API Reference

One base URL, bearer auth, JSON in and out. Everything the dashboard shows you comes through these same routes.

Authentication

Send your key as a bearer token. Every request needs one, and the key’s scope decides what it may do.

Authorization: Bearer vst_live_…

Scopes

read — prices, positions, history. Cannot place an order.
trade — everything read can do, plus orders. Cannot mint keys.
manage — accounts and keys. Cannot place a trade.

Routes

Reading

Route	Scope	What it does
`GET /v1/account`	`read`	Balance, equity, margin, leverage.
`GET /v1/positions`	`read`	Everything currently open.
`GET /v1/orders`	`read`	Pending orders.
`GET /v1/symbols`	`read`	What this account can trade, with its limits.
`GET /v1/candles`	`read`	Historical bars for one symbol.
`GET /v1/history`	`read`	Closed deals over a time range.
`GET /v1/session`	`manage`	The terminal's own health and watchdog tallies.

Trading

Route	Scope	What it does
`POST /v1/orders`	`trade`	Place an order. Requires a client_order_id.
`POST /v1/orders/check`	`read`	Validate an order without sending it.
`GET /v1/orders/{client_order_id}`	`read`	Look up by your id, not a broker ticket.
`PATCH /v1/positions/{ticket}`	`trade`	Move a stop or take-profit.
`DELETE /v1/positions/{ticket}`	`trade`	Close a position, whole or partial.
`DELETE /v1/orders/{ticket}`	`trade`	Cancel a pending order.
`POST /v1/positions/close-all`	`trade`	Close everything. Never rate limited.

Safety

Route	Scope	What it does
`POST /v1/kill`	`trade`	Engage the kill switch. Never rate limited.
`DELETE /v1/kill`	`manage`	Disarm it. Deliberately manage-only.

Management

Route	Scope	What it does
`GET /v1/accounts`	`manage`	Connected MT5 accounts.
`POST /v1/accounts`	`manage`	Connect one.
`PATCH /v1/accounts/{id}`	`manage`	Rename, replace credentials, enable or disable.
`DELETE /v1/accounts/{id}`	`manage`	Disconnect. Positions stay at your broker.
`GET /v1/keys`	`manage`	Key prefixes and scopes. Never the keys.
`POST /v1/keys`	`manage`	Mint a key. Shown once.
`DELETE /v1/keys/{prefix}`	`manage`	Revoke, immediately.
`GET /v1/hosts`	`manage`	The machines running your accounts.
`GET /v1/activity`	`manage`	The audit log. Supports ?format=csv.
`POST /v1/session/restart`	`manage`	Rebuild the terminal.

Idempotency

Every order carries a client_order_id you choose. Send the same one twice and you get the first result back rather than a second trade — including when the first attempt timed out and you never saw the answer. That is the whole point of it: after a 503, resending the identical request is the correct move, not a gamble.

Errors

Three classes, and the right response to each is different:

4xx — the request is wrong or not allowed. Fix it; retrying unchanged will not help.
200 with status: rejected — we reached your broker and they said no. Not an error in the transport sense; the reason says why.
503 — we do not know what happened. Resend the identical request; the client_order_id makes that safe.

Code	HTTP	Meaning	What to do
`missing_key`	401	No API key was supplied.	Fix the request. Retrying unchanged will not help.
`invalid_key`	401	This API key is not recognised.	Fix the request. Retrying unchanged will not help.
`revoked_key`	401	This API key has been revoked.	Fix the request. Retrying unchanged will not help.
`scope_insufficient`	403	This key does not have the scope for that.	Fix the request. Retrying unchanged will not help.
`account_not_permitted`	403	This key is bound to a different account.	Fix the request. Retrying unchanged will not help.
`order_exceeds_max_lots`	403	This order is larger than the key's ceiling.	Fix the request. Retrying unchanged will not help.
`position_limit_reached`	403	This key has reached its open position limit.	Fix the request. Retrying unchanged will not help.
`kill_switch_engaged`	403	The kill switch is engaged for this account.	Fix the request. Retrying unchanged will not help.
`instrument_not_permitted`	403	This key may not trade that instrument.	Fix the request. Retrying unchanged will not help.
`two_factor_required`	403	Enable two-factor authentication first.	Fix the request. Retrying unchanged will not help.
`subscription_past_due`	402	Payment is past due. Closing positions still works.	Fix the request. Retrying unchanged will not help.
`client_order_id_required`	422	client_order_id is required.	Fix the request. Retrying unchanged will not help.
`client_order_id_too_long`	422	client_order_id must be 128 characters or fewer.	Fix the request. Retrying unchanged will not help.
`client_order_id_reused`	422	That client_order_id was already used for a different request.	Fix the request. Retrying unchanged will not help.
`unknown_symbol`	422	This account cannot trade that symbol.	Fix the request. Retrying unchanged will not help.
`unknown_timeframe`	422	That timeframe is not one we serve.	Fix the request. Retrying unchanged will not help.
`invalid_side_or_type`	422	side must be buy or sell; type must be market, limit, stop or stop_limit.	Fix the request. Retrying unchanged will not help.
`volume_below_minimum`	422	That volume is below the symbol's minimum.	Fix the request. Retrying unchanged will not help.
`volume_above_maximum`	422	That volume is above the symbol's maximum.	Fix the request. Retrying unchanged will not help.
`price_required`	422	A pending order needs a price.	Fix the request. Retrying unchanged will not help.
`missing_parameter`	422	A required parameter is missing.	Fix the request. Retrying unchanged will not help.
`invalid_json`	422	The request body is not valid JSON.	Fix the request. Retrying unchanged will not help.
`not_found`	404	No record of that.	Fix the request. Retrying unchanged will not help.
`busy`	429	Too many requests. Retry after the interval given.	Wait for retry_after_ms, then resend.
`terminal_unavailable`	503	The terminal is unreachable.	Resend the identical request.
`account_not_on_this_host`	503	That account is not currently running.	Resend the identical request.
`host_unreachable`	503	The host running this account is not connected.	Resend the identical request.
`order_outcome_unknown`	503	No reply from the broker. The order may or may not exist.	Resend the identical request.

Calls that reduce exposure — closing, cancelling, close-all, engaging the kill switch — are never rate limited and keep working while the kill switch is on or a payment is past due. If you build one safety assumption on this API, build it on that.