Documentation index
Everything is documented, versioned and generated from the schema.
Full API reference, deployment runbooks and control definitions are issued under NDA during technical due diligence. This index shows the surface area and the conventions that apply to all of it.
Rules that apply to every endpoint.
Versioning
Semantic, in the path
Major version in the URL, additive changes only within a major, and a published deprecation window of not less than six months with dual-running support.
Authentication
Scoped keys, least privilege
Keys are scoped to environment, module and permission set. Mutual TLS is available for institutional and on-premises integrations. Rotation is scheduled, not emergency.
Writes
Idempotent by contract
Every state-changing call accepts an idempotency key. Retries are safe. Duplicate suppression is enforced server-side and reported in the response.
Errors
Machine-readable, stable
A documented error taxonomy with stable codes, human-readable detail, and a correlation identifier that resolves to the audit-trail entry for the request.
Rate limits
Declared, not discovered
Limits are returned in response headers per key, with current usage and reset window. Throttling behaviour and backoff guidance are documented.
Documentation
Generated from the schema
OpenAPI 3.1 for REST, protocol buffers for internal gRPC, and JSON Schema for webhook payloads. Documentation cannot drift from the implementation.
What the documentation covers.
| Document set | Contents | Format | Access |
|---|---|---|---|
| API reference | Market data, signals, client records, payments, onboarding, managed accounts, reporting and audit export | OpenAPI 3.1 | Public · sandbox key |
| Streaming guide | WebSocket subscription model, binary frame layout, delta semantics, sequence recovery, backpressure | Prose + schema | Public |
| Webhook catalogue | Event types, payload schemas, signing, retry and replay behaviour | JSON Schema | Public |
| FIX profile | Supported messages, session configuration, sequence recovery, venue-specific profiles | FIX dictionary | Under NDA |
| Architecture pack | Full topology, layer specifications, control definitions, deployment options, measurement methods | PDF + diagrams | Under NDA |
| Control & security | RBAC model, four-eyes procedure, audit-trail format, evidence export shapes, retention configuration | Under NDA | |
| Deployment runbooks | Provisioning, failover rehearsal, recovery point and time objectives, degraded-mode behaviour per surface | Runbook | Client |
| Compliance mapping | Control-to-obligation mapping for the target permission set, aligned with the applicant's counsel | Matrix | Client |
Access levels: public — available with a sandbox key · under NDA — issued during technical due diligence · client — issued to engaged operators for their deployment
Deterministic fixtures, not a demo environment that drifts.
The sandbox replays recorded market sessions and returns deterministic responses for a fixed set of request patterns, so integration work is reproducible. Latency in the sandbox is not representative of production and is labelled as such in every response.
Sandbox properties
GET /v1/marketdata/XAUUSD?depth=5 Authorization: Bearer cvx_sbx_•••••••• Idempotency-Key: 3f1c9a72-88d4-4a1e Accept: application/json; v=1
{
"symbol": "XAUUSD",
"mid": 2385.25,
"spread": 0.10,
"depth": { "bid": 5, "ask": 5 },
"session": "LDN_PRE_NY",
"latency_ms": 0.82,
"meta": {
"environment": "sandbox",
"deterministic": true,
"latency_representative": false,
"correlation_id": "cvx-9f21-4488-ab10"
}
}
Documentation · next step
Request the architecture pack and sandbox access.
Issued under NDA where required, with a named engineering contact for the duration of your evaluation.