Skip to main content
Trading execution is unavailable. These routes do not create orders, follows, signing permits, signatures or transactions. The scopes below are reserved and cannot be selected in Developer API settings. Browser trading sessions do not authorize API-key execution. This page accompanies the closed-intake release; it does not announce live trading.
Existing spot quotes remain read-only. Keep API keys on a trusted server. Cookies and caller-supplied user IDs never authorize these routes.

​
Availability

GET /api/v1/spot/capabilities — requires md.read.
The response reports executionAvailable: false, blockedOn: signing-contracts, inputChains, operations and a note. Each operation names its path, method, reserved scope and kinds, with available: false. Input coverage describes validation only, not chain execution admission. It covers Solana and the 23 EVM chains listed by the deployed OpenAPI specification; copy inputs retain the five-chain coverage below.

​
Buy and sell

POST /api/v1/spot/trades — reserved spot.trade scope; unavailable.
The JSON request has these required fields. Query parameters and additional fields are forbidden. Addresses must match the explicit chain. Amounts cannot use floating point numbers, fractions or scientific notation. EVM addresses must be nonzero, 20-byte hex addresses; Solana addresses must be valid base58 public keys. Signer, recipient, fee and user identity overrides are not accepted.

​
Limit, TWAP and snipe

POST /api/v1/spot/orders — reserved spot.orders scope; unavailable.
Requests include the buy/sell fields above and one order variant: For a migration snipe, migrationFromPool is required and must be a valid address on the selected chain. It is forbidden for first_liquidity. Exact decimal prices allow up to 20 integer digits and 18 fractional digits. These input schemas do not imply that automation adapters or permits are live.

​
Copy trade

POST /api/v1/copy-trading/follows — reserved copy.trade scope; unavailable.
Existing GET /copy-trading/follows remains a separate copy.read operation; read access confers no creation authority. USD fields use exact decimal strings with up to 20 integer digits and 18 fractional digits. Unknown fields are refused; no follow is saved or activated.

​
Admission and responses

All routes use the standard per-key REST budget, separate from the quote budget. Mutations require application/json, at most 8 KiB, with a three-second body read deadline. Authentication, product-access checks, key revocation, REST admission and IP restrictions precede the body read. The bounded exact wire bytes go to request-signature admission before JSON parsing, input validation or wallet lookup. The independent signature gate currently refuses every request, including fabricated signature headers. Thus an unsigned caller cannot distinguish owned, foreign or unavailable wallet bindings. No signature header format or enrollment procedure is released. No mutation advertises a success response. Responses use Cache-Control: no-store, standard CORS and the error envelope. This response was captured from the exported source-candidate POST in a local, unfunded test; it is not evidence of a deployed mutation route:
Execution requires a reviewed release of per-key signed requests binding a timestamp, nonce, method/path and exact body hash with an atomic bounded replay window. Separate owner-bound wallet authority, service ownership checks, exact permits/caps, one-use journals, reconciliation and revocation are also required. Replacing a refusal or supplying a bearer token does not activate trading.