GET requests, for when you want to ask once or poll instead of holding a socket open: checking your redemption balance after a transfer, or reading back an order. Each one answers what the matching message answers on the socket, from the same data.
Everything else stays on the socket: placing and cancelling orders, submit_crypto_funding, the pushes, get_symbols and get_redemption_address.
Endpoint
Routes
- The query parameters are the message’s payload fields, with the same names, rules and defaults. A parameter that is not one of them is ignored.
includetakes several values repeated (include=fills&include=mints) or comma-separated (include=fills,mints).- The body of a
200is thepayloadof the matchingack, with nothing around it:
Signing
There is no session, so every request is signed, with the same key you signhello with. A read-only key is enough. Three headers carry it:
targetis the path and query exactly as you send them, starting with/:/v1/market-maker/cash-movements?limit=20. Encode the query first, then sign the encoded string and send that same string. A client library that re-encodes the URL after you sign it, or a value with a space, a+or a&left unencoded, makes the signature fail. This is the most common way a signed request fails.methodisGET, in capitals.- The query is part of what is signed, so a signature cannot be reused with other parameters. Anyone holding a signed request can repeat it for 30 seconds, though: don’t log or share signed requests.
Errors
A request that fails answers the samecode and message the socket would, and a traceId to quote when you contact Securitize. It also comes in the x-correlation-id header:
Branch on
code, as on the socket; Errors says what to do about each one.
Limits
Requests are limited per source address, across every route together. Poll at the pace you need the answer, not faster: a balance checked every few seconds after a transfer stays well inside the limit. Past it, requests answer429 until the count resets, a second or a minute later.