Endpoints

REST routes are under /api/v1. Trading and account streams share one WebSocket at /ws/v1.

Set the host with your SDK (baseUrl, restBaseUrl) or the origin issued with your API credentials. Examples in these docs use relative paths. A request shown as POST /orders means POST /api/v1/orders on that origin.

REST

Method	Path	Auth	Purpose
`POST`	`/auth/token`	API credentials	Exchange key id, secret, and passphrase for a bearer token
`POST`	`/auth/token/revoke`	Bearer	Revoke the current access token
`GET`	`/time`	—	Server clock
`GET`	`/rate-limits`	—	Public rate-limit manifest
`GET`	`/instruments`	—	Tradable instruments
`GET`	`/instruments/{symbol}`	—	One instrument
`POST`	`/orders`	Bearer + HPKE	Place an order
`DELETE`	`/orders/{orderId}`	Bearer + HPKE	Cancel an order
`PATCH`	`/orders/{orderId}`	Bearer + HPKE	Modify an order
`GET`	`/orders/{orderId}`	Bearer	Order pointer. Use the orders stream for status
`POST`	`/orders/massQuote`	Bearer + HPKE	Mass quote
`POST`	`/account`	Bearer + HPKE	Account margin snapshot
`POST`	`/positions`	Bearer + HPKE	Positions snapshot
`POST`	`/openOrders`	Bearer + HPKE	Open-orders snapshot
`GET`	`/tiers/config`	—	VIP tier definitions
`GET`	`/tiers/config/{tier_level}`	—	One VIP tier
`GET`	`/tiers/status`	Bearer	Your tier and rolling volume
`GET`	`/stats/platform`	—	Public platform statistics

Account, positions, and open orders are encrypted POST snapshots. There is no public GET for those resources.

WebSocket

/ws/v1

Frame	Direction	Purpose
`op: login`	Client → server	Authenticate with the access token
`op: logout`	Client → server	End the session
`op: ping` / `pong`	Both	Heartbeat
`op: subscribe` / `unsubscribe`	Client → server	Register channels
HPKE setup and sealed commands	Binary	Place, cancel, modify, and related commands
Public channels	Server → client	`volume`, `open_interest`, `funding_rate`
Private channels	Server → client	`orders`, `positions` (login required)

See WebSocket Trading, Orders Channel, and Positions Channel.

Headers

Authenticated JSON requests:

Content-Type: application/json
Authorization: Bearer <access_token>

Encrypted trading bodies use the media type produced by the SDK. Do not send ciphertext as application/json.

Header	Purpose
`X-Request-Id`	Request id to include in support reports
`X-RateLimit-Limit`	Budget for the current window
`X-RateLimit-Remaining`	Remaining budget
`X-RateLimit-Reset`	Unix seconds when the window resets

Response envelope

{
  "code": 0,
  "data": {},
  "timestamp": "2026-04-20T10:30:00.123Z",
  "request_id": "req_01HXYZ..."
}

Errors use the same envelope with a non-zero code and a message. See Error Codes.

Server time

GET /time returns server_time and server_time_ns.