SDM API Reference

Build trading integrations on Secure Digital Markets.

Use SDM WebSocket, REST, and FIX APIs to connect market data, order execution, RFQ, trade, balance, and instrument workflows for institutional digital asset trading.

Start with auth View orders

REST sandboxtrade-sandbox.sdm.co

WebSocket sandboxwss://trade-sandbox.sdm.co/ws/v1

Source versionsTrading v1.4.0 / FIX v2.50

Quickstart

Shellbash

curl 'https://trade-sandbox.sdm.co/v1/symbols/BTC-USD/ohlcv/1D' \
  -H 'ApiKey: <api-key>' \
  -H 'ApiTimestamp: 2019-02-13T05:17:32.000000Z' \
  -H 'ApiSign: <signature>'

ResponseWebSocket hello

{
  "type": "hello",
  "ts": "2019-10-16T10:41:23.168807Z",
  "session_id": "1109RQ13KXR00"
}

Get started

Environments

Sandbox and production use separate API keys. Confirm the target environment before signing requests, because host and path are part of the signature payload.

WebSocket sandbox	wss://trade-sandbox.sdm.co/ws/v1
WebSocket production	wss://trade.sdm.co/ws/v1
REST sandbox	https://trade-sandbox.sdm.co
REST production	https://trade.sdm.co
FIX connectivity	Hostname, port, SenderCompID, and TargetCompID are issued during onboarding.

Get started

Authentication

WebSocket and REST requests use API-key headers and a Base64 URL-safe HMAC SHA-256 signature. Keep the Base64 padding from the generated signature and never send API secrets in chat, email threads, tickets, or logs.

Name	Type	Required	Description
`ApiKey`	string	Yes	SDM API key issued for the selected sandbox or production environment.
`ApiTimestamp`	datetime	Yes	ISO-8601 UTC timestamp, for example 2019-02-13T05:17:32.000000Z.
`ApiSign`	string	Yes	Base64 URL-safe HMAC SHA-256 signature created with the API secret.

WebSocket signature stringtext

GET
2019-02-13T05:17:32.000000Z
trade-sandbox.sdm.co
/ws/v1

REST signature stringtext

GET
2019-02-13T05:17:32.000000Z
trade-sandbox.sdm.co
/v1/symbols/BTC-USD/ohlcv/1D

WebSocket and REST

WebSocket connection

Connect to the versioned WebSocket path with signed headers. After authentication succeeds, SDM sends a hello message containing the server timestamp and session ID.

WebSocketGETwss://<host>/ws/v1

Hello messagejson

{
  "type": "hello",
  "ts": "2019-10-16T10:41:23.168807Z",
  "session_id": "1109RQ13KXR00"
}

WebSocket and REST

Subscriptions

Client requests use a non-zero reqid. Responses echo the request ID and may include a pagination token for follow-up page requests.

Name	Type	Required	Description
`reqid`	number	Yes	Related client request ID.
`seq`	number	Yes	Sequence number for this request stream.
`type`	string	Yes	Response or stream type.
`tag`	string	No	Optional tag echoed from the stream request.
`initial`	boolean	No	Marks an initial snapshot payload.
`action`	string	No	Update or Remove.
`data`	object[]	No	Response payload for the requested stream.
`total_count`	number	No	Total records for paged streams.
`ts`	datetime	Yes	Publication timestamp in UTC.

Subscribejson

{
  "reqid": 1,
  "type": "subscribe",
  "streams": [
    {
      "name": "Security"
    }
  ],
  "ts": "2019-02-13T05:17:32.000000Z"
}

Pagejson

{
  "reqid": 2,
  "type": "page",
  "data": [
    {
      "name": "MarketDataSnapshot",
      "after": "<next-token>"
    }
  ]
}

Canceljson

{
  "reqid": 2,
  "type": "cancel"
}

WebSocket and REST

Market data

Subscribe to instrument reference data, supported currencies, market data snapshots, and currency conversion streams.

WebSocketsubscribeMarketDataSnapshot

Market data snapshotjson

{
  "reqid": 5,
  "type": "subscribe",
  "streams": [
    {
      "name": "MarketDataSnapshot",
      "Symbol": "BTC-USD"
    }
  ]
}

Security fields

SecurityIDSymbolMinPriceIncrementMinSizeIncrementMinAmtIncrementMinimumSizeMaximumSizeQuoteCurrencyBaseCurrencyDefaultPriceIncrementDefaultSizeIncrementPriceDisplaySpecSizeDisplaySpecNormalSizeProductTypePositionCurrencySettlementCurrencyNotionalMultiplierExpirationSizeBucketsDisplaySymbolDescription

Currency fields

TimestampCurrencyIDSymbolMinIncrementDefaultIncrementDescription

WebSocket and REST

Orders

Subscribe to ExecutionReport before sending orders. Quantities and prices should be encoded as decimal strings where precision matters.

WebSocketsendNewOrderSingle

Name	Type	Required	Description
`Symbol`	string	Yes	Currency pair, for example BTC-USD.
`ClOrdID`	string	Yes	Unique client order ID. UUID recommended.
`Side`	string	Yes	Buy or Sell.
`OrdType`	string	Yes	Market, Limit, or RFQ.
`OrderQty`	decimal string	Yes	Order quantity in units of Currency.
`Price`	decimal string	Conditional	Required for limit orders.
`Currency`	string	No	Quantity currency. Defaults to the symbol base currency.
`QuoteID`	string	Conditional	Required when trading a specific RFQ quote.
`RFQID`	string	Conditional	Required when OrdType is RFQ.
`TimeInForce`	string	Yes	GoodTillCancel, FillAndKill, or FillOrKill.
`Strategy`	string	No	Optional order strategy, including SteadyPace or StopLimit when enabled.
`AllowedSlippage`	decimal string	No	Optional absolute slippage for limit orders placed against RFQ.
`Parameters`	object	No	Optional order strategy parameters.
`TransactTime`	datetime	No	Client business timestamp in UTC.

New orderjson

{
  "reqid": 13,
  "type": "NewOrderSingle",
  "data": [
    {
      "Symbol": "BTC-USD",
      "ClOrdID": "4d489920-15da-11ec-b5e7-7f4881f01b7d",
      "Side": "Buy",
      "TransactTime": "2021-09-15T04:06:28.530000Z",
      "OrderQty": "0.5",
      "OrdType": "Limit",
      "Price": "43000",
      "Currency": "BTC",
      "TimeInForce": "GoodTillCancel",
      "Strategy": "Limit",
      "Parameters": {
        "ErrorAction": "Pause"
      }
    }
  ]
}

Order commands

OrderCancelRequest	Cancel an open order.
OrderCancelReplaceRequest	Modify an open order.
OrderControlRequest	Pause or resume an open order where enabled.

WebSocket and REST

RFQ and post trade

Subscribe to trade and RFQ streams for quote lifecycle, accepted quote execution, and post-trade updates. Balance and user administration streams may require account-specific permissions.

Quote	Subscribe to available RFQ quote updates.
QuoteRequest	Request a quote for an eligible market.
QuoteCancelRequest	Cancel an active quote request.
ExecutionReport	Receive execution updates when an accepted quote trades.

Strategy orders, withdrawal commands, Balance, Exposure, BalanceTransaction, User, and UserConfig should be enabled only when confirmed for the client account.

WebSocket and REST

REST OHLCV

Use REST for historical OHLCV candles by symbol and resolution.

RESTGET/v1/symbols/<symbol>/ohlcv/<resolution>

OHLCV requesttext

GET /v1/symbols/<symbol>/ohlcv/<resolution>

GET /v1/symbols/BTC-USD/ohlcv/1h

FIX API

FIX overview

The Secure Digital FIX API uses FIX 4.4 for market data subscriptions and order execution. SDM acts as the FIX acceptor for client sessions.

Hostname	Provided by SDM.
Port	Provided by SDM.
SenderCompID	Provided by SDM.
TargetCompID	Provided by SDM.
Session window	Provided by SDM.
API key and secret	Issued separately for each environment.

A typical setup uses one market data session with recovery disabled and one order submission session with recovery enabled.

FIX API

FIX logon

Authenticate with a FIX Logon(35=A). Put the Base64 URL-safe signature in RawData(96) and the API key in Password(554).

Name	Type	Required	Description
`35`	MsgType	Yes	A for Logon.
`108`	HeartBtInt	Yes	Heartbeat interval.
`141`	ResetSeqNumFlag	No	Reset sequence numbers.
`95`	RawDataLength	Yes	Signature length.
`96`	RawData	Yes	HMAC SHA-256 signature.
`554`	Password	Yes	API key.

Signature stringtext

SendingTime(52)
ASCII 01
MsgSeqNum(34)
ASCII 01
SenderCompID(49)
ASCII 01
TargetCompID(56)

Logon exampletext

8=FIX.4.4^A9=143^A35=A^A34=1^A49=CUSTOMER^A52=20220915-18:29:58.756^A56=Secure Digital^A95=44^A96=<signature>^A98=0^A108=300000^A141=Y^A554=<api-key>^A10=248^A

FIX API

FIX market data

After logon, send MarketDataRequest(35=V) to subscribe to snapshots. Specify exactly one of MarketDepth(264) or NoSizeBucketsSegments(20020).

FIX35=VMarketDataRequest

Name	Type	Required	Description
`262`	MDReqID	Yes	Unique market data request ID.
`263`	SubscriptionRequestType	Yes	0 snapshot, 1 subscribe, or 2 unsubscribe.
`264`	MarketDepth	Conditional	Full book, top of book, or depth level.
`1070`	MDQuoteType	No	0 indicative or 1 tradeable.
`20020`	NoSizeBucketsSegments	Conditional	Aggregated size buckets.
`55`	Symbol	Yes	Currency pair, for example BTC-USD.

FIX API

FIX orders

Submit market or limit orders with NewOrderSingle(35=D). Open FIX orders are canceled on disconnect by default unless CancelOnDisconnect=N is configured for the order.

FIX35=DNewOrderSingle

Name	Type	Required	Description
`1`	Account	Conditional	Required when multiple accounts are enabled.
`11`	ClOrdID	Yes	Client order ID, max 36 characters. UUID recommended.
`55`	Symbol	Yes	Currency pair.
`54`	Side	Yes	1 buy or 2 sell.
`40`	OrdType	Yes	1 market, 2 limit, or A limit all-in.
`38`	OrderQty	Yes	Order quantity.
`15`	Currency	No	Quantity currency. Defaults to base currency.
`44`	Price	Conditional	Required for limit orders.
`59`	TimeInForce	Yes	1 GTC, 3 IOC, or 4 FOK.
`60`	TransactTime	Yes	Business timestamp.
`126`	ExpireTime	No	Optional expiration time for GTC orders.
`168`	EffectiveTime	No	Optional activation time for staged orders.
`847`	TargetStrategy	No	Order strategy type, for example StopLimit.
`957`	NoStrategyParams	No	Number of strategy parameter groups.
`958`	StrategyParameterName	No	Strategy parameter name.
`960`	StrategyParameterValue	No	Strategy parameter value.
`20030`	CancelOnDisconnect	No	Y or N. Defaults to Y.

Cancel, replace, and reports

OrderCancelRequest (F)	Cancel an existing order.
OrderCancelReplaceRequest (G)	Amend price, quantity, or market.
OrderCancelReject (9)	Reject invalid cancel or replace requests.
ExecutionReport (8)	Acknowledge, reject, update status, or report fills.

FIX API

FIX sessions

FIX sessions support standard session-level messages, optional recovery, drop copy, and Security List messages for instrument validation.

Logon (A)	Authenticate and start a session.
Heartbeat (0)	Keep the session alive.
Test Request (1)	Request heartbeat proof.
Resend Request (2)	Request a missing sequence range.
Reject (3)	Reject malformed or session-level messages.
Sequence Reset (4)	Gap fill or reset sequence state.
Logout (5)	End the session.

Operate

Troubleshooting

Most integration failures come from signature construction, clock drift, permissions, or invalid symbols.

Authentication fails	Check key, secret, host, path, and timestamp drift.
Signature invalid	Check newline order, query/body inclusion, Base64 URL encoding, and UTC time.
No response after subscribe	Check stream name and required stream parameters.
Order rejected	Check symbol, side, quantity increment, price, and time-in-force.
Sequence errors	Check FIX recovery settings and expected sequence numbers.

Operate

Reliability and errors

Treat retry behavior as part of the integration contract. Preserve IDs for reconciliation, retry only transient failures, and avoid logging secrets while keeping enough request context for support.

Retry policy	Use bounded exponential backoff for transient network, rate limit, and unavailable responses.
Duplicate prevention	Keep client request IDs and order IDs stable when retrying so downstream reconciliation is deterministic.
WebSocket recovery	Reconnect, re-authenticate, resubscribe, and reconcile by request ID, sequence, and timestamp after a disconnect.
FIX recovery	Use the agreed session recovery settings, process Resend Request and Sequence Reset messages, and reconcile with ExecutionReport.
Operational logs	Log request ID, environment, host, path, timestamp, and response code without recording API secrets.

Before production, confirm any client-specific rate limits, FIX recovery rules, and retry windows with the SDM onboarding team.

Operate

Onboarding checklist

Complete these steps before moving an integration into production.

API key and API secret issued.
Sandbox or production environment confirmed.
Hostname, port, path, SenderCompID, and TargetCompID confirmed where applicable.
IP allowlist completed if required.
Client clock sync confirmed.
First authentication test completed.
First market data subscription completed.
Order or RFQ permissions confirmed before live order testing.

Operate

Changelog

Version notes consolidated from the WebSocket/REST and FIX source documents.

Trading API 1.4.0	Legacy note: added REST OHLCV endpoint.
Trading API 1.3.0	Legacy note: added BalanceTransaction and NewWithdrawRequest.
Trading API 1.2.0	Legacy note: changed selected transaction timestamp fields.
Trading API 1.1.0	Legacy note: changed MaximumSize for Security to optional.
FIX API 2.50	Legacy note: added description for order strategies.