Conventions

HTTP

• JSON responses unless noted.
• Timestamps are Unix milliseconds unless a FIX UTC timestamp is specified.
• Query parameter names and JSON field names match the gateway / Postman casing (typically camelCase on trading APIs; some fiat/migration fields use snake_case — follow the OpenAPI examples).

Authentication classes

Class	When	Header	Signature
Public	No @SignAuth	Host required for org; API key optional in Postman	No
API key only	@SignAuth(validKeyOnly=true)	x-ptrader-apikey	No
Signed HMAC	@SignAuth (default trading/account)	x-ptrader-apikey	Yes (signature + usually timestamp)

Market data path aliases

MktDataApiController is mapped on both:

• /openapi/quote/v1/... (preferred in Postman / these docs)
• /openapi/v1/... (same handlers)

[NEEDS-CONFIRMATION: whether both aliases remain guaranteed long-term]

Error body shape

{ "code": -1022, "msg": "Signature for this request is not valid." }

See Error codes.

Markers in this site

Marker	Meaning
[NEEDS-CONFIRMATION: …]	Fact not fully verified; do not treat as production promise
Illustrative	Example synthesized from Postman/code; verify against live response
Gap tracker	Backlog for backend / writers

Exclusions

Do not call or document:

• /merchant-api/*
• /broker/v1/public/security/create-api-key-v2, /openapi/v1/tool/create-api-key-v2
• Admin / Exchange-Web BFF APIs