Skip to main content
The OCX API is a single HTTPS surface for both venues — options and dated futures. All traffic flows through one gateway that authenticates you and routes to the matching engines, so you work against one base URL with one request and response contract.

REST endpoints

Market data, trading, account, and wallet operations over HTTPS JSON.

Streaming

Server-Sent Events for futures books, fills, positions, the option board, and balances.

Errors & limits

Status codes, error shapes, and rate limits.

​
Base URL

All request and response bodies are JSON. Monetary and size values are returned as decimal strings (for example "31071.25", not 31071.25) — parse them with a decimal-safe type, never a native float. Futures endpoints live under /fut/*; the legacy /perps/* prefix serves the same handlers. Options endpoints use /orders, /quotes, /positions/me, and /options/*; market data lives under /markets/*, /fut/*, and /orderbook/*.
The API is meant to be called from your own servers, bots, and agents. Cross-origin browser requests are only allowed from OCX’s own web app.

​
Authentication

Each endpoint in this reference is tagged with the access it needs.

Public

No credentials. Market data — markets, order books, stats, candles, the option board, fee schedules — and the public streams.

Session

A session from Sign-In With Ethereum (SIWE). Required for orders, quotes, and your own account and wallet.
Sign in with your wallet to open a session — the full flow is in Authentication. The session is a signed JWT valid for 7 days, delivered as the astra_session cookie and accepted either way:
API keys created in the app are not yet accepted by the public API. Use a session token for automated access.

​
Response shape

Successful responses return the resource directly as a JSON object or array — there is no envelope on REST responses.
Streaming endpoints return text/event-stream — see Streaming.

​
Error shape

Errors use HTTP status codes with a JSON body. Handle the status first, then read the body for detail. Business rejections carry a stable code, for example:
The exact body differs between the options and futures engines; see Errors & rate limits for both shapes and the codes to handle.

​
Rate limits

Requests are rate-limited per client, and rate-limited responses carry x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset (seconds until the window resets). Futures market-data reads are not rate-limited; prefer the streams over tight polling anyway. Details are in Errors & rate limits.

​
Idempotency

Order endpoints accept a clientOrderId. Resending an order with the same clientOrderId and the same parameters returns the original result instead of placing a second order. Quote endpoints accept a quoteId to tag a quote set.

​
Versioning

The API is served at a single base path. New fields and endpoints may appear without notice, so clients should ignore unknown JSON fields. Operational values such as fees and margin are surfaced through live responses (fee schedules and order preview) rather than pinned as constants, so always read the current values.