General Info

General API Information

• The base endpoint is: https://app.quote.trade/api
• All HTTP POST and PUT endpoints expect minified JSON. ({} if there is no data to send.)
• For GET endpoints, parameters must be sent in the query string.
• For POST and PUT endpoints, the parameters must be sent as the request body with content type application/json.
• All HTTP endpoints return either a minified JSON object or a minified JSON array.

HTTP Return Codes

• HTTP 200 return code is used for success or business rejection responses.
• HTTP 4XX return codes are used for malformed requests; the issue is on the sender's side.
• HTTP 403 return code is used when the WAF Limit (Web Application Firewall) has been violated.
• HTTP 409 return code is used when a cancelReplace order partially succeeds. (e.g. if the cancellation of the order fails but the new order placement succeeds.)
• HTTP 429 return code is used when breaking a request rate limit.
• HTTP 418 return code is used when an IP has been auto-banned for continuing to send requests after receiving 429 codes.
• HTTP 5XX return codes are used for internal errors; the issue is on quote.trade's side. It is important to NOT treat this as a failed operation; the execution status is UNKNOWN and the operation may have succeeded.

Error Codes and Messages

• If an error occurs, the API returns an error message explaining the reason.

The API error payload is as follows:

{
  "error":"Invalid symbol."
}

LIMITS

REST Rate Limits

• Rate limits are runtime configuration and can differ by deployment. Do not hard-code a value from this page.
• Read the current advertised order limit from GET /api/exchangeInfo and its rateLimits array.
• Additional gateway, IP, authenticated user/account, route-specific or burst controls may be stricter than the advertised order bucket.
• When the server returns HTTP 429 or {"error":"rate limit exceeded"}, stop sending requests and retry with bounded backoff. Honor Retry-After when it is present.
• Do not blindly retry an order, cancellation, transfer or withdrawal after an ambiguous timeout or rate-limit response. Query or reconcile its status first.

WebSocket Limits

• Connection, message-rate, payload-size and subscription limits are deployment-specific.
• Clients must use bounded reconnect backoff and reconcile missed order state after reconnecting.
• Ping, pong and subscription-control traffic may count toward gateway message limits.

API Limit Introduction

The /api/* endpoints can be subject to independent IP, user/account, endpoint and gateway controls. The rateLimits array returned by GET /api/exchangeInfo is the current advertised order limit for that deployment; it is not a guarantee that every endpoint shares one bucket or that no stricter control applies.

---

Data Sources

• The API system is asynchronous, so some delay in the response is normal and expected.
• Each endpoint has a data source indicating where the data is being retrieved, and thus which endpoints have the most up-to-date response.

These are the three sources, ordered from the most up-to-date to the one with potential update delays.

• Matching Engine - the data is from the matching engine
• Memory - the data is from a server's local or external memory
• Database - the data is taken directly from a database

Endpoint security type

• Each endpoint has a security type that determines how you will interact with it. This is stated next to the NAME of the endpoint.
  • If no security type is stated, assume the security type is NONE.
• API keys are passed into the REST API via the X-MBX-APIKEY header.
• API keys and secret keys are case sensitive.
• API keys can access only the routes permitted by their assigned permissions; a trade-only key cannot authorize withdrawals.

Security Type	Description
NONE	Endpoint can be accessed freely.
TRADE	Endpoint requires sending a valid API-Key and signature.
USER_DATA	Endpoint requires sending a valid API-Key and signature.
USER_STREAM	Endpoint requires sending a valid API-Key.
MARKET_DATA	Endpoint requires sending a valid API-Key.

• TRADE, and USER_DATA endpoints are SIGNED endpoints.

---

SIGNED (TRADE, AND USER_DATA ) Endpoint security

• SIGNED endpoints require an additional parameter, signature, to be sent in the http headers.
• Endpoints use HMAC SHA256 signatures. The HMAC SHA256 signature is a keyed HMAC SHA256 operation. Use your secretKey as the key. For POST requests, the value is the raw query string after ? exactly as sent (if the URL has one) immediately followed by the exact serialized request body bytes; with no query string it is just the body. Send those same bytes without reformatting. For signed GET requests, sign the raw query string after ? exactly as sent (for example, symbol=USDT), or the empty string when there is no query. Sensitive account actions (profile, password, 2FA, API keys, withdrawals, transfers, whitelists, banks, user files) must include a millisecond timestamp (and optionally recvWindow) inside the signed payload. Withdrawals, transfers and apiKey/apiKeys must be signed with a wallet (non-trade-only) API key.
• The signature is not case sensitive.

SIGNED Endpoint Example for POST /api/v2/order

Sign the exact minified request-body bytes that you send. The example below generates a current millisecond timestamp, signs the body with HMAC SHA256, and sends a regular priced LIMIT order. Replace the placeholder credentials before using it.

Key	Value
apiKey	YOUR_API_KEY
secretKey	YOUR_API_SECRET

Parameter	Value
symbol	BTC
side	BUY
type	LIMIT
timeInForce	GTC
quantity	0.001
price	75000
timestamp	Current Unix time in milliseconds

Signed curl request:

api_key='YOUR_API_KEY'
api_secret='YOUR_API_SECRET'
api_url='https://app.quote.trade/api/v2/order'
timestamp=$(date +%s000)
request_body=$(printf '{"symbol":"BTC","side":"BUY","type":"LIMIT","timeInForce":"GTC","quantity":0.001,"price":75000,"newClientOrderId":"btc-limit-001","timestamp":%s}' "$timestamp")
signature=$(printf '%s' "$request_body" | openssl dgst -sha256 -hmac "$api_secret" | awk '{print $NF}')

curl -X POST "$api_url" --data-binary "$request_body" \
  -H "X-MBX-APIKEY: $api_key" \
  -H "signature: $signature" \
  -H "Content-Type: application/json"

If the URL contains a query string, sign the exact raw query string followed immediately by the exact body bytes. Do not parse, reformat, or reserialize the body after calculating the signature.

---

Public API Definitions

Terminology

These terms will be used throughout the documentation, so it is recommended especially for new users to read to help their understanding of the API.

• base asset refers to the asset that is the quantity of a symbol. For the symbol BTC/USDC, BTC would be the base asset.
• quote asset refers to the asset that is the price of a symbol. For the symbol BTC/USDC, USDC would be the quote asset.

ENUM definitions

Symbol status (status):

• PRE_TRADING
• TRADING
• POST_TRADING
• END_OF_DAY
• HALT
• AUCTION_MATCH
• BREAK

Account and Symbol Permissions (permissions):

• SPOT
• MARGIN
• LEVERAGED
• TRD_GRP_002
• TRD_GRP_003
• TRD_GRP_004
• TRD_GRP_005

Order status (status):

Status	Description
NEW	The order has been accepted by the engine.
PARTIALLY_FILLED	A part of the order has been filled.
FILLED	The order has been completed.
CANCELED	The order has been canceled by the user.
PENDING_CANCEL	Currently unused
REJECTED	The order was not accepted by the engine and not processed.
EXPIRED	The order was canceled according to the order type's rules (e.g. LIMIT FOK orders with no fill, LIMIT IOC or MARKET orders that partially fill) or by the exchange, (e.g. orders canceled during liquidation, orders canceled during maintenance)

OCO Status (listStatusType):

Status	Description
RESPONSE	This is used when the ListStatus is responding to a failed action. (e.g. order list placement or cancellation)
EXEC_STARTED	The order list has been placed or there is an update to the order list status.
ALL_DONE	The order list has finished executing and is no longer active.

OCO Order Status (listOrderStatus):

Status	Description
EXECUTING	Either an order list has been placed or there is an update to the status of the list.
ALL_DONE	An order list has completed execution and is no longer active.
REJECT	The list status indicates a failed action during order placement or cancellation.

Order types (orderTypes, type):

• LIMIT
• MARKET
• STOP_LOSS
• STOP_LOSS_LIMIT
• TAKE_PROFIT
• TAKE_PROFIT_LIMIT
• LIMIT_MAKER

Order Response Type (newOrderRespType):

• ACK
• RESULT
• FULL

Order side (side):

• BUY
• SELL

Time in force (timeInForce):

This sets how long an order will be active before expiration.

Status	Description
GTC	Good Till Canceled An order will be on the book unless the order is canceled.
IOC	Immediate Or Cancel An order will fill as much as possible before it expires.
FOK	Fill or Kill An order will expire if the full order cannot be filled upon execution.

Kline/Candlestick chart intervals:

s-> seconds; m -> minutes; h -> hours; d -> days; w -> weeks; M -> months

• 1s
• 1m
• 3m
• 5m
• 15m
• 30m
• 1h
• 2h
• 4h
• 6h
• 8h
• 12h
• 1d
• 3d
• 1w
• 1M

const { Wallet, verifyMessage } = require("ethers"); // ethers.js version 6.13.5

const privateKey = "0x"; // Replace with your actual private key
const wallet = new Wallet(privateKey);

/**
  * Signs a message with the given private key.
  * @param {string} challenge - The challenge text received from the server.
  * @returns {Promise} - The signed message.
  */
async function signMessage(challenge) {
  const signature = await wallet.signMessage(challenge);
  return signature;
}
              

{
    "signature": "{ecrecover signature generated in step 2}",
    "challenge": "{CHALLENGE TEXT received in step 1}"
}
        

{
    "requestToken": "{REQUEST_TOKEN}",
    "requestSecret": "{REQUEST_SECRET}"
}
        

const { Wallet, verifyMessage } = require("ethers"); // ethers.js version 6.13.5

const privateKey = "0x"; // Replace with your actual private key
const wallet = new Wallet(privateKey);

/**
  * Signs a message with the given private key.
  * @param {string} challenge - The challenge text received from the server.
  * @returns {Promise} - The signed message.
  */
async function signMessage(challenge) {
  const signature = await wallet.signMessage(challenge);
  return signature;
}