Skip to main content
API reference
CeFi direct REST
Docs
Help
Version: v1.0.6

True Markets CeFi REST

Overview​

This API allows clients to interact with the CeFi trading platform for order management, market data retrieval, and account information.

Base URLs​

EnvironmentBase URL
Productionhttps://api.truex.co/v1/cefi/
UAT (sandbox)https://api.uat.truex.co/v1/cefi/

UAT and Production require VPN / PrivateLink network access for institutional clients. Contact [email protected] for network onboarding.

Breaking in v1.0.6. The legacy /api/v1/ path prefix is removed — every operation is now served only under /v1/cefi/ (admin operations under /admin/v1/cefi/). Response formats are unchanged: this release is a path move only, so updating your base path is sufficient.

Coming on November 1, 2026 — v2024_01_01 is removed. From that date v2026_01_23 is the only supported schema version. It becomes the default, so a request that sends no X-Truex-Version header will receive the envelope response format described under API Versioning below, with paginated list reads and error bodies wrapped in { "error": ... }; and a request that explicitly sends X-Truex-Version: v2024_01_01 is rejected. There is no way to remain on v2024_01_01 past that date — it is already past its August 5, 2026 sunset — so pinning that header delays nothing and will fail your requests once the cutoff lands. Send X-Truex-Version: v2026_01_23 now to adopt the new format on your own schedule beforehand.

Authentication​

Protected endpoints accept either of two authentication methods:

  • Institutional clients — HMAC-SHA256 signed requests using an API key (organization_id / key_id / secret).
  • Retail clients — a JWT bearer token in the Authorization header, with no per-request signing.

Market data and service-health endpoints are public and require no authentication.

Institutional: obtaining API-key credentials​

Direct CeFi REST/WS/FIX access for institutions requires KYB onboarding. Begin at https://www.truex.co/sign-up, or contact [email protected] for help. Approved organizations receive an organization_id, key_id, and HMAC secret.

Retail: JWT bearer token​

Retail clients authenticate directly by presenting a True Markets-issued JWT access token in the Authorization: Bearer <token> header — no per-request HMAC signing. Obtain a token pair by registering an ES256 (EC P-256) API key and exchanging a signed challenge via the Auth API (POST /v1/auth/api-key/token); the same token is also issued by the standard sign-in flows.

The access token must carry a client_id claim, which scopes every request to your CeFi client. That claim is present only once your account is onboarded to CeFi — a JWT without a client_id claim is rejected with 401 Unauthorized.

Signature computation (HMAC-SHA256)​

Each authenticated request must include the headers X-Truex-Organization-Id, X-Truex-Key-Id, X-Truex-Timestamp (UTC Unix seconds, within ±15s of server time), and X-Truex-Signature. Compute X-Truex-Signature as:

signature = base64( HMAC_SHA256( secret, METHOD + "\n" + PATH + "\n" + TIMESTAMP + "\n" + BODY ) )

where BODY is the exact serialized request body (empty string for GET/DELETE). See docs.truex.co for reference implementations in Python, Go, and shell.

API Versioning​

The API uses date-based versioning via the X-Truex-Version header. To request a specific API version, include the header in your request:

X-Truex-Version: v2026_01_23

Supported Versions:

VersionStatusDescription
v2024_01_01Deprecated (Default) — removed November 1, 2026Original API format - responses return raw data arrays/objects
v2026_01_23Current — becomes the default and the only supported version on November 1, 2026Envelope format - responses wrapped in { "data": [...], "pagination": {...} }

If no version header is provided, the API defaults to v2024_01_01. From November 1, 2026 the default is v2026_01_23, and v2024_01_01 is rejected whether it is sent explicitly or inherited. Use the /v1/cefi/versions endpoint to discover supported versions programmatically.

Response Format by Version:

  • v2024_01_01: [{...}, {...}] (raw array) or {...} (raw object)
  • v2026_01_23: { "data": [...], "pagination": { "size": 10, "next_cursor": "..." } }

Error Response Format by Version:

  • v2024_01_01: RFC 7807 Problem Details format
  • v2026_01_23: { "error": { ...RFC 7807 Problem Details... } }

Deprecation Policy: When a version is deprecated, responses will include RFC 8594 headers:

  • Deprecation: Date when the version was deprecated
  • Sunset: Date when the version will be removed

Deprecation is a warning, not a grace period that can be extended: once a version passes its removal date it is withdrawn, and requests that ask for it are rejected rather than served in an older format.

Authentication​

Clients must compute and send an HMAC signature in x-truex-auth-signature.

Compute the payload exactly as:

timestamp + method + path + body

Then compute the signature as:

Base64( HMAC_SHA256(secret, payload) )

Rules:

  • timestamp is x-truex-auth-timestamp in seconds since Unix epoch.
  • timestamp must be no older than 15 seconds and no more than 1 second in the future.
  • method is uppercase HTTP method (GET, POST, DELETE, etc.).
  • path is everything after the domain, including leading / (e.g. /v1/cefi/orders) and excludes query string parameters.
  • body is the exact raw request body string. Use an empty string for requests with no body.

Example payload:

  • 1700000000POST/v1/cefi/orders{"client_id":"7","instrument_id":"1","qty":"1","price":"100"}

Example signature (shell):

  • printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" -binary | base64

Note, method is all upper case and path is everything after the domain name including the / (e.g. /v1/cefi/orders). Required headers:

  • x-truex-auth-token: The ID of the HMAC key being used (API key).
  • x-truex-auth-signature: The signature generated from processing the payload with the HMAC key.
  • x-truex-auth-timestamp: Current time as seconds since epoch.
  • x-truex-auth-userid: Client identifier.

Security Scheme Type:

apiKey

Header parameter name:

x-truex-auth-token

Terms of Service

https://truex.co/tos
Was this page helpful?YesNo