Trading API

In the web app, create a bot with template API (no strategy params - the engine is inert; you drive it). This gives you a dedicated sub-account the key will trade.

Top the bot up from the bot's detail page (funding stays in the web app - never on this API). Balance shows up on GET /v1/account.

In the app, open Settings, then the API tab, and generate the bot's trading key(an armed, running or paused bot lists there). It's shown once - copy it now (mtx_bot_…). Affiliates generate an mtx_aff_… key on the same tab instead - see the Affiliate API.

Check it's wired up:

curl https://trade.mutex.exchange/v1/key \
  -H "Authorization: Bearer mtx_bot_…"
# {"kind":"trading","display_prefix":"mtx_bot_a1b2","bot":"bot_…","created_at":1721480400000}

curl -X POST https://trade.mutex.exchange/v1/orders \
  -H "Authorization: Bearer mtx_bot_…" \
  -H "Content-Type: application/json" \
  -d '{"type":"limit","symbol":"BTC","side":"buy","size":"0.01",
       "price":"50000","time_in_force":"gtc","client_order_id":"algo-1"}'

• Markets are plain coin symbols ("BTC"). Numbers are decimal strings on output; inputs accept strings or JSON numbers. Timestamps are Unix ms.
• client_order_id (≤ 64 chars, not UUID-shaped) is your idempotency + lookup handle, unique per bot. A duplicate is 409 duplicate_client_order_id before anything reaches the venue.
• Attach take_profit / stop_loss (trigger prices) to an entry order and they fan out as reduce-only conditionals after the entry submits.

Preview first if you want the fee/margin estimate: POST /v1/orders/preview.

curl "https://trade.mutex.exchange/v1/fills?limit=50" \
  -H "Authorization: Bearer mtx_bot_…"
# {"fills":[{"fill_id":"…","symbol":"BTC","side":"buy","role":"taker",
#            "size":"0.01","price":"50000","fee":"0.15","liquidation":false,
#            "created_at":1721480400000}],"next_before":"…"}

Page with the cursor: pass the response's next_before as ?before=. Positions and balance are GET /v1/positions and GET /v1/account.

Authorization: Bearer <key> on every non-market-data route. Market data (/v1/markets, /v1/candles) needs no key. A trading key on affiliate routes (or the reverse) is 403 wrong_key_kind. Keys never expire; they die when revoked or when the bound bot is torn down. On a suspected leak, revoke the key (regenerate in the app or ask an admin) - the bot keeps running.

Two per-key fixed 1-minute buckets:

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset (seconds to reset). Over the limit → 429 rate_limited plus Retry-After - back off until then. Sustained flooding (> 1000 429s in 10 min) auto-suspends the key for an hour (key_suspended); three suspensions in 24 h needs a manual admin re-enable. Public market data has no per-key bucket - nginx per-IP flood control is the guard there.

Honest HTTP status + { "error": { "code", "message" } }. Match on code.

Deposits, withdrawals, swaps, transfers, TWAP orders, WebSocket streams, and your main perp account. Slice your own algo orders; poll for market data. The full endpoint set, request/response schemas and examples live in the interactive reference.