> ## Documentation Index > Fetch the complete documentation index at: https://developers.oceanxz-int.com/llms.txt > Use this file to discover all available pages before exploring further. # Documentation Description ## Example of Interface > [!NOTE] > > The interface below is the interface for obtaining server time. This interface > is used as an example to show the interface format, access link and parameter > description. ## Check Server Time **`GET`** `https://openapi.oceanxz-au.com/sapi/v1/time` > [tab] 200: OK > > ```json theme={null} > { > "timezone": "Coordinated Universal Time", > "serverTime": 1785841675564 > } > ``` > [tab] Responses > > | Parameter | Type | Example | Describe | > | - | - | - | - | > | timezone | string | Coordinated Universal Time | Server time zone | > | serverTime | long | 1785841675564 | Server timestamp | *** ## Document parameters specifications > [!NOTE] > > The red \* in the upper right corner of the input parameter name indicates > that the parameter must be inputted, otherwise it is not required. > [!NOTE] > > The interface is case-sensitive to input parameter characters, which will be > clearly specified in the interface. If the currency pair name is in uppercase, > you need to enter BTCUSDT, but btcusdt is not allowed. > [!NOTE] > > The input parameters in the document have clear type descriptions and need to > be entered according to the specified type. For example, the integer type can > only input numeric types. The input of 3 is correct, but the input of "3" is > not allowed. *** ## Whether the interface requires signature verification? Interface types are divided into: Public, Market, Trade, Account * The interfaces under the "Public" and "Market" categories can be accessed without API-Key or signature. * "Trade" and "Account" security require API-Key and signature verification before access * The signature content is related to the parameters. If the parameters are entered incorrectly, the parameter error or null value will be returned. * For interfaces that require signature verification, X-CH-SIGN, X-CH-APIKEY, and X-CH-TS must be added to the header for signature verification. For signature rules and examples, please refer to : Signature (apiKey and secretKey in this document are virtual values. The real content needs to be obtained by the user in the API management of the front page) *** ## Return code type Please refer to the document: [Return Code Type](https://developers.oceanxz-int.com/docs/return_code_type.md) *** ## API Basic Information * baseurl `https://openapi.oceanxz-au.com` * All endpoints return either a JSON object or array. * Data is returned in **Reverse** order. newest first, oldest last. * All time and timestamp related fields are in milliseconds. *** ## HTTP Error Codes * HTTP `4XX` return codes are used for malformed requests; the issue is on the sender's side. * HTTP `403` return code is used when the request is blocked for exceeding a rate limit. * HTTP `5XX` return codes are used for internal errors * HTTP `504` return code is used when the API successfully sent the message but not get a response within the timeout period. It is important to **NOT** treat this as a failure operation; the execution status is **UNKNOWN** and could have been a success. * All endpoints can possibly return an ERROR, the error payload is as follows: ```json theme={null} { "code": -1121, "msg": "Invalid symbol." } ``` *** ## General Information * All requests are based on the Https protocol, and the `Content-Type` in the request header information needs to be uniformly set to:`'application/json'` * For the interface of the `GET` method, the parameters must be sent in the `query string` * The interface of the `POST` method, the parameters must be sent in the `request body` * Parameters may be sent in any order. *** ## LIMITS * There will be a limited frequency description below each interface. * A 403 will be returned when either rate limit is violated. *** ## Endpoint Security Type * Each endpoint has a security type that determines the how you will interact with it. * API-keys are passed into the Rest API via the `X-CH-APIKEY` header. * API-keys and secret-keys **are case sensitive**. | Security Type | Description | | - | - | | NONE | Endpoint can be accessed freely. | | TRADE | Endpoint requires sending a valid API-Key and signature. | | USER\_DATA | Endpoint requires sending a valid API-Key and signature. | | USER\_STREAM | Endpoint requires sending a valid API-Key. | | MARKET\_DATA | Endpoint requires sending a valid API-Key. | *** ## SIGNED (TRADE and USER\_DATA) endpoint security * When calling the `TRADE` or `USER_DATA` interface, the signature parameter should be passed in the `X-CH-SIGN` field in the HTTP header. * The signature uses the `HMAC SHA256` algorithm. The `API-Secret` corresponding to the API-KEY is used as the `HMAC SHA256` key. * The request header of `X-CH-SIGN` is based on `timestamp` + `method` + `requestPath` + `body string` (+ means string connection) as the operation object * The value of `timestamp` is the same as the `X-CH-TS` request header, `method` is the request method, and the letters are all uppercase: `GET/POST` * `requestPath` is the request interface path For example: `/sapi/v1/order` * `body` is the string of the request body (post only) * The signature is not case sensitive. *** ## Timing Security * The signature interface needs to pass the timestamp in the `X-CH-TS` field in the HTTP header, and its value should be the unix timestamp of the request sending time e.g. `1528394129373` * An additional parameter, `recvWindow`, may be sent to specify the number of milliseconds after `timestamp` the request is valid for. If `recvWindow` is not sent, **it defaults to 5000**. * In addition, if the server calculates that the client's timestamp is more than one second ‘in the future’ of the server’s time, it will also reject the request. * The logic is as follows: ```javascript theme={null} if (timestamp < serverTime + 1000 && serverTime - timestamp <= recvWindow) { // process request } else { // reject request } ``` **Serious trading is about timing.** Networks can be unstable and unreliable, which can lead to requests taking varying amounts of time to reach the servers. With `recvWindow`, you can specify that the request must be processed within a certain number of milliseconds or be rejected by the server. **It recommended to use a small recvWindow of 5000 or less!** *** ## SIGNED Endpoint Examples for POST /sapi/v1/order Here is a step-by-step example of how to send a vaild signed payload from the Linux command line using `echo`, `openssl`, and `curl`. | Key | Value | | - | - | | apiKey | `` | | secretKey | `` | | Parameter | value | | - | - | | symbol | BTCUSDT | | side | BUY | | type | LIMIT | | volume | 1 | | price | 9300 | *** ## Signature example * **body:** ```json theme={null} { "symbol": "BTCUSDT", "price": "9300", "volume": "1", "side": "BUY", "type": "LIMIT" } ``` * **HMAC SHA256 Signature:** ```bash theme={null} [linux]$ echo -n "1588591856950POST/sapi/v1/order/test{\"symbol\":\"BTCUSDT\",\"price\":\"9300\",\"volume\":\"1\",\"side\":\"BUY\",\"type\":\"LIMIT\"}" | openssl dgst -sha256 -hmac "902ae3cb34ecee2779aa4d3e1d226686" (stdin)= c50d0a74bb9427a9a03933d0eded03af9bf50115dc5b706882a4fcf07a26b761 ``` * **Curl command :** ```bash theme={null} (HMAC SHA256) [linux]$ curl -H "X-CH-APIKEY: " -H "X-CH-SIGN: " ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.