# HTTP — overview

HTTP endpoints use the standard REST envelope:
`{ status, data, server_time_ms }`.

## Public Endpoints

These endpoints do not require an API key:

| Endpoint | Description |
| -------- | ----------- |
| [`GET /v1/fees`](/api/fees) | Effective venue and Mosaiq fee rates loaded by Mosaiq. |
| [`GET /v1/clearinghouseState`](/api/clearinghouse-state) | Account state snapshot for a requested `user`. |
| [`GET /v1/openOrders`](/api/open-orders) | Live open-order snapshot for a requested `user`. |
| [`GET /v1/userFunding`](/api/user-funding) | Settled funding paid or received by a requested `user`. |

## Private Endpoints

Trading requests use API keys. Wallet/account management uses a Para JWT. The
first Para-auth account or funding request creates the Mosaiq account if the
wallet is approved for beta.

```http
Authorization: Bearer <your-api-key>
```

| Endpoint | Description |
| -------- | ----------- |
| [`POST /v1/exchange`](/api/exchange) | Place, modify, and cancel orders; mass cancel; create deposit requests and Para-auth withdrawals. |
| `GET /v1/apiKey` | Return active API key metadata using Para wallet auth. |
| `POST /v1/apiKey` | Create one 30-day API key using Para wallet auth. |
| `DELETE /v1/apiKey` | Revoke the active API key using Para wallet auth. |
| [`GET /v1/funding`](/api/funding) | Return recent deposit and withdrawal requests using Para wallet auth. |

## Rate Limits

All HTTP requests share a global per-client-IP budget:

| Limit | Default | Applies to |
| ----- | ------- | ---------- |
| Global HTTP requests | `600`/minute/IP | Every HTTP route, including health, docs, public reads, private exchange, WebSocket upgrades, and metrics. |

`POST /v1/exchange` also has an authenticated-user budget:

| Limit | Default | Applies to |
| ----- | ------- | ---------- |
| Exchange requests | `120`/minute/user | API-key rotations and wallet-auth funding share the user's budget. A batch of up to 20 order/cancel actions counts as one request. |

Approved high-throughput users may receive a higher exchange budget. The same
user budget applies to exchange WebSocket messages.

Rate budgets use token-bucket/GCRA admission. Capacity refills continuously
rather than resetting on wall-clock minute boundaries, so short bursts are
allowed up to the configured bucket capacity.

If you hit a limit, Mosaiq returns HTTP `429` with code `rate_limited`. Back
off before retrying. For uncertain orders, reconcile through `orderUpdates`,
`userFills`, or [`/v1/openOrders`](/api/open-orders) before sending another
exchange request.