API Reference

Base URL: https://tradezone.forex/api · Version: v1.0 · Try in Console →

Introduction

All endpoints return JSON. Successful responses have HTTP 200 and include a status: "ok" field. Errors include status: "error" and an error code string.

// Success
{ "status": "ok", "data": { ... }, "ts": 1712345678 }

// Error
{ "status": "error", "error": "INVALID_MARKET", "message": "Market not found", "ts": 1712345678 }

Authentication

Private endpoints require three headers on every request:

Header	Description
`X-API-KEY`	Your API key
`X-TIMESTAMP`	Unix timestamp (seconds). Must be within ±30s of server time.
`X-SIGNATURE`	HMAC-SHA256 signature (see below)

Signature

Concatenate: timestamp + METHOD + /path + body (body empty string for GET). Sign with your API secret using HMAC-SHA256.

# Python
import hmac, hashlib, time, requests

ts  = str(int(time.time()))
msg = ts + "GET" + "/api/V1Account/balances"  # + "" for GET
sig = hmac.new(API_SECRET.encode(), msg.encode(), hashlib.sha256).hexdigest()

resp = requests.get(BASE_URL + "/V1Account/balances", headers={
    "X-API-KEY": API_KEY, "X-TIMESTAMP": ts, "X-SIGNATURE": sig
})

// JavaScript (Node.js)
const crypto = require('crypto');
const ts  = String(Math.floor(Date.now()/1000));
const msg = ts + 'GET' + '/api/V1Account/balances';
const sig = crypto.createHmac('sha256', API_SECRET).update(msg).digest('hex');

fetch(BASE_URL + '/V1Account/balances', {
  headers: { 'X-API-KEY': API_KEY, 'X-TIMESTAMP': ts, 'X-SIGNATURE': sig }
});

Rate Limits

Rate limit info is returned in response headers:

Header	Meaning
`X-RateLimit-Limit`	Max requests per minute for your tier
`X-RateLimit-Remaining`	Requests remaining in current window
`X-RateLimit-Reset`	Unix timestamp when window resets

Tier	Limit
Public (no key)	30 req/min per IP
Basic	120 req/min
Pro	600 req/min
Custom	Per-key setting

HTTP 429 is returned when exceeded. Retry after X-RateLimit-Reset.

Error Codes

Code	HTTP	Meaning
`UNAUTHORIZED`	401	Missing or invalid API key
`FORBIDDEN`	403	Permission not granted for this action
`INVALID_SIGNATURE`	401	HMAC signature mismatch or timestamp too old
`RATE_LIMITED`	429	Rate limit exceeded
`INVALID_MARKET`	400	Market not found or disabled
`INVALID_PARAMS`	400	Missing or invalid request parameters
`INSUFFICIENT_BALANCE`	400	Not enough funds
`ORDER_NOT_FOUND`	404	Order does not exist or belongs to another user
`WITHDRAWAL_LIMIT`	400	Withdrawal exceeds daily limit or coin min/max
`KYC_REQUIRED`	403	KYC verification required for this action

Public Endpoints

No authentication required. Rate limited by IP (30 req/min).

GET /V1Public/time Server time

Returns the current server Unix timestamp. Use to sync your clock before signing requests.

{ "status": "ok", "data": { "ts": 1712345678, "iso": "2025-04-01T12:34:38Z" } }

GET /V1Public/assets List all tradeable assets

Returns all active coins with their withdrawal fees, min/max, and decimal precision.

{ "data": { "btc": { "name": "Bitcoin", "min_withdraw": 0.0005, "fee": 0.0001, "decimals": 8 }, ... } }

GET /V1Public/markets List all markets

Returns all active trading pairs with fees, precision, and min order size.

{ "data": { "btc_usdt": { "base": "btc", "quote": "usdt", "fee": 0.001, "min_amount": 0.0001 }, ... } }

GET /V1Public/ticker/market/{market} Single market ticker

Param	In	Type	Description
`market` *	path	string	e.g. `btc_usdt`

{ "data": { "market": "btc_usdt", "last": 65432.10, "bid": 65430.00, "ask": 65435.00, "high": 66000.00, "low": 64800.00, "volume": 123.45, "change_pct": 1.24 } }

GET /V1Public/tickers All market tickers

Returns ticker data for all active markets in a single call. Ideal for dashboard overviews.

GET /V1Public/orderbook/market/{market} Order book

Param	In	Type	Description
`market` *	path	string	Market pair
`depth`	query	integer	Levels per side. Default 50, max 200.

{ "data": { "bids": [[65430,0.5],[65420,1.2],...], "asks": [[65435,0.3],[65440,0.8],...] } }

GET /V1Public/trades/market/{market} Recent trades

Param	In	Type	Description
`market` *	path	string	Market pair
`limit`	query	integer	Max 200. Default 50.

{ "data": [{ "price": 65432, "amount": 0.1, "side": "buy", "ts": 1712345678 },...] }

GET /V1Public/ohlcv/market/{market} OHLCV candles

Param	In	Type	Description
`market` *	path	string	Market pair
`interval`	query	string	`1m 5m 15m 30m 1h 4h 1d 1w`. Default `1h`.
`limit`	query	integer	Max 1000. Default 200.
`start`	query	integer	Start Unix timestamp (optional)
`end`	query	integer	End Unix timestamp (optional)

{ "data": [[1712340000,65200,66100,65100,65900,45.3],...] }
// Each candle: [timestamp, open, high, low, close, volume]

Account Endpoints

Requires X-API-KEY + X-TIMESTAMP + X-SIGNATURE headers. Permission needed: read (or withdraw for the withdrawal endpoint).

GET /V1Account/profile Account profile read

{ "data": { "uid": 42, "username": "alice", "email": "a***@example.com", "kyc": 2, "plan": "pro" } }

GET /V1Account/balances All coin balances read

{ "data": { "btc": { "available": 0.52, "frozen": 0.05 }, "usdt": { "available": 1200.00, "frozen": 0 } } }

GET /V1Account/depositAddress/coin/{coin} Get deposit address read

Param	In	Type	Description
`coin` *	path	string	e.g. `btc`, `eth`, `usdt`

{ "data": { "coin": "btc", "address": "1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf...", "memo": null } }

GET /V1Account/deposits Deposit history read

Param	In	Type	Description
`coin`	query	string	Filter by coin
`page`	query	integer	Page number (default 1)
`limit`	query	integer	Per page, max 100 (default 20)

GET /V1Account/withdrawals Withdrawal history read

Param	In	Type	Description
`coin`	query	string	Filter by coin
`page`	query	integer	Page number

GET /V1Account/transactions All transactions read

Combined ledger — deposits, withdrawals, trades, fees. Sorted by time descending.

Param	In	Type	Description
`type`	query	string	`deposit` \| `withdrawal` \| `trade`
`page`	query	integer	Page number

POST /V1Account/withdraw Request withdrawal withdraw

Requires withdraw permission. KYC must be verified. Must pass IP whitelist check if configured.

Field	Type	Description
`coin` *	string	Coin symbol e.g. `btc`
`address` *	string	Destination address
`amount` *	number	Amount to withdraw
`memo`	string	Memo/tag (for XRP, XLM, etc.)

{ "data": { "withdrawal_id": 9182, "coin": "usdt", "amount": 100, "fee": 1, "status": "pending" } }

Trade Endpoints

Requires trade permission.

POST /V1Trade/order Place order trade

Field	Type	Description
`market` *	string	e.g. `btc_usdt`
`side` *	string	`buy` or `sell`
`type` *	string	`limit` or `market`
`amount` *	number	Quantity in base coin
`price`	number	Required for limit orders

{ "data": { "order_id": 583921, "market": "btc_usdt", "side": "buy", "type": "limit", "price": 65000, "amount": 0.1, "filled": 0, "status": "open" } }

POST /V1Trade/cancel Cancel order trade

Field	Type	Description
`order_id` *	integer	Order ID to cancel
`market` *	string	Market pair

POST /V1Trade/cancelAll Cancel all open orders trade

Field	Type	Description
`market`	string	Limit to this market (omit for all)

{ "data": { "cancelled": 4 } }

GET /V1Trade/orders Open orders read

Param	In	Type	Description
`market`	query	string	Filter by market
`page`	query	integer	Page number

GET /V1Trade/history Filled trade history read

Param	In	Type	Description
`market`	query	string	Filter by market
`start`	query	integer	Unix start timestamp
`end`	query	integer	Unix end timestamp
`page`	query	integer	Page number

Webhook Endpoints

Requires webhooks permission.

POST /V1Webhook/subscribe Create webhook subscription webhooks

Field	Type	Description
`url` *	string	HTTPS endpoint to receive events
`events` *	array	List of event types (see below)
`secret`	string	Your signing secret for HMAC verification

Webhook payloads are signed with HMAC-SHA256 in the X-Webhook-Sig header using your secret.

GET /V1Webhook/subscriptions List subscriptions webhooks

Returns all active webhook subscriptions for the authenticated API key.

POST /V1Webhook/delete Delete subscription webhooks

Field	Type	Description
`id` *	integer	Subscription ID to delete

Event Types

Event	Triggered when
`order.filled`	A limit order is fully or partially filled
`order.cancelled`	An order is cancelled
`deposit.confirmed`	A deposit is confirmed on-chain
`withdrawal.sent`	A withdrawal is broadcast to the network
`withdrawal.completed`	A withdrawal is confirmed

// Webhook payload example (order.filled)
POST https://your-server.com/webhook
X-Webhook-Sig: sha256=abc123...

{
  "event":   "order.filled",
  "ts":      1712345678,
  "data": {
    "order_id": 583921,
    "market":   "btc_usdt",
    "side":     "buy",
    "price":    65000,
    "amount":   0.1,
    "filled":   0.1
  }
}

Server-Sent Events (SSE)

Real-time streaming via EventSource. No authentication required. Sessions last 60 seconds then send a reconnect event — the client should reconnect automatically (EventSource does this by default).

GET /V1Stream/ticker?market={market} Real-time ticker stream

Emits a ticker event every 2 seconds with current price data.

// Browser
const es = new EventSource('https://tradezone.forex/api/V1Stream/ticker?market=btc_usdt');
es.addEventListener('ticker', e => {
  const t = JSON.parse(e.data);
  console.log(t.last, t.bid, t.ask, t.change_pct + '%');
});
es.addEventListener('reconnect', () => { es.close(); });

GET /V1Stream/orderbook?market={market} Real-time order book stream

Param	In	Type	Description
`market` *	query	string	Market pair
`depth`	query	integer	Levels per side (5-50, default 20)

const es = new EventSource('https://tradezone.forex/api/V1Stream/orderbook?market=btc_usdt&depth=10');
es.addEventListener('orderbook', e => {
  const ob = JSON.parse(e.data);
  console.log('bids:', ob.bids, 'asks:', ob.asks);
});

Try in Console → OpenAPI JSON