Developers
There is no privileged internal interface
The client area and the operations console are both clients of the same public API your team gets. That is the only arrangement that keeps documentation honest, because an undocumented change breaks our software first.
Same endpoints, same validation, same errors
What the surface covers
If it appears on a screen, there is an endpoint behind it
Client and account management
Create and update clients, manage groups and verification state, open and configure trading accounts.
Balances and transfers
Read wallet and account balances, initiate internal transfers, and query the ledger directly.
Payments
Initiate deposits, submit withdrawal requests and read their state, with the same validation the client area applies.
Documents and reporting
Upload and retrieve documents, generate statements, and query the records the built-in reports use.
Scoped credentials
Keys are granted specific scopes and can be revoked at any time, with every issuance recorded in the audit log.
See it live
The same request, in your terminal
A scoped key and a single call return the exact record shape the console itself reads — there is no separate, undocumented internal version.
Integrating against BrokerOS
The path from first request to production traffic
- 1Credential
Scoped keys
An API key is created with an explicit scope. Read-only, client management and payment initiation are granted separately.
- 2Sandbox
Real error paths
The sandbox mirrors the production surface including error responses, so an integration meets its edge cases before it meets real clients.
- 3Build
Same validation as the console
API requests pass through identical validation, so an integration cannot bypass a limit or a permission your team configured.
- 4Promote
Endpoint and key change, nothing else
Moving to production changes credentials and the base URL. Request shapes, responses and error semantics are unchanged.
Why API quality matters here
The client area covers the common path. The API covers everything specific to your business.
Automate operations
Bulk onboarding, scheduled adjustments and internal tooling stop being console work.
Own your front end
Some brokerages build their own client area against this API rather than using ours.
No bypass risk
Identical validation means an integration cannot route around a control your team set.
Accurate documentation
Because our own software depends on it, the published surface cannot quietly drift.
FAQ
REST API: common questions
5 short answers to what teams ask before a demo.
Yes. The client area and the operations console are both consumers of it. There is no separate privileged interface, which is what keeps the published documentation accurate.
Each key carries an explicit scope — read-only, client management, payment initiation — granted independently. Issuance and revocation are recorded in the audit log with the operator identity.
No. Validation runs server-side, so limits, permissions and jurisdiction rules apply identically whether a request came from the API, the client area or the console.
Yes, a separate environment mirroring the production surface including error responses, so integration work happens without touching real clients or money.
The API is versioned with published schemas and a changelog per release. A superseded version remains available for a stated window so you can migrate deliberately.
Still have a question?
A specialist will answer it directly, with your set-up in mind.
Ask a specialistGive your engineers the whole API surface
We will walk your technical team through the API surface, the sandbox and the webhook model.