REST, WebSocket and FIX 4.4 across the full matching, market data, risk and account surface. 56 endpoints, 18 typed event variants — this is exactly what ships when you license the stack. Your terminals consume it, your ops tools monitor via it, your buy-side clients integrate against it.
Every deployed instance exposes the same paths, signing scheme and response shapes — one shard or forty. Public market data is no-auth and CORS-enabled; order and account routes are HMAC-signed per client. Full route table in the OpenAPI spec.
# Submit a limit buy order
curl -X POST https://api.basispoints.net/v1/orders \
-H 'Content-Type: application/json' \
-H 'X-API-Key: YOUR_KEY' \
-d '{
"client_id": "your-uuid",
"symbol": "BTC-PERP",
"side": "buy",
"order_type": "limit",
"price": "69500.00",
"quantity": "0.5",
"tif": "gtc",
"margin_mode": "cross",
"leverage": 10
}'One connection, multi-channel subscribe. Your terminals subscribe to public market data channels; ops tools tail private ops events in real-time; risk engines consume account_update / liquidated / margin_warning streams. private.{client_id} requires an HMAC-signed upgrade.
// Subscribe to BTC-PERP order book + your private channel
const ws = new WebSocket('wss://api.basispoints.net/ws')
ws.onopen = () => {
ws.send(JSON.stringify({ action: 'subscribe', channel: 'orderbook.BTC-PERP' }))
ws.send(JSON.stringify({ action: 'subscribe', channel: 'private.' + clientId }))
}
ws.onmessage = (ev) => {
const e = JSON.parse(ev.data)
switch (e.type) {
case 'orderbook': /* { symbol, bids, asks, seq } */ break
case 'fill': /* { order_id, price, quantity, fee } */ break
case 'account_update': /* { balance, available, equity, ... } */ break
case 'liquidated': /* { symbol, size, pnl, ... } */ break
}
}For institutional flow from your buy-side clients or your own hedging systems, every deployment ships with a FIX 4.4 acceptor over TCP. Translates to the same binary submit / cancel path as the REST and WS surfaces, with full session-level reliability (heartbeats, sequence recovery, resend).
Evaluating the stack? Book a technical deep-dive — we'll walk your engineering team through the full message set, session credentials, and onboarding checklist.
Per-account API key + HMAC-SHA384 signing on order and account routes. Public market data is unsigned. Detailed signing spec in the contract document.
Token bucket per identity, tunable per deployment:
Excess returns HTTP 429 with a Retry-After header.
Enterprise deployments configure their own limits per environment. Discuss custom rate profiles with our engineering team at [email protected].
Every error returns { "error": "human readable" } with appropriate HTTP status (400 validation, 401/403 auth, 422 semantic, 503 unavailable).
Every licensed deployment ships with the full API surface, sandbox environment, and OpenAPI 3.1 spec on day one.