protected state. Steam may also omit assets from every view. No trade offer is sent. The caller supplies only a WOK key and SteamID; WOK's bot credentials remain server-side. Steam public visibility is checked without bot cookies before each connector delivery; WOK keeps a successful overlay for at most 15 seconds before requiring another check.

Read the native `meta.coverage` before using the result:

| `meta.coverage` | Meaning |
|---|---|
| `public_only` | Only the public context-2 result is available. In mode `1`, `meta.protected_items_fallback: "public_only"` (or compatibility header `X-Wok-Protected-Items-Fallback: public_only`) identifies an unavailable trade-view read, including when its bounded capacity is busy or Steam refuses a source. |
| `public_plus_trade_view_unverified` | At least one authenticated view was usable. `items[]` may contain extra candidates; `meta.trade_view_extra_count` is their number before display filtering. `meta.trade_view_partial: true` means context 2 or 16 was unavailable, truncated, or had invalid rows. Even `false` does not establish complete ownership or seven-day protection status. |

In mode `1`, `meta.public_items_total` is the public item count, `meta.trade_view_extra_count` is the quantity of additional items after asset-ID deduplication, and top-level `items_total` is their **combined observed count**. That count is not a guarantee of all owned assets. `meta.public_snapshot_age_seconds` tells you how old the public snapshot was when compared with the trade view; `meta.trade_view_partial` signals a possibly incomplete trade-view read. `meta.valuation_scope: "public_only"`, `meta.counts_scope: "public_only"`, and `meta.protection_status: "unverified"` make the other limits explicit: top-level `total`, `estimated_total`, `sellable`, `untradable`, `tradelocked`, `unpriced`, and their values describe **public context-2 assets only**.

Extra candidates stay separate from public rows and from candidates in the other authenticated view with the same market name, even with `group=1`. The exact origin is `source: "authenticated_steam_trade_view", context_id: "2"` or `source: "authenticated_steam_context16", context_id: "16"`. Every candidate also has `visibility: "absent_from_public_snapshot"`, `protection_status: "unverified"`, and `tradeprotected: null`. Grouped candidate rows include `trade_view_assetids[]`; compatibility `group=0` rows have one `assetid`. Candidates appear before public rows when mode `1` applies `search` and native `top`, so a default `top=10` can display them. Their row price may come from WOK's saved catalog by market hash name, identified by `price_basis: "local_catalog_market_hash_name"`; it is a generic item quote, not a float or attachment premium. Missing quotes leave price fields null or empty and `price_basis: null`. Even a priced candidate is excluded from top-level portfolio values. Do not interpret `tradeprotected: null` as `true`. A fallback returns the public items with `coverage: "public_only"` when neither authenticated view is usable.

Mode `2` requires verified protected-item coverage and returns **HTTP 501** while that guarantee is unavailable. Omit the option or use `0` for the public context-2 inventory. Modes `1` and `2` are valid only for CS2; other games return HTTP 400.

For each returned item, `tradable` reflects Steam's visible item description. WOK's `tradelocked` means its parser found evidence of a *current temporary trading restriction* on that visible item. `tradelockuntil` can be absent or approximate; do not treat it as Steam's exact protection expiry. `tradelocked: false` means no such lock was established for that returned item. It says nothing about items omitted from context 2. The nullable `tradeprotected` field is `null` when WOK cannot verify Steam's distinct seven-day Trade Protected state from its source; `null` is neither `true` nor `false`. In particular, `tradelocked` and `tradeprotected` are not interchangeable.

Images and any inspect data, float, paint seed, stickers, and charms describe only the items actually returned or subsequently enriched. For a candidate with `include_inspect=1`, a valid inspect certificate can provide an inspect link, float, seed, paint index and locally decoded sticker or charm IDs for that exact asset. `attachments_known: true` appears only when the certificate supports the attachment set; names may resolve from WOK's local catalog, while attachment images and prices can remain unavailable. Without a valid certificate, these fields stay absent. The monetary totals and public-only counters in mode `1` may be below the account's true holdings during Steam's visibility delay. Do not turn a missing item into `tradeprotected: false`, a zero-valued asset, or a claim that the owner no longer has it.

[`GET /v1/cs2/item-preview`](cs2-item-preview.md) can resolve public class-level metadata by a known Steam `classid` and `instanceid`. It does not list a player's assets or reveal whether any asset is protected.

## What broader coverage would require

The [SteamWebAPI inventory reference](https://api.steamwebapi.com/api/steam/documentation) describes its protected-item detection using an **authenticated trading-inventory path** and CS2 context 16 alongside context 2. That is the competitor's description of its own implementation, not a Valve guarantee that any third party can read every protected item. Valve's documented [`IInventoryService/GetInventory`](https://partner.steamgames.com/doc/webapi/IInventoryService) requires a game's Steamworks *publisher* key with Economy permission; an ordinary Steam Web API key does not grant that access.

WOK's authenticated candidate reads are best effort and do not establish complete protected-inventory coverage. In a live comparison, three CS2 asset IDs appeared in an authenticated trade view but not in the complete public context-2 response; the combined set still fell short of Steam's reported item count. Those three descriptions showed `tradable=1` and no owner-specific protection text, so their actual Trade Protected state was unknown. A Steam count mismatch alone cannot identify missing items. Steam's rate limits, privacy settings, and incomplete upstream replies must remain visible through coverage or error signals. No Steam login cookie, trade URL, or Steam token is required from a WOK client.