Developer Documentation

This page documents the public REST and WebSocket APIs exposed for trading bots, integration scripts, and live market price feeds. All endpoints documented here are public by design.

Base API URL

Standard requests are rate-limited to 120 calls per minute per IP address. If exceeded, the API returns a standard HTTP 429 Too Many Requests response.

Authentication

Signed REST requests are validated against your API key, custom signature, and timestamp. Please provide the following HTTP headers on every authenticated private request:

REST Endpoints

Browse the public and authenticated REST actions available below.

Order request example

Authenticated REST calls require calculation of an HMAC signature. Concatenate your request components and calculate the signature with your Secret API key.

Signature Format

payload = timestamp + method.toUpperCase() + path + body
signature = HMAC_SHA256(apiSecret, payload).hex()

cURL Request Example

curl --request POST \
  --url https://api.vitrincard.com/orders \
  --header 'x-api-key: vc_live_xxx' \
  --header 'x-api-timestamp: 1760000000000' \
  --header 'x-api-signature: <computed-signature>' \
  --header 'Content-Type: application/json' \
  --data '{
    "pairId": "pair-uuid",
    "type": "LIMIT_BUY",
    "side": "BUY",
    "amount": "0.0100",
    "price": "62000"
  }'

WebSocket API

Use the public Socket.io endpoint to subscribe to live price snapshots and broadcast feeds for active markets.

WS Path

Socket.io Client Example

const socket = io("https://api.vitrincard.com", {
  path: "/public/ws",
  transports: ["websocket"],
});

socket.emit("subscribe:market", { pairs: ["USDT-IRT"] });

socket.on("market:price", (data) => {
  console.log(data.pair, data.bid, data.ask);
});