> ## Documentation Index > Fetch the complete documentation index at: https://developers.securitize.io/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > SecId API: use the sandbox base URL https://partners-api.sandbox.securitize.io/investors/v1/onboarding-reliance unless the user explicitly provides production access. Authenticate with OAuth 2.0 client credentials: POST https://partners-api.sandbox.securitize.io/oauth2/token (form fields grant_type=client_credentials, client_id, client_secret, read from environment variables), cache the bearer token for its expires_in (7200 s) and send it as Authorization: Bearer on every call; never print or log the secret or the token. > Nothing is verified until POST /investors/{investorId}/verification/submit. An individual: create, upload one identity document, submit. A company: create, add its people as key parties (at least one with isBeneficialOwner: true), upload their documents, submit. > Branch on the HTTP status and the error `code`, never on `message`. A body without `code` comes from the gateway: on a 401 get a new token and send the request again; a 403 means the account is not enabled for this API. > SecId API addresses: send address.state only when that address's countryCode is US, as the 2-letter state code (NY); omit it for any other country, also when the user has a province or region. Otherwise the call answers 400 validation_error on address.state. > SecId API individuals in the US: taxId is the person's Social Security number, and it is checked against the name and residential address sent; send them as registered. A mismatch can move the investor to manual-review instead of verified. Sandbox does not run the check. > Creates are safe to repeat with the same body: after a timeout or a 502, send the identical create again. Document uploads are not: each call stores a new document, so only re-send a document after a 502. > Poll GET /investors/{investorId} about every 30 seconds, then back off; treat any status you do not recognise as not verified. In sandbox, the webhook investor.kyc.updated also announces every status change, and investor.suitability.updated / investor.dlt_test.updated every change of the suitability and DLT test verificationStatus: verify the signature, deduplicate on sourceEventId and confirm with the matching GET before acting. Token whitelisting is asynchronous too: poll GET /investors/{investorId}/wallets/whitelist until the status leaves processing. > SecId API tax forms: POST /investors/{investorId}/tax-forms takes multipart/form-data (parts file, formType, signatureDate); never base64 or JSON. Let the HTTP client set content-type with the boundary. At any point of the verification, before or after the investor is verified, only for investors you created (201), one PDF up to 10 MB per call; each upload replaces the form on file, so after a 502 send the same request again. A W-9 can instead go as JSON fields to POST /investors/{investorId}/tax-forms/w9 (TIN as 9 digits, SSN or EIN): it does not replace a form on file (409 tax_form_already_active, details.activeTaxForm), and it requires a certification object (certifiedAt, signatureName, subjectToBackupWithholding false, isUSPerson true, certificationTextVersion w9-sm-2026-10): the investor certifies in your flow on the text published at /secid-api/tax-forms#the-certification, shown without changes; subjectToBackupWithholding true answers 422 business_rule_violation (details.reason backup_withholding_not_supported). Unlike creates, a repeat after success answers 409 tax_form_already_active, not 201: when details.activeTaxForm.formType is W-9, treat it as on file. > Use synthetic test data in sandbox (@test.invalid emails, fresh ids each run). Never send more than one DLT test attempt per test investor unless the user asks: three failed attempts lock the test permanently. > The complete contract, with every field, response and error, is the OpenAPI file of the API reference; the Errors page says what to do for each code. > CET Underlying API: a WebSocket at wss://partners-rt-gw.sandbox.securitize.io/v1/market-maker/stream (TLS only; ws:// hangs with no answer). Sign hello, place_order, cancel_order and submit_crypto_funding with the user's Ed25519 key, read from an environment variable or secrets store; never print or log it. Sign timestamp + "." + type + "." + the exact payload string you send: serialise the payload once and embed that same string in the frame. > CET Underlying API: send a unique requestId of at most 32 characters (a UUID without hyphens) on every message and match replies on it; frames without a requestId are pushes. Every amount is a decimal string, never a JSON number; compare amounts as decimals. Branch on the error code, never on message. > CET Underlying API: an ack to place_order means taken, not filled. externalRef is the idempotency key; after an ack with status UNKNOWN or an UPSTREAM_UNAVAILABLE error, call get_order by externalRef before resending. Updates are delivered at most once: after any reconnect, read working orders back with get_order. Every order is placed by quantity. A buy must be a LIMIT order: quantity × limitPrice plus fees is held against your own available cash (get_cash_balance_v2), and a buy it does not cover, a MARKET buy or a notional order is refused (INVALID_ORDER). A sell must be placed by quantity, after its CETs reach the redemption wallet, or it is refused. mint_updated and burn_updated push mints and burns once they are on chain; after a gap, read them with get_mints and get_burns. The complete contract is the AsyncAPI file of the API reference. > Stocks API (Beta): documented ahead of its release through the partner gateway; paths, fields and errors can change. Base URL https://partners-api.sandbox.securitize.io/stocks/v1. Send x-api-key on every call and investorId on every call about an investor. Read the key from an environment variable; never print or log it, and never call the API from frontend code. > Stocks API: an investor can trade only once the SecId API shows them verified, with verified suitability (and a passed DLT test in the EEA), and once their wallet on the stock's chain is linked with their signature of the agreement message, signed verbatim. There is no whitelisting call: the first trade whitelists the wallet. > Stocks API: orders are fill or kill. GET /stocks/realtime-price, prepare within about 20 seconds (signedPrice), have the investor's wallet sign the returned transaction unchanged and sign-only (never send it), then submit it once with POST /stocks/execute-signed-transaction within 120 seconds. Amounts are raw base units as strings; USDC has 6 decimals. The outcome is on chain: follow transactionHash. > Stocks API: production access requires a UI audit by Securitize Compliance of the live screens: the disclosures and the market data shown, the NBBO included. > Corporate Actions API (Beta, 0.x): in development and subject to change; paths, fields, enumerations and event names can change before 1.0.0. Base URL https://partners-api.sandbox.securitize.io/corporate-actions/v1. Get a bearer token with OAuth 2.0 client credentials at POST https://partners-api.sandbox.securitize.io/oauth2/token (no scope, 2 hours), cache it, and send Authorization: Bearer on every call. Read the client id, secret and the webhook signing secret from environment variables; never print or log them, and never call the API from frontend code. > Corporate Actions API: webhooks arrive signed with the Standard Webhooks scheme under the svix-id, svix-timestamp and svix-signature headers (HMAC-SHA256 over id.timestamp.raw body, base64, v1 prefix; the secret is base64 after whsec_). Verify before parsing, reject a timestamp more than 5 minutes off, answer 2xx within 10 seconds. Delivery is at least once and can be out of order: deduplicate on sourceEventId, keep the highest version per object (objectId), order by sequence per stream.id, and replace the object with data (never merge). > Corporate Actions API: treat an unknown caType, reasonCode, eventType or enum value as informational, never as an error. A restriction ends only with ca.restriction.removed; expectedEnd is informational. marketStatus UNAVAILABLE means do not trade; the reason field carries a restriction reasonCode or a market reason such as PRE_MARKET. GET /tokens?status= filters by marketStatus (OPEN, CLOSED, UNAVAILABLE), not by the token's ACTIVE status. > Corporate Actions API: the event routes are at https://partners-api.sandbox.securitize.io/webhooks/v1 (not under /corporate-actions/v1) and cover every webhook family sent to the partner; filter with eventTypes=ca.* for corporate actions only. After an outage call POST /events/recover with since at the start of the outage (resends failed deliveries only), or page GET /events?since= (newest first, iterator paging, 90 days), then read state with GET /tokens/{tokenId}/status and GET /corporate-actions/{sourceCaId}. In sandbox, POST /sandbox/events with a scenario and one of your tokenIds publishes a scripted sequence at once; order the events by sequence, not by arrival. > Investor Activity API: base URL https://partners-api.sandbox.securitize.io/v1. Authentication is OAuth 2.0 client credentials only (no API key): POST https://partners-api.sandbox.securitize.io/oauth2/token (no scope, 2 hours), cache the token, and send Authorization: Bearer on every call. The token identifies the investor account; there is no investor id to pass. Read the client id, secret and the webhook signing secret from environment variables; never print or log them, and never call the API from frontend code. > Investor Activity API: every amount is an integer string in base units with a sibling decimals (human = amount / 10^decimals); parse with BigInt or a decimal type, never a float. Cash amounts (deposits, confirmations, payouts) are in the minor units of currencyId (1 = USD, decimals 2); token amounts (transactions, mintings, holdings) in the token's base units. Never add cash to tokens. > Investor Activity API: reconcile a subscription by grouping GET /deposits?tokenId= on tokenIssuanceId and matching the transaction in GET /transactions?tokenId= with the same tokenIssuanceId (null on a deposit means not issued yet; null on a transaction means not an issuance). Each issuance has a deposit movement (cash in) and a liquidation movement (that cash applied to the tokens) for the same amount: count the cash once, by direction=deposit, never by adding every movement. Page with offset and limit (max 100) until offset + meta.length reaches meta.total; there is no tokenIssuanceId filter. Reconcile a redemption by txHash (transfer, investor.redemption.pending, payout sourceTransaction) and by the redemption's data.id across pending, confirmed, payout.initiated and payout.completed. > Investor Activity API: webhooks arrive signed with the Standard Webhooks scheme under the svix-id, svix-timestamp and svix-signature headers (HMAC-SHA256 over id.timestamp.raw body, base64, v1 prefix; the secret is base64 after whsec_). Verify before parsing, reject a timestamp more than 5 minutes off, answer 2xx within 15 seconds. The body is {eventType, eventId, timestamp, data}: deduplicate on eventId (not svix-id), upsert by data.id, never move a record back to an earlier step, and treat an unknown eventType, processType or paymentMethod as informational. In webhooks a field with no value is absent; in endpoint answers it is null. After an outage page GET /webhook-events (newest first, iterator paging, optional eventType) back to the start of the outage. > SecId hosted onboarding: instead of the API, a partner can send an investor to https://stocks.securitize.io/partners?tokenId=&partnerUrl= (tokenAddress may replace tokenId; partnerUrl must be an absolute https URL, URL-encoded). Securitize runs identity verification, the investment profile and the wallet there. Nothing is appended to partnerUrl on return: check the wallet on chain before trading (Beta on Solana). # Cash > Read your own cash and its movements, and fund it with USDC. A buy is checked against the `available` of `get_cash_balance_v2`, your own cash. See [Cash](https://developers.securitize.io/cet-underlying-api/positions-and-cash.md) for what each figure means, and [Fund your cash with crypto](https://developers.securitize.io/cet-underlying-api/positions-and-cash.md#fund-your-cash-with-crypto) for the steps of a crypto deposit. ## AsyncAPI ````yaml cet-underlying-api/asyncapi.yaml positions-and-cash id: positions-and-cash title: Cash description: > Read your own cash and its movements. A buy is checked against your own `available`. Fund your cash with crypto: `get_crypto_funding` says where to send USDC and from which of your wallets, and `submit_crypto_funding` credits a deposit you sent, by its transaction hash. servers: - id: sandbox protocol: wss host: partners-rt-gw.sandbox.securitize.io bindings: [] variables: [] address: /v1/market-maker/stream parameters: [] bindings: [] operations: - &ref_5 id: getCashBalanceV2 title: Read your own cash description: >- Your own deposits, withdrawals and fees, per currency — not the whole account's. type: receive messages: - &ref_11 id: get_cash_balance_v2 payload: - name: get_cash_balance_v2 description: Reads your own cash, per currency. type: object properties: - name: type type: string description: get_cash_balance_v2 required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false headers: [] jsonPayloadSchema: type: object required: - type properties: type: type: string const: get_cash_balance_v2 x-parser-schema-id: requestId: &ref_0 type: string maxLength: 64 description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. x-parser-schema-id: RequestId x-parser-schema-id: GetCashBalanceV2Frame title: Get_cash_balance_v2 description: Reads your own cash, per currency. example: |- { "type": "get_cash_balance_v2", "requestId": "7c2e9a41b5d84f06a3e1c8b27d5f0e93" } bindings: [] extensions: - id: x-parser-unique-object-id value: get_cash_balance_v2 bindings: [] extensions: &ref_1 - id: x-parser-unique-object-id value: positions-and-cash - &ref_6 id: getCashMovements title: Read your cash movements description: The movements behind your own cash balance, newest first. type: receive messages: - &ref_12 id: get_cash_movements payload: - name: get_cash_movements description: Reads the movements behind your own cash balance, newest first. type: object properties: - name: type type: string description: get_cash_movements required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false - name: payload type: object required: false properties: - name: limit type: integer required: false - name: before type: string description: The `id` of the last movement of the previous page. required: false headers: [] jsonPayloadSchema: type: object required: - type properties: type: type: string const: get_cash_movements x-parser-schema-id: requestId: *ref_0 payload: type: object properties: limit: type: integer minimum: 1 maximum: 200 default: 50 x-parser-schema-id: before: type: string pattern: ^[0-9a-f]{24}$ description: The `id` of the last movement of the previous page. x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: GetCashMovementsFrame title: Get_cash_movements description: Reads the movements behind your own cash balance, newest first. example: |- { "type": "get_cash_movements", "requestId": "1f6d3b8e2a9c4057b1e4d7a0c3f62b85", "payload": { "limit": 10 } } bindings: [] extensions: - id: x-parser-unique-object-id value: get_cash_movements bindings: [] extensions: *ref_1 - &ref_7 id: getCryptoFunding title: Read where to fund your cash with crypto description: >- Where to send USDC to fund your own cash, and the wallets it must come from. type: receive messages: - &ref_13 id: get_crypto_funding payload: - name: get_crypto_funding description: >- Reads where to send USDC to fund your own cash, and the wallets it must come from. type: object properties: - name: type type: string description: get_crypto_funding required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false headers: [] jsonPayloadSchema: type: object required: - type properties: type: type: string const: get_crypto_funding x-parser-schema-id: requestId: *ref_0 x-parser-schema-id: GetCryptoFundingFrame title: Get_crypto_funding description: >- Reads where to send USDC to fund your own cash, and the wallets it must come from. example: |- { "type": "get_crypto_funding", "requestId": "3b9e1c7a5d2f4e86a0c4b8d1f6e2a957" } bindings: [] extensions: - id: x-parser-unique-object-id value: get_crypto_funding bindings: [] extensions: *ref_1 - &ref_8 id: submitCryptoFunding title: Credit a crypto deposit description: >- Credits a USDC deposit you already sent to your own cash, by its transaction hash. type: receive messages: - &ref_14 id: submit_crypto_funding payload: - name: submit_crypto_funding description: >- Credits a USDC deposit you already sent to your own cash, by its transaction hash. Signed. type: object properties: - name: type type: string description: submit_crypto_funding required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false - name: timestamp type: integer description: >- Unix seconds when you signed the message. Must be within 30 seconds of the server clock. required: true - name: payload type: object required: true properties: - name: chainId type: integer description: >- The chain the deposit was sent on, as `depositTo` lists it. required: true - name: txHash type: string description: >- The hash of the deposit's transaction. `0x` and 64 hex digits on an EVM chain; the base58 signature on Solana, as it is (case-sensitive). required: true - name: signature type: string description: >- base58( Ed25519-Sign( privateKey, timestamp + "." + type + "." + payloadBytes ) ), over the exact bytes of `payload` as sent. required: true headers: [] jsonPayloadSchema: type: object required: - type - timestamp - payload - signature properties: type: type: string const: submit_crypto_funding x-parser-schema-id: requestId: *ref_0 timestamp: type: integer description: >- Unix seconds when you signed the message. Must be within 30 seconds of the server clock. x-parser-schema-id: Timestamp payload: type: object required: - chainId - txHash properties: chainId: type: integer minimum: 1 description: The chain the deposit was sent on, as `depositTo` lists it. x-parser-schema-id: txHash: type: string pattern: ^(0x[0-9a-fA-F]{64}|[1-9A-HJ-NP-Za-km-z]{43,90})$ description: >- The hash of the deposit's transaction. `0x` and 64 hex digits on an EVM chain; the base58 signature on Solana, as it is (case-sensitive). x-parser-schema-id: x-parser-schema-id: signature: type: string maxLength: 128 description: >- base58( Ed25519-Sign( privateKey, timestamp + "." + type + "." + payloadBytes ) ), over the exact bytes of `payload` as sent. x-parser-schema-id: Signature x-parser-schema-id: SubmitCryptoFundingFrame title: Submit_crypto_funding description: >- Credits a USDC deposit you already sent to your own cash, by its transaction hash. Signed. example: |- { "type": "submit_crypto_funding", "requestId": "8d4f2a6c1e9b4073b5a2c7e0d3f8b164", "timestamp": 1793631600, "payload": { "chainId": 1952, "txHash": "0xabab5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f6071829" }, "signature": "3Kf9…" } bindings: [] extensions: - id: x-parser-unique-object-id value: submit_crypto_funding bindings: [] extensions: *ref_1 - &ref_9 id: cashMovement title: Cash movements description: >- Pushed when a movement of your own cash is recorded, assigned to you, or cancelled. type: send messages: - &ref_15 id: cash_movement payload: - name: cash_movement description: Pushed when a movement of your own cash changes. type: object properties: - name: type type: string description: cash_movement required: true - name: traceId type: string description: >- The server's id for this exchange. Opaque; quote it when you contact Securitize. Not the `traceId` on a mint or a burn. required: true - name: sentAt type: string description: >- When the server put the message on the wire. ISO 8601, UTC, milliseconds. Not when anything happened at the broker. required: true - name: payload type: object required: true properties: - name: id type: string description: The movement's id. What to quote to us about it. required: true - name: type type: string enumValues: - DEPOSIT - WITHDRAW - FEE required: true - name: amount type: string description: Unsigned; `type` says which way it went. required: true - name: currency type: string required: true - name: status type: string description: >- `BOOKED` counts in your balance; `CANCELLED` no longer does. enumValues: - BOOKED - CANCELLED required: true - name: bookedAt type: string required: true - name: cancelledAt type: string required: false - name: eventId type: string description: The same on every repeat of one change. required: true headers: [] jsonPayloadSchema: type: object required: - type - traceId - sentAt - payload properties: type: type: string const: cash_movement x-parser-schema-id: traceId: &ref_2 type: string description: >- The server's id for this exchange. Opaque; quote it when you contact Securitize. Not the `traceId` on a mint or a burn. x-parser-schema-id: TraceId sentAt: &ref_3 type: string format: date-time description: >- When the server put the message on the wire. ISO 8601, UTC, milliseconds. Not when anything happened at the broker. x-parser-schema-id: SentAt payload: allOf: - &ref_4 type: object required: - id - type - amount - currency - status - bookedAt properties: id: type: string description: The movement's id. What to quote to us about it. x-parser-schema-id: type: type: string enum: - DEPOSIT - WITHDRAW - FEE x-parser-schema-id: amount: type: string format: decimal description: Unsigned; `type` says which way it went. x-parser-schema-id: currency: type: string x-parser-schema-id: status: type: string enum: - BOOKED - CANCELLED description: >- `BOOKED` counts in your balance; `CANCELLED` no longer does. x-parser-schema-id: bookedAt: type: string format: date-time x-parser-schema-id: cancelledAt: type: string format: date-time x-parser-schema-id: x-parser-schema-id: CashMovement - type: object required: - eventId properties: eventId: type: string description: The same on every repeat of one change. x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: CashMovementFrame title: Cash_movement description: Pushed when a movement of your own cash changes. example: |- { "type": "cash_movement", "traceId": "partners-rt-gw-0b7e4c19-5a2d-4f83-b6e1-9c3d8a2f7e54", "sentAt": "2026-10-24T16:21:14.420Z", "payload": { "eventId": "742352b766ba4c2710207aae:BOOKED:1693600582c5aebc9499c1d7", "id": "742352b766ba4c2710207aae", "type": "DEPOSIT", "amount": "1.000000", "currency": "USD", "status": "BOOKED", "bookedAt": "2026-10-24T16:21:13.170Z" } } bindings: [] extensions: - id: x-parser-unique-object-id value: cash_movement bindings: [] extensions: *ref_1 - &ref_10 id: positionsAndCashReplies title: Cash replies description: What the server answers to cash reads and to submit_crypto_funding. type: send messages: - &ref_16 id: get_cash_balance_v2_ack payload: - name: ack (get_cash_balance_v2) description: Your own cash, one entry per currency. type: object properties: - name: type type: string description: ack required: true - name: for type: string description: get_cash_balance_v2 required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false - name: traceId type: string description: >- The server's id for this exchange. Opaque; quote it when you contact Securitize. Not the `traceId` on a mint or a burn. required: true - name: sentAt type: string description: >- When the server put the message on the wire. ISO 8601, UTC, milliseconds. Not when anything happened at the broker. required: true - name: payload type: object required: true properties: - name: balances type: array description: >- One per currency you have moved; empty before your first movement. required: true properties: - name: currency type: string required: true - name: deposited type: string required: true - name: withdrawn type: string description: Every withdrawal that was not a fee. required: true - name: fees type: string required: true - name: bought type: string description: What your buys cost, as far as they executed. required: true - name: sold type: string description: What your sells brought in, as far as they executed. required: true - name: netBalance type: string description: >- `deposited - withdrawn - fees - bought + sold`: your balance. Negative when more left than arrived. required: true - name: committed type: string description: >- Held and not spent yet — the unfilled part of your live buys at their limit, fees not charged yet, and buys being placed. required: true - name: available type: string description: >- `netBalance - committed`: what a new buy can spend. Negative when overdrawn. required: true headers: [] jsonPayloadSchema: type: object required: - type - for - traceId - sentAt - payload properties: type: type: string const: ack x-parser-schema-id: for: type: string const: get_cash_balance_v2 x-parser-schema-id: requestId: *ref_0 traceId: *ref_2 sentAt: *ref_3 payload: type: object required: - balances properties: balances: type: array description: >- One per currency you have moved; empty before your first movement. items: type: object required: - currency - deposited - withdrawn - fees - bought - sold - netBalance - committed - available properties: currency: type: string x-parser-schema-id: deposited: type: string format: decimal x-parser-schema-id: withdrawn: type: string format: decimal description: Every withdrawal that was not a fee. x-parser-schema-id: fees: type: string format: decimal x-parser-schema-id: bought: type: string format: decimal description: What your buys cost, as far as they executed. x-parser-schema-id: sold: type: string format: decimal description: What your sells brought in, as far as they executed. x-parser-schema-id: netBalance: type: string format: decimal description: >- `deposited - withdrawn - fees - bought + sold`: your balance. Negative when more left than arrived. x-parser-schema-id: committed: type: string format: decimal description: >- Held and not spent yet — the unfilled part of your live buys at their limit, fees not charged yet, and buys being placed. x-parser-schema-id: available: type: string format: decimal description: >- `netBalance - committed`: what a new buy can spend. Negative when overdrawn. x-parser-schema-id: x-parser-schema-id: CustomerCashTotals x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: GetCashBalanceV2AckFrame title: ack (get_cash_balance_v2) description: Your own cash, one entry per currency. example: |- { "type": "ack", "for": "get_cash_balance_v2", "requestId": "7c2e9a41b5d84f06a3e1c8b27d5f0e93", "traceId": "partners-rt-gw-3e8b1c52-7d4a-4f96-a0e2-5b9c6d1f8a37", "sentAt": "2026-10-25T13:03:10.215Z", "payload": { "balances": [ { "currency": "USD", "deposited": "1000", "withdrawn": "0.5", "fees": "0.3", "bought": "500", "sold": "0", "netBalance": "499.2", "committed": "100.1", "available": "399.1" } ] } } bindings: [] extensions: - id: x-parser-unique-object-id value: get_cash_balance_v2_ack - &ref_17 id: get_cash_movements_ack payload: - name: ack (get_cash_movements) description: One page of your cash movements. type: object properties: - name: type type: string description: ack required: true - name: for type: string description: get_cash_movements required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false - name: traceId type: string description: >- The server's id for this exchange. Opaque; quote it when you contact Securitize. Not the `traceId` on a mint or a burn. required: true - name: sentAt type: string description: >- When the server put the message on the wire. ISO 8601, UTC, milliseconds. Not when anything happened at the broker. required: true - name: payload type: object required: true properties: - name: movements type: array required: true properties: - name: id type: string description: The movement's id. What to quote to us about it. required: true - name: type type: string enumValues: - DEPOSIT - WITHDRAW - FEE required: true - name: amount type: string description: Unsigned; `type` says which way it went. required: true - name: currency type: string required: true - name: status type: string description: >- `BOOKED` counts in your balance; `CANCELLED` no longer does. enumValues: - BOOKED - CANCELLED required: true - name: bookedAt type: string required: true - name: cancelledAt type: string required: false headers: [] jsonPayloadSchema: type: object required: - type - for - traceId - sentAt - payload properties: type: type: string const: ack x-parser-schema-id: for: type: string const: get_cash_movements x-parser-schema-id: requestId: *ref_0 traceId: *ref_2 sentAt: *ref_3 payload: type: object required: - movements properties: movements: type: array items: *ref_4 x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: GetCashMovementsAckFrame title: ack (get_cash_movements) description: One page of your cash movements. example: |- { "type": "ack", "for": "get_cash_movements", "requestId": "1f6d3b8e2a9c4057b1e4d7a0c3f62b85", "traceId": "partners-rt-gw-6a1f2d94-8b3e-4c57-9e0a-2d7b5c4f1e86", "sentAt": "2026-10-25T13:04:11.002Z", "payload": { "movements": [ { "id": "742352b766ba4c2710207aae", "type": "DEPOSIT", "amount": "1.000000", "currency": "USD", "status": "BOOKED", "bookedAt": "2026-10-24T16:21:13.170Z" } ] } } bindings: [] extensions: - id: x-parser-unique-object-id value: get_cash_movements_ack - &ref_18 id: get_crypto_funding_ack payload: - name: ack (get_crypto_funding) description: Where to send USDC, and the wallets it must come from. type: object properties: - name: type type: string description: ack required: true - name: for type: string description: get_crypto_funding required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false - name: traceId type: string description: >- The server's id for this exchange. Opaque; quote it when you contact Securitize. Not the `traceId` on a mint or a burn. required: true - name: sentAt type: string description: >- When the server put the message on the wire. ISO 8601, UTC, milliseconds. Not when anything happened at the broker. required: true - name: payload type: object required: true properties: - name: enabled type: boolean description: >- Whether you can fund your cash with crypto. `false` comes with an empty `depositTo`. required: true - name: depositTo type: array description: Securitize's wallets to send to, one per chain and token. required: true properties: - name: chainId type: integer description: >- The chain to send on, and the value `submit_crypto_funding` takes as `chainId`. An EVM chain uses its own chain id; Solana is `101` (mainnet) or `901` (devnet). required: true - name: token type: string description: The token to send, such as `USDC`. required: true - name: tokenAddress type: string description: >- The token's contract on that chain, or its mint on Solana. Only transfers of this token are credited. required: true - name: address type: string description: The wallet to send the token to. required: true - name: decimals type: integer description: The token's decimals on that chain. required: true - name: minConfirmations type: integer description: >- The confirmations a deposit needs before it is final and can be credited. required: true - name: fromWallets type: array description: >- Your own wallets, registered by Securitize at your request. Only a deposit sent from one of them is credited. required: true properties: - name: namespace type: string description: >- The wallet's chain family, `eip155` for an EVM address or `solana`. required: true - name: address type: string required: true headers: [] jsonPayloadSchema: type: object required: - type - for - traceId - sentAt - payload properties: type: type: string const: ack x-parser-schema-id: for: type: string const: get_crypto_funding x-parser-schema-id: requestId: *ref_0 traceId: *ref_2 sentAt: *ref_3 payload: type: object required: - enabled - depositTo - fromWallets properties: enabled: type: boolean description: >- Whether you can fund your cash with crypto. `false` comes with an empty `depositTo`. x-parser-schema-id: depositTo: type: array description: Securitize's wallets to send to, one per chain and token. items: type: object required: - chainId - token - tokenAddress - address - decimals - minConfirmations properties: chainId: type: integer description: >- The chain to send on, and the value `submit_crypto_funding` takes as `chainId`. An EVM chain uses its own chain id; Solana is `101` (mainnet) or `901` (devnet). x-parser-schema-id: token: type: string description: The token to send, such as `USDC`. x-parser-schema-id: tokenAddress: type: string description: >- The token's contract on that chain, or its mint on Solana. Only transfers of this token are credited. x-parser-schema-id: address: type: string description: The wallet to send the token to. x-parser-schema-id: decimals: type: integer description: The token's decimals on that chain. x-parser-schema-id: minConfirmations: type: integer description: >- The confirmations a deposit needs before it is final and can be credited. x-parser-schema-id: x-parser-schema-id: CryptoFundingDeposit x-parser-schema-id: fromWallets: type: array description: >- Your own wallets, registered by Securitize at your request. Only a deposit sent from one of them is credited. items: type: object required: - namespace - address properties: namespace: type: string description: >- The wallet's chain family, `eip155` for an EVM address or `solana`. x-parser-schema-id: address: type: string x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: CryptoFunding x-parser-schema-id: GetCryptoFundingAckFrame title: ack (get_crypto_funding) description: Where to send USDC, and the wallets it must come from. example: |- { "type": "ack", "for": "get_crypto_funding", "requestId": "3b9e1c7a5d2f4e86a0c4b8d1f6e2a957", "traceId": "partners-rt-gw-5c2a8e17-4b9d-4f30-a6e1-8d3f7b2c9e05", "sentAt": "2026-11-03T14:58:02.117Z", "payload": { "enabled": true, "depositTo": [ { "chainId": 1952, "token": "USDC", "tokenAddress": "0x1a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d", "address": "0x8f3c6a1e9b2d4c7f0a5e3b8d1c6f9a2e4b7d0c35", "decimals": 6, "minConfirmations": 12 } ], "fromWallets": [ { "namespace": "eip155", "address": "0x1111aaaa2222bbbb3333cccc4444dddd5555eeee" } ] } } bindings: [] extensions: - id: x-parser-unique-object-id value: get_crypto_funding_ack - &ref_19 id: submit_crypto_funding_ack payload: - name: ack (submit_crypto_funding) description: The deposit is credited to your own cash. type: object properties: - name: type type: string description: ack required: true - name: for type: string description: submit_crypto_funding required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false - name: traceId type: string description: >- The server's id for this exchange. Opaque; quote it when you contact Securitize. Not the `traceId` on a mint or a burn. required: true - name: sentAt type: string description: >- When the server put the message on the wire. ISO 8601, UTC, milliseconds. Not when anything happened at the broker. required: true - name: payload type: object required: true properties: - name: status type: string description: CREDITED required: true - name: movementId type: string description: >- The cash movement the deposit was booked as, the `id` `get_cash_movements` lists it under. required: true - name: amount type: string description: >- What was credited, in USD, one for one with the USDC that arrived. required: true - name: currency type: string description: USD required: true - name: chainId type: integer required: true - name: txHash type: string required: true - name: bookedAt type: string required: true headers: [] jsonPayloadSchema: type: object required: - type - for - traceId - sentAt - payload properties: type: type: string const: ack x-parser-schema-id: for: type: string const: submit_crypto_funding x-parser-schema-id: requestId: *ref_0 traceId: *ref_2 sentAt: *ref_3 payload: type: object required: - status - movementId - amount - currency - chainId - txHash - bookedAt properties: status: type: string const: CREDITED x-parser-schema-id: movementId: type: string description: >- The cash movement the deposit was booked as, the `id` `get_cash_movements` lists it under. x-parser-schema-id: amount: type: string format: decimal description: >- What was credited, in USD, one for one with the USDC that arrived. x-parser-schema-id: currency: type: string const: USD x-parser-schema-id: chainId: type: integer x-parser-schema-id: txHash: type: string x-parser-schema-id: bookedAt: type: string format: date-time x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: SubmitCryptoFundingAckFrame title: ack (submit_crypto_funding) description: The deposit is credited to your own cash. example: |- { "type": "ack", "for": "submit_crypto_funding", "requestId": "8d4f2a6c1e9b4073b5a2c7e0d3f8b164", "traceId": "partners-rt-gw-9e1b4d7c-3a6f-4c82-b5d0-2f8e6a1c7b39", "sentAt": "2026-11-03T15:00:00.412Z", "payload": { "status": "CREDITED", "movementId": "6ae9a0c1d2e4b5a6978c0d1e", "amount": "250.5", "currency": "USD", "chainId": 1952, "txHash": "0xabab5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f6071829", "bookedAt": "2026-11-03T15:00:00.000Z" } } bindings: [] extensions: - id: x-parser-unique-object-id value: submit_crypto_funding_ack - &ref_20 id: error payload: - name: error description: A request was refused. Most errors leave the socket open. type: object properties: - name: type type: string description: error required: true - name: requestId type: string description: >- Your id for this message, echoed on its reply. Never interpreted or checked for uniqueness. Up to 64 characters are accepted, but keep it to 32, since an `error` echoes only the first 32 followed by `…`. A UUID without its hyphens is 32 characters. required: false - name: traceId type: string description: >- The server's id for this exchange. Opaque; quote it when you contact Securitize. Not the `traceId` on a mint or a burn. required: true - name: sentAt type: string description: >- When the server put the message on the wire. ISO 8601, UTC, milliseconds. Not when anything happened at the broker. required: true - name: payload type: object required: true properties: - name: code type: string description: >- One of `SIGNATURE_INVALID`, `TIMESTAMP_OUT_OF_WINDOW`, `UNAUTHENTICATED`, `NOT_PERMITTED`, `RATE_LIMITED`, `MALFORMED`, `INVALID_ORDER`, `INVALID_SYMBOL`, `ORDER_NOT_FOUND`, `ORDER_NOT_CANCELLABLE`, `DEPOSIT_PENDING`, `DEPOSIT_REFUSED`, `UPSTREAM_UNAVAILABLE`, `INTERNAL`. Treat a code you do not recognise as a refusal. required: true - name: message type: string description: For people. Can change; never branch on it. required: true headers: [] jsonPayloadSchema: type: object required: - type - traceId - sentAt - payload properties: type: type: string const: error x-parser-schema-id: requestId: *ref_0 traceId: *ref_2 sentAt: *ref_3 payload: type: object required: - code - message properties: code: type: string description: >- One of `SIGNATURE_INVALID`, `TIMESTAMP_OUT_OF_WINDOW`, `UNAUTHENTICATED`, `NOT_PERMITTED`, `RATE_LIMITED`, `MALFORMED`, `INVALID_ORDER`, `INVALID_SYMBOL`, `ORDER_NOT_FOUND`, `ORDER_NOT_CANCELLABLE`, `DEPOSIT_PENDING`, `DEPOSIT_REFUSED`, `UPSTREAM_UNAVAILABLE`, `INTERNAL`. Treat a code you do not recognise as a refusal. x-parser-schema-id: message: type: string description: For people. Can change; never branch on it. x-parser-schema-id: x-parser-schema-id: x-parser-schema-id: ErrorFrame title: Error description: A request was refused. Most errors leave the socket open. example: |- { "type": "error", "requestId": "7a02c4e158b34f9da0e23c6b1d7f8e45", "traceId": "partners-rt-gw-4d81e0a7-2c6f-4b19-9e3a-8f5d1c7b0a62", "sentAt": "2026-08-28T15:29:47.012Z", "payload": { "code": "INVALID_ORDER", "message": "The reference ref-2026-08-28-0001 already names an order (FILLED): look it up instead of placing it again" } } bindings: [] extensions: - id: x-parser-unique-object-id value: error bindings: [] extensions: *ref_1 sendOperations: - *ref_5 - *ref_6 - *ref_7 - *ref_8 receiveOperations: - *ref_9 - *ref_10 sendMessages: - *ref_11 - *ref_12 - *ref_13 - *ref_14 receiveMessages: - *ref_15 - *ref_16 - *ref_17 - *ref_18 - *ref_19 - *ref_20 extensions: - id: x-parser-unique-object-id value: positions-and-cash securitySchemes: - id: ed25519Signature name: ed25519Signature type: asymmetricEncryption description: > Each client registers an Ed25519 public key with Securitize beforehand; the private key never leaves the client. `hello`, `place_order`, `cancel_order`, `submit_crypto_funding`, `sandbox_deposit` and `sandbox_withdraw` carry `timestamp` (Unix seconds) and `signature` = base58( Ed25519-Sign( privateKey, timestamp + "." + type + "." + payloadBytes ) ), where `payloadBytes` are the exact bytes of `payload` as sent on the wire. The timestamp must be within 30 seconds of the server clock. Other messages ride on the session `hello` opens. extensions: [] ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.