DEVELOPER & QUANT API SPECIFICATION

StrataRelay REST API & Webhooks

Programmatic access to low-latency quantitative signals, trade execution telemetry, risk firewall controls, and cryptographically verified audit streams.

Interactive Swagger UI openapi.json

Bearer Authentication

Include your live API key or OAuth JWT token in every request header:

Authorization: Bearer er_live_...

Cryptographic Scopes

Keys are strictly scoped according to principle of least privilege:

signals:readtrades:readrisk:adminorders:write

Outbound Webhooks

Every webhook delivery is signed with HMAC-SHA256:

X-StrataRelay-Signature: sha256=...

Quickstart Implementation

# 1. Verify API Connectivity
curl -X GET "http://127.0.0.1:8000/api/v1/health"

# 2. Fetch Latest Quantitative Model Signals
curl -X GET "http://127.0.0.1:8000/api/v1/signals" \
  -H "Authorization: Bearer er_live_Tz9PJoMbT4hXop5DyDWwu2cpIIMXYaHvVFkPOuZZbes"

# 3. Trigger Emergency Kill Switch (Fleet-Wide)
curl -X POST "http://127.0.0.1:8000/api/v1/risk/kill-switch" \
  -H "Authorization: Bearer er_live_Tz9PJoMbT4hXop5DyDWwu2cpIIMXYaHvVFkPOuZZbes" \
  -H "Content-Type: application/json" \
  -d '{"action": "CANCEL_AND_PAUSE", "pause": true}'

Core REST Endpoints

Canonical v1 Spec

GET/api/v1/health

Public

Liveness and operational status of StrataRelay control plane.

Example Response (200 OK)

{
  "status": "HEALTHY",
  "version": "1.0.0"
}

GET/api/v1/models

Bearer API Key

List all active quantitative models, trading universes, and verification hashes.

Example Response (200 OK)

[
  {
    "id": "core-v3-7",
    "name": "Core Multi-Asset",
    "universe": ["BTC", "ETH", "SOL", "BNB", "AVAX"],
    "version": "3.7.3",
    "status": "FORWARD_PAPER"
  }
]

GET/api/v1/signals

Bearer API Key (scope: signals:read)

Fetch real-time opportunity signals strictly for your workspace's active model(s) (Signal: 1 active model, Execute: up to 5). Supports optional ?model_id= filter.

Example Response (200 OK)

[
  {
    "id": "sig-001",
    "model_id": "core-v3-7",
    "pair": "BTC/USDT",
    "action": "ENTER_LONG",
    "entry_price": 65420.0,
    "created_at": "2026-10-04T10:15:00Z"
  }
]

GET/api/v1/trades

Bearer API Key (scope: trades:read)

Query executed paper and live order ledgers with timestamps and friction attribution.

Example Response (200 OK)

[
  {
    "id": "TR-8953",
    "model": "Core Multi-Asset",
    "pair": "BTC/USDT",
    "direction": "LONG",
    "entry_price": 65420.0,
    "exit_price": 66890.0,
    "pnl_pct": 2.25,
    "status": "OPEN"
  }
]

GET/api/v1/risk/profile

Bearer API Key / JWT

Retrieve tenant risk parameters, maximum portfolio exposure, and kill switch status.

Example Response (200 OK)

{
  "tenant_id": "tenant-8f12a",
  "max_open_trades": 5,
  "max_exposure_usd": 20000.0,
  "trading_paused": false
}

POST/api/v1/risk/kill-switch

Bearer API Key / JWT

Trigger emergency execution halt, cancel pending orders, or resume automation across fleet.

Example Response (200 OK)

{
  "status": "TRIGGERED",
  "trading_paused": true,
  "model_id": "all",
  "canceled_orders": 0,
  "success": true
}

GET/api/v1/risk/incidents

Bearer API Key / JWT

Retrieve immutable security, risk & kill switch incident trail with SHA-256 integrity.

Example Response (200 OK)

[
  {
    "id": "INC-89A12B",
    "action": "EMERGENCY_KILL_SWITCH_ENGAGED",
    "actor": "[email protected]",
    "status": "ENGAGED",
    "timestamp": "2026-10-04 17:15:00 UTC"
  }
]

POST/api/v1/auth/api-tokens

JWT (User Session)

Provision a new high-entropy, scoped API key for external bots and pipelines.

Example Response (200 OK)

{
  "id": "tok-9842",
  "name": "Production Bot",
  "token": "er_live_Tz9PJoMbT4hXop5DyDWwu2cpIIMXYaHvVFkPOuZZbes",
  "prefix": "er_live_Tz9P",
  "scopes": ["signals:read", "trades:read"]
}

POST/api/v1/webhooks

Bearer API Key / JWT

Example Response (200 OK)

{
  "id": "wh-491",
  "url": "https://api.yourcompany.com/webhook",
  "status": "ACTIVE",
  "signing_secret": "whsec_8f910a92b8c049e..."
}

Webhook HMAC-SHA256 Verification

StrataRelay delivers real-time notifications directly to your HTTPS endpoint. Verify the X-StrataRelay-Signature header against the raw request body to guard against tampering and replay attacks.

import hmac
import hashlib

def verify_stratarelay_webhook(raw_body: bytes, received_signature: str, signing_secret: str) -> bool:
    computed = "sha256=" + hmac.new(
        signing_secret.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(computed, received_signature)