API reference

This reference follows the routes mounted in the current production application. Paths and shapes below are the implemented contract, not a roadmap.

Request conventions

API-key authentication

Authorization: Bearer <YOUR_API_KEY>

Send the full key as a Bearer token. The API rejects api_key query parameters. Keys have explicit read, buy and sell scopes.

Browser-session mutations

X-CSRF-Token: <SESSION_CSRF>

Browser-session mutations for orders, rental extensions, auto-top-up rules and seller settings require this header. API keys do not use CSRF.

Idempotent mutations

Idempotency-Key: <UNIQUE_VALUE>

Single and batch order creation, multisig session creation and reinvestment preparation require a non-blank Idempotency-Key of at most 128 characters. Rental extension also uses an idempotency key. Reuse a value only when retrying the identical action.

JSON bodies

Content-Type: application/json

Send this media type on requests with a JSON body. Successful responses are the documented object directly, without a success envelope.

Cursor pagination

{ "items": [], "next_cursor": null, "has_more": false }

List routes return items, next_cursor and has_more. Treat the cursor as opaque and pass it unchanged on the next request; do not build offsets from it.

Standard error envelope

{ "error": { "code": "invalid_request", "message": "...", "request_id": "..." } }

Errors use one envelope. Codes include invalid_request, unauthorized, forbidden, not_found, conflict, rate_limited, unavailable, insufficient_balance and internal. Validation details appear only on 422 responses.

Public market

These routes need no credential. Use the query names shown below; routes with strict query validation reject unknown names instead of ignoring them.

GET /v1/price Public

Returns the latest settled price, 24-hour range and volume, plus live network ratios used by price and APY calculations.

Key fields
query: resource
Response
PriceResponse { resource, last_price_sun, change_24h_pct, high_24h_sun, low_24h_sun, volume_24h, network_ratio, burn_fee_sun_per_unit, trx_usd, updated_at }
GET /v1/market/depth Public

Returns aggregated ask and bid levels for one resource, rental duration and minimum lot.

Key fields
query: resource, duration, min_lot
Response
DepthResponse { resource, duration_sec, min_lot, asks[], bids[], spread_sun, updated_at }
GET /v1/market/trades Public

Returns settled fills only, newest first, with seller and on-chain evidence when available.

Key fields
query: resource, limit, cursor
Response
Page<TradeItem> { items[], next_cursor, has_more }
GET /v1/market/orders Public

Returns currently fillable public demand, including remaining amount, seller payout, fill floor and term.

Key fields
query: resource, duration_sec, min_amount, limit, cursor
Response
Page<MarketOrderItem> { items[], next_cursor, has_more }
GET /v1/market/stats Public

Returns headline activity and capacity totals for one resource.

Key fields
query: resource
Response
MarketStats { resource, open_orders, available_amount, volume_24h, fills_24h, active_sellers, avg_seller_apy_percent, network_ratio, updated_at }
GET /v1/market/ohlcv Public

Returns a bounded oldest-first candle window. tf accepts 1m, 5m, 15m, 1h, 4h or 1d.

Key fields
query: resource, tf, limit
Response
Page<OhlcvBar> { items[{ t, o, h, l, c, v }], next_cursor: null, has_more: false }
GET /v1/sellers Public

Returns currently eligible sellers ranked by measured execution for the selected resource.

Key fields
query: resource, limit, cursor
Response
Page<SellerPublic> { items[], next_cursor, has_more }
GET /v1/sellers/{address} Public

Returns the public execution record for one valid TRON seller address.

Key fields
path: address; query: resource
Response
SellerPublic { address, resource, fills_total, fill_rate_pct, rating, typical_delivery_ms, volume_trx, active_since }
WS /v1/stream Public channels; session cookie for user channel

Streams public price, depth, trade and order events. A signed-in session may also subscribe to its own user channel.

Key fields
frame: { op, channels[] }; public prefixes: price:, depth:, trades:, orders:
Response
welcome | subscribed | unsubscribed | event | pong | error

Authenticated buyer

Read calls require the read scope. Orders, rental extensions and auto-top-up changes require buy; browser sessions also supply their CSRF token.

POST /v1/orders buy scope; session mutations also need CSRF

Reserves the buyer balance, matches available supply and publishes any remainder as one transaction. Provider fallback is unavailable: omit allow_provider_fallback or send false; true is rejected with HTTP 422.

Key fields
body: resource, amount, duration_sec, price_sun, receiver_address, allow_partial, extension_required, smart_matching (optional; prefers a previously successful seller only within the same price level), allow_provider_fallback (optional; omit or false only while provider fallback is unavailable; true returns 422), slippage_pct, min_fill_amount, ttl_sec, scheduled_at (optional ISO-8601; naive=UTC, offset-aware normalized to UTC; for a new request, strictly future and no more than 7 days ahead); header: Idempotency-Key
Response
OrderResponse { id, status, extension_required, smart_matching, cost_trx, price_improvement_trx, fills[], scheduled_at, expires_at, created_at, ... }
POST /v1/orders/batch buy scope; session mutations also need CSRF

Creates 1–25 orders atomically from shared terms and unique activated TRON recipients. Recipient validation happens before escrow is committed, and identical retries return the existing batch.

Key fields
body: the same shared order terms plus receiver_addresses (1–25 unique activated TRON addresses); header: Idempotency-Key. The basket is atomic and a changed retry body returns 409.
Response
OrderBatchResponse { id, target_count, orders: OrderResponse[] }
POST /v1/multisig/sessions buy scope; session mutations also need CSRF

Prepares an unsigned transfer to the caller's platform deposit address. The server neither signs nor broadcasts it; the owner signs in TronLink. Status is pending until signature weight reaches the required threshold, ready after it does, or expired after the transaction deadline.

Key fields
body: owner_address, amount_trx, permission_id; header: Idempotency-Key
Response
MultisigSessionResponse { id, owner_address, destination_address, amount_trx, permission_id, tx_id, transaction, signatures_collected, required_weight, current_weight, status: pending | ready | expired, expires_at, created_at }
POST /v1/multisig/sessions/{session_id}/signatures buy scope; session mutations also need CSRF

Adds one user-provided signature, validates it against the prepared transaction and recalculates its on-chain permission weight. The server still does not broadcast the transaction.

Key fields
path: session_id; body: signature (130 hexadecimal characters)
Response
MultisigSessionResponse
GET /v1/multisig/sessions/{session_id} read scope: session or API key

Returns the caller's current signing session, collected signatures and verified weight without exposing another user's session.

Key fields
path: session_id
Response
MultisigSessionResponse
GET /v1/orders read scope: session or API key

Returns the caller's own orders, newest first, optionally limited to active orders.

Key fields
query: limit, cursor, active_only
Response
Page<OrderResponse> { items[], next_cursor, has_more }
GET /v1/rentals read scope: session or API key

Returns the caller's buyer-owned confirmed P2P rentals that remain live, including chain-verified delivered amount and unlock time. The receiver may be a different wallet. Provider fills remain visible in order history until provider lifetime evidence exists.

Key fields
query: limit, cursor
Response
Page<RentalItem> { items[{ id, order_id, resource, receiver_address, amount, delivered_amount, duration_sec, delegated_at, expires_at, status, cost_trx, can_extend, extension_order_id, extension_scheduled_at, extension_status }], next_cursor, has_more }
GET /v1/rentals/incoming read scope: session or API key

Returns settled live TET P2P delegations received by the caller's server-resolved primary verified wallet, including chain-verified delivered amount and unlock time. Buyer order and commercial fields are omitted.

Key fields
query: limit, cursor
Response
Page<IncomingDelegationItem> { items[{ id, resource, receiver_address, delivered_amount, delegated_at, expires_at, status }], next_cursor, has_more }
POST /v1/rentals/{rental_id}/extend buy scope; session mutations also need CSRF

Reserves the buyer's internal balance now and schedules one P2P child order for the rental's unlock time, preserving its delivered amount, receiver and term.

Key fields
path: rental_id; optional header: Idempotency-Key; no body
Response
RentalExtensionRequestResponse { id, rental_id, status, order_id, created_at, executed_at }; 202 accepted, 200 replay
GET /v1/mandates read scope: session or API key

Returns the caller's automatic top-up rules with current status, observed resource level, budget use and latest child order.

Key fields
query: limit, cursor
Response
Page<MandateResponse> { items[], next_cursor, has_more }
POST /v1/mandates buy scope; session mutations also need CSRF

Creates one automatic top-up rule funded from the internal balance, with explicit trigger, target, price, duration, budget and deadline limits.

Key fields
body: resource, target_address, trigger_level, target_level, duration_sec, max_price_sun, budget_trx, deadline, enabled
Response
MandateResponse { id, status, budget_used_trx, budget_remaining_trx, last_observed_available, last_order_id, ... }
PATCH /v1/mandates/{mandate_id} buy scope; session mutations also need CSRF

Changes an owned automatic top-up rule's limits or enabled state without changing its resource or target address.

Key fields
path: mandate_id; body: trigger_level, target_level, duration_sec, max_price_sun, budget_trx, deadline, enabled
Response
MandateResponse
GET /v1/orders/{order_id} read scope: session or API key

Returns one order owned by the caller; another user's order is indistinguishable from absent.

Key fields
path: order_id
Response
OrderResponse
PATCH /v1/orders/{order_id} buy scope; session mutations also need CSRF

Changes absolute order terms inside the edit window and reports the resulting escrow adjustment.

Key fields
path: order_id; body: price_sun, amount, receiver_address
Response
OrderResponse { ..., escrow_delta_trx }
DELETE /v1/orders/{order_id} buy scope; session mutations also need CSRF

Cancels an eligible order and returns two separate exact TRX amounts: released escrow/refund in refunded_trx and the conditional fee in cancellation_fee_trx. A zero fee means no fee was charged.

Key fields
path: order_id
Response
OrderResponse { ..., refunded_trx, cancellation_fee_trx }

Authenticated seller

Seller reports use the read scope. Synchronising or changing the auto-sell pool requires the sell scope.

GET /v1/seller/pool read scope: session or API key

Returns the caller's seller status, exact permission requirements, capacity, pending earnings and auto-sell settings.

Key fields
none
Response
SellerPoolResponse { status, permissions, stake and capacity, pending_payout_trx, smart_reuse, auto_extend, reinvest, settings }
POST /v1/seller/pool/sync sell scope; session mutations also need CSRF

Reconciles the verified wallet against live chain permission, stake and bandwidth state, creating the seller row if needed.

Key fields
none
Response
SellerPoolResponse
PATCH /v1/seller/pool sell scope; session mutations also need CSRF

Saves auto-sell terms and seller policies. smart_reuse prioritises a seller previously used for the same receiver only inside an equal-price level; auto_extend permits a buyer-requested same-term extension; reinvest enables non-custodial reinvestment preparation.

Key fields
body: auto_sell_enabled, bandwidth_auto_sell_enabled, smart_reuse, auto_extend, reinvest, min_price_sun, bandwidth_min_price_sun, allowed_durations_sec, min_order_amount, max_order_amount, min_delegation
Response
SellerPoolResponse
GET /v1/seller/delegations read scope: session or API key

Returns the caller's outgoing delegations and recorded delivery and payout evidence.

Key fields
query: resource, active_only, limit, cursor
Response
Page<DelegationItem> { items[], next_cursor, has_more }
GET /v1/seller/earnings read scope: session or API key

Returns pending, paid and today's seller earnings, the next payout policy boundary when currently payable, and a 30-day daily history.

Key fields
none
Response
EarningsResponse { pending_trx, paid_total_trx, today_trx, apy_30d_percent, next_payout_at, history[] }
POST /v1/seller/reinvestment/sessions sell scope; session mutations also need CSRF

Prepares an unsigned FreezeBalanceV2 for one completed seller payout. The server never signs or broadcasts it; the seller signs and broadcasts from TronLink. One payout can back only one session.

Key fields
header: Idempotency-Key; no body
Response
SellerReinvestmentSessionResponse { id, payout_entry_id, amount_trx, tx_id, transaction, status: pending | signed | expired, expires_at, signed_at, created_at }
POST /v1/seller/reinvestment/sessions/{session_id}/confirmation sell scope; session mutations also need CSRF

Validates that the signed transaction is the prepared FreezeBalanceV2, verifies its signature weight and records the session as signed without broadcasting it.

Key fields
path: session_id; body: signed_transaction
Response
SellerReinvestmentSessionResponse
GET /v1/seller/reinvestment/sessions/{session_id} read scope: session or API key

Returns the caller's reinvestment session in pending, signed or expired state.

Key fields
path: session_id
Response
SellerReinvestmentSessionResponse

Authentication and account

Wallet sign-in creates the browser session. API-key lifecycle mutations remain session-only so a stolen key cannot mint or replace credentials.

POST /v1/auth/nonce Public

Returns the exact site-bound message that the wallet must sign.

Key fields
body: address
Response
NonceResponse { nonce, message, expires_at }
POST /v1/auth/verify Public

Verifies the nonce message and TIP-191 signature, then creates the browser session. An optional referral code is applied only when the wallet creates a new account.

Key fields
body: address, message, signature, ref? (6–32 URL-safe characters)
Response
SessionResponse { user_id, address, role, csrf, expires_at, created } + session cookie
POST /v1/auth/logout Browser session

Revokes and clears the current browser session.

Key fields
none
Response
{ ok: true }
GET /v1/auth/me Session or API key

Returns the current principal, authentication method and effective scopes.

Key fields
none
Response
MeResponse { user_id, role, method, scopes[], preferred_lang }
GET /v1/balance read scope: session or API key

Returns exact decimal-string account balances, nullable deposit_address and deposit_minimum_trx, and the required recent_deposits array. When deposits are configured and scanner allocation is ready, the address is the caller's stable personal platform deposit address and the minimum is the exact decimal-string TRX amount required for automatic credit; both are null when deposits are disabled or unavailable. Without deposit_txid, recent_deposits contains at most the caller's five newest entries with txid, amount_trx, status, confirmations_required, observed_at and credited_at. With a deposit_txid of exactly 64 hexadecimal characters, it contains zero or one exact caller-owned match even when that deposit is older. seen awaits confirmations; confirmed has enough confirmations but remains uncredited because it is below the current minimum; credited reached the available balance; orphaned lost canonical-chain status and any credit was reversed.

Key fields
query: deposit_txid (optional; exactly 64 hexadecimal characters)
Response
BalanceResponse { user_id, available_trx, escrow_held_trx, seller_pending_trx, deposit_address, deposit_minimum_trx, recent_deposits[{ txid, amount_trx, status, confirmations_required, observed_at, credited_at }] }
GET /v1/referrals read scope: session or API key

Returns the caller's stable invite link, pending and lifetime rewards, invited accounts with order status, and persisted payout history. next_payout_at remains null until a payout batch is actually scheduled.

Key fields
none
Response
ReferralsResponse { code, link, pending_trx, earned_total_trx, active_count, awaiting_first_order, next_payout_at, referred[], payouts[] }
POST /v1/keys Browser session + CSRF

Creates a scoped API key. The full secret is returned once and is not recoverable later.

Key fields
body: name, can_read, can_buy, can_sell
Response
ApiKeyResponse { id, name, key_prefix, secret, can_read, can_buy, can_sell, last_used_at, created_at, revoked_at }; secret appears once
GET /v1/keys Browser session

Returns the complete owned key lifecycle history, including revoked keys.

Key fields
none
Response
Page<ApiKeyResponse> { items[], has_more: false }
DELETE /v1/keys/{key_id} Browser session + CSRF

Revokes one owned API key without revealing whether another user's key exists.

Key fields
path: key_id
Response
ApiKeyResponse { ..., revoked_at }