API reference
This reference follows the routes mounted in the current production application. Paths and shapes below are the implemented contract, not a roadmap.
Request conventions
API-key authentication
Authorization: Bearer <YOUR_API_KEY> Send the full key as a Bearer token. The API rejects api_key query parameters. Keys have explicit read, buy and sell scopes.
Browser-session mutations
X-CSRF-Token: <SESSION_CSRF> Browser-session mutations for orders, rental extensions, auto-top-up rules and seller settings require this header. API keys do not use CSRF.
Idempotent mutations
Idempotency-Key: <UNIQUE_VALUE> Single and batch order creation, multisig session creation and reinvestment preparation require a non-blank Idempotency-Key of at most 128 characters. Rental extension also uses an idempotency key. Reuse a value only when retrying the identical action.
JSON bodies
Content-Type: application/json Send this media type on requests with a JSON body. Successful responses are the documented object directly, without a success envelope.
Cursor pagination
{ "items": [], "next_cursor": null, "has_more": false } List routes return items, next_cursor and has_more. Treat the cursor as opaque and pass it unchanged on the next request; do not build offsets from it.
Standard error envelope
{ "error": { "code": "invalid_request", "message": "...", "request_id": "..." } } Errors use one envelope. Codes include invalid_request, unauthorized, forbidden, not_found, conflict, rate_limited, unavailable, insufficient_balance and internal. Validation details appear only on 422 responses.
Public market
These routes need no credential. Use the query names shown below; routes with strict query validation reject unknown names instead of ignoring them.
GET /v1/price PublicReturns the latest settled price, 24-hour range and volume, plus live network ratios used by price and APY calculations.
- Key fields
query: resource- Response
PriceResponse { resource, last_price_sun, change_24h_pct, high_24h_sun, low_24h_sun, volume_24h, network_ratio, burn_fee_sun_per_unit, trx_usd, updated_at }
GET /v1/market/depth PublicReturns aggregated ask and bid levels for one resource, rental duration and minimum lot.
- Key fields
query: resource, duration, min_lot- Response
DepthResponse { resource, duration_sec, min_lot, asks[], bids[], spread_sun, updated_at }
GET /v1/market/trades PublicReturns settled fills only, newest first, with seller and on-chain evidence when available.
- Key fields
query: resource, limit, cursor- Response
Page<TradeItem> { items[], next_cursor, has_more }
GET /v1/market/orders PublicReturns currently fillable public demand, including remaining amount, seller payout, fill floor and term.
- Key fields
query: resource, duration_sec, min_amount, limit, cursor- Response
Page<MarketOrderItem> { items[], next_cursor, has_more }
GET /v1/market/stats PublicReturns headline activity and capacity totals for one resource.
- Key fields
query: resource- Response
MarketStats { resource, open_orders, available_amount, volume_24h, fills_24h, active_sellers, avg_seller_apy_percent, network_ratio, updated_at }
GET /v1/market/ohlcv PublicReturns a bounded oldest-first candle window. tf accepts 1m, 5m, 15m, 1h, 4h or 1d.
- Key fields
query: resource, tf, limit- Response
Page<OhlcvBar> { items[{ t, o, h, l, c, v }], next_cursor: null, has_more: false }
GET /v1/sellers PublicReturns currently eligible sellers ranked by measured execution for the selected resource.
- Key fields
query: resource, limit, cursor- Response
Page<SellerPublic> { items[], next_cursor, has_more }
GET /v1/sellers/{address} PublicReturns the public execution record for one valid TRON seller address.
- Key fields
path: address; query: resource- Response
SellerPublic { address, resource, fills_total, fill_rate_pct, rating, typical_delivery_ms, volume_trx, active_since }
WS /v1/stream Public channels; session cookie for user channelStreams public price, depth, trade and order events. A signed-in session may also subscribe to its own user channel.
- Key fields
frame: { op, channels[] }; public prefixes: price:, depth:, trades:, orders:- Response
welcome | subscribed | unsubscribed | event | pong | error
Authenticated buyer
Read calls require the read scope. Orders, rental extensions and auto-top-up changes require buy; browser sessions also supply their CSRF token.
POST /v1/orders buy scope; session mutations also need CSRFReserves the buyer balance, matches available supply and publishes any remainder as one transaction. Provider fallback is unavailable: omit allow_provider_fallback or send false; true is rejected with HTTP 422.
- Key fields
body: resource, amount, duration_sec, price_sun, receiver_address, allow_partial, extension_required, smart_matching (optional; prefers a previously successful seller only within the same price level), allow_provider_fallback (optional; omit or false only while provider fallback is unavailable; true returns 422), slippage_pct, min_fill_amount, ttl_sec, scheduled_at (optional ISO-8601; naive=UTC, offset-aware normalized to UTC; for a new request, strictly future and no more than 7 days ahead); header: Idempotency-Key- Response
OrderResponse { id, status, extension_required, smart_matching, cost_trx, price_improvement_trx, fills[], scheduled_at, expires_at, created_at, ... }
POST /v1/orders/batch buy scope; session mutations also need CSRFCreates 1–25 orders atomically from shared terms and unique activated TRON recipients. Recipient validation happens before escrow is committed, and identical retries return the existing batch.
- Key fields
body: the same shared order terms plus receiver_addresses (1–25 unique activated TRON addresses); header: Idempotency-Key. The basket is atomic and a changed retry body returns 409.- Response
OrderBatchResponse { id, target_count, orders: OrderResponse[] }
POST /v1/multisig/sessions buy scope; session mutations also need CSRFPrepares an unsigned transfer to the caller's platform deposit address. The server neither signs nor broadcasts it; the owner signs in TronLink. Status is pending until signature weight reaches the required threshold, ready after it does, or expired after the transaction deadline.
- Key fields
body: owner_address, amount_trx, permission_id; header: Idempotency-Key- Response
MultisigSessionResponse { id, owner_address, destination_address, amount_trx, permission_id, tx_id, transaction, signatures_collected, required_weight, current_weight, status: pending | ready | expired, expires_at, created_at }
POST /v1/multisig/sessions/{session_id}/signatures buy scope; session mutations also need CSRFAdds one user-provided signature, validates it against the prepared transaction and recalculates its on-chain permission weight. The server still does not broadcast the transaction.
- Key fields
path: session_id; body: signature (130 hexadecimal characters)- Response
MultisigSessionResponse
GET /v1/multisig/sessions/{session_id} read scope: session or API keyReturns the caller's current signing session, collected signatures and verified weight without exposing another user's session.
- Key fields
path: session_id- Response
MultisigSessionResponse
GET /v1/orders read scope: session or API keyReturns the caller's own orders, newest first, optionally limited to active orders.
- Key fields
query: limit, cursor, active_only- Response
Page<OrderResponse> { items[], next_cursor, has_more }
GET /v1/rentals read scope: session or API keyReturns the caller's buyer-owned confirmed P2P rentals that remain live, including chain-verified delivered amount and unlock time. The receiver may be a different wallet. Provider fills remain visible in order history until provider lifetime evidence exists.
- Key fields
query: limit, cursor- Response
Page<RentalItem> { items[{ id, order_id, resource, receiver_address, amount, delivered_amount, duration_sec, delegated_at, expires_at, status, cost_trx, can_extend, extension_order_id, extension_scheduled_at, extension_status }], next_cursor, has_more }
GET /v1/rentals/incoming read scope: session or API keyReturns settled live TET P2P delegations received by the caller's server-resolved primary verified wallet, including chain-verified delivered amount and unlock time. Buyer order and commercial fields are omitted.
- Key fields
query: limit, cursor- Response
Page<IncomingDelegationItem> { items[{ id, resource, receiver_address, delivered_amount, delegated_at, expires_at, status }], next_cursor, has_more }
POST /v1/rentals/{rental_id}/extend buy scope; session mutations also need CSRFReserves the buyer's internal balance now and schedules one P2P child order for the rental's unlock time, preserving its delivered amount, receiver and term.
- Key fields
path: rental_id; optional header: Idempotency-Key; no body- Response
RentalExtensionRequestResponse { id, rental_id, status, order_id, created_at, executed_at }; 202 accepted, 200 replay
GET /v1/mandates read scope: session or API keyReturns the caller's automatic top-up rules with current status, observed resource level, budget use and latest child order.
- Key fields
query: limit, cursor- Response
Page<MandateResponse> { items[], next_cursor, has_more }
POST /v1/mandates buy scope; session mutations also need CSRFCreates one automatic top-up rule funded from the internal balance, with explicit trigger, target, price, duration, budget and deadline limits.
- Key fields
body: resource, target_address, trigger_level, target_level, duration_sec, max_price_sun, budget_trx, deadline, enabled- Response
MandateResponse { id, status, budget_used_trx, budget_remaining_trx, last_observed_available, last_order_id, ... }
PATCH /v1/mandates/{mandate_id} buy scope; session mutations also need CSRFChanges an owned automatic top-up rule's limits or enabled state without changing its resource or target address.
- Key fields
path: mandate_id; body: trigger_level, target_level, duration_sec, max_price_sun, budget_trx, deadline, enabled- Response
MandateResponse
GET /v1/orders/{order_id} read scope: session or API keyReturns one order owned by the caller; another user's order is indistinguishable from absent.
- Key fields
path: order_id- Response
OrderResponse
PATCH /v1/orders/{order_id} buy scope; session mutations also need CSRFChanges absolute order terms inside the edit window and reports the resulting escrow adjustment.
- Key fields
path: order_id; body: price_sun, amount, receiver_address- Response
OrderResponse { ..., escrow_delta_trx }
DELETE /v1/orders/{order_id} buy scope; session mutations also need CSRFCancels an eligible order and returns two separate exact TRX amounts: released escrow/refund in refunded_trx and the conditional fee in cancellation_fee_trx. A zero fee means no fee was charged.
- Key fields
path: order_id- Response
OrderResponse { ..., refunded_trx, cancellation_fee_trx }
Authenticated seller
Seller reports use the read scope. Synchronising or changing the auto-sell pool requires the sell scope.
GET /v1/seller/pool read scope: session or API keyReturns the caller's seller status, exact permission requirements, capacity, pending earnings and auto-sell settings.
- Key fields
none- Response
SellerPoolResponse { status, permissions, stake and capacity, pending_payout_trx, smart_reuse, auto_extend, reinvest, settings }
POST /v1/seller/pool/sync sell scope; session mutations also need CSRFReconciles the verified wallet against live chain permission, stake and bandwidth state, creating the seller row if needed.
- Key fields
none- Response
SellerPoolResponse
PATCH /v1/seller/pool sell scope; session mutations also need CSRFSaves auto-sell terms and seller policies. smart_reuse prioritises a seller previously used for the same receiver only inside an equal-price level; auto_extend permits a buyer-requested same-term extension; reinvest enables non-custodial reinvestment preparation.
- Key fields
body: auto_sell_enabled, bandwidth_auto_sell_enabled, smart_reuse, auto_extend, reinvest, min_price_sun, bandwidth_min_price_sun, allowed_durations_sec, min_order_amount, max_order_amount, min_delegation- Response
SellerPoolResponse
GET /v1/seller/delegations read scope: session or API keyReturns the caller's outgoing delegations and recorded delivery and payout evidence.
- Key fields
query: resource, active_only, limit, cursor- Response
Page<DelegationItem> { items[], next_cursor, has_more }
GET /v1/seller/earnings read scope: session or API keyReturns pending, paid and today's seller earnings, the next payout policy boundary when currently payable, and a 30-day daily history.
- Key fields
none- Response
EarningsResponse { pending_trx, paid_total_trx, today_trx, apy_30d_percent, next_payout_at, history[] }
POST /v1/seller/reinvestment/sessions sell scope; session mutations also need CSRFPrepares an unsigned FreezeBalanceV2 for one completed seller payout. The server never signs or broadcasts it; the seller signs and broadcasts from TronLink. One payout can back only one session.
- Key fields
header: Idempotency-Key; no body- Response
SellerReinvestmentSessionResponse { id, payout_entry_id, amount_trx, tx_id, transaction, status: pending | signed | expired, expires_at, signed_at, created_at }
POST /v1/seller/reinvestment/sessions/{session_id}/confirmation sell scope; session mutations also need CSRFValidates that the signed transaction is the prepared FreezeBalanceV2, verifies its signature weight and records the session as signed without broadcasting it.
- Key fields
path: session_id; body: signed_transaction- Response
SellerReinvestmentSessionResponse
GET /v1/seller/reinvestment/sessions/{session_id} read scope: session or API keyReturns the caller's reinvestment session in pending, signed or expired state.
- Key fields
path: session_id- Response
SellerReinvestmentSessionResponse
Authentication and account
Wallet sign-in creates the browser session. API-key lifecycle mutations remain session-only so a stolen key cannot mint or replace credentials.
POST /v1/auth/nonce PublicReturns the exact site-bound message that the wallet must sign.
- Key fields
body: address- Response
NonceResponse { nonce, message, expires_at }
POST /v1/auth/verify PublicVerifies the nonce message and TIP-191 signature, then creates the browser session. An optional referral code is applied only when the wallet creates a new account.
- Key fields
body: address, message, signature, ref? (6–32 URL-safe characters)- Response
SessionResponse { user_id, address, role, csrf, expires_at, created } + session cookie
POST /v1/auth/logout Browser sessionRevokes and clears the current browser session.
- Key fields
none- Response
{ ok: true }
GET /v1/auth/me Session or API keyReturns the current principal, authentication method and effective scopes.
- Key fields
none- Response
MeResponse { user_id, role, method, scopes[], preferred_lang }
GET /v1/balance read scope: session or API keyReturns exact decimal-string account balances, nullable deposit_address and deposit_minimum_trx, and the required recent_deposits array. When deposits are configured and scanner allocation is ready, the address is the caller's stable personal platform deposit address and the minimum is the exact decimal-string TRX amount required for automatic credit; both are null when deposits are disabled or unavailable. Without deposit_txid, recent_deposits contains at most the caller's five newest entries with txid, amount_trx, status, confirmations_required, observed_at and credited_at. With a deposit_txid of exactly 64 hexadecimal characters, it contains zero or one exact caller-owned match even when that deposit is older. seen awaits confirmations; confirmed has enough confirmations but remains uncredited because it is below the current minimum; credited reached the available balance; orphaned lost canonical-chain status and any credit was reversed.
- Key fields
query: deposit_txid (optional; exactly 64 hexadecimal characters)- Response
BalanceResponse { user_id, available_trx, escrow_held_trx, seller_pending_trx, deposit_address, deposit_minimum_trx, recent_deposits[{ txid, amount_trx, status, confirmations_required, observed_at, credited_at }] }
GET /v1/referrals read scope: session or API keyReturns the caller's stable invite link, pending and lifetime rewards, invited accounts with order status, and persisted payout history. next_payout_at remains null until a payout batch is actually scheduled.
- Key fields
none- Response
ReferralsResponse { code, link, pending_trx, earned_total_trx, active_count, awaiting_first_order, next_payout_at, referred[], payouts[] }
POST /v1/keys Browser session + CSRFCreates a scoped API key. The full secret is returned once and is not recoverable later.
- Key fields
body: name, can_read, can_buy, can_sell- Response
ApiKeyResponse { id, name, key_prefix, secret, can_read, can_buy, can_sell, last_used_at, created_at, revoked_at }; secret appears once
GET /v1/keys Browser sessionReturns the complete owned key lifecycle history, including revoked keys.
- Key fields
none- Response
Page<ApiKeyResponse> { items[], has_more: false }
DELETE /v1/keys/{key_id} Browser session + CSRFRevokes one owned API key without revealing whether another user's key exists.
- Key fields
path: key_id- Response
ApiKeyResponse { ..., revoked_at }