POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)

Summary

The POST /api/bitcoinWithdrawalFees endpoint returns real-time Bitcoin withdrawal fee data without requiring any authentication, despite being explicitly documented as a "USER OPERATION" (private endpoint) in the official CoinMate API documentation.

This is the only private endpoint that does not enforce authentication. All other USER OPERATION endpoints (e.g., /api/balances, /api/openOrders, /api/bitcoinDepositAddresses) correctly reject unauthenticated requests with {"error": true, "errorMessage": "Invalid request"}.

Root Cause

The authentication middleware/filter on the /api/bitcoinWithdrawalFees endpoint is misconfigured, allowing the request to bypass HMAC-SHA256 signature verification. This is confirmed by the fact that all three official API client libraries (Java, TypeScript, Python) invoke this endpoint via their postPrivate() methods, which attach clientId, nonce, publicKey, and signature parameters.