# HTTP — overview

Production base URL: `https://production.mosaiq.0d.finance`.

Every `/v1` endpoint returns `{ status, data, server_time_ms }`. On success
`status` is `"ok"`; on a request-level failure `status` is `"error"` and
`data` is `{ code, msg }`. `POST /v1/exchange` adds `server_receive_time_ms`.
Responses are sent with `Cache-Control: no-store`.

Errors shared by every endpoint: an unknown path returns HTTP `404`
`not_found`, a wrong method `405 method_not_allowed`, a missing or
ill-typed query parameter `400 invalid_query`, and an unexpected failure
`500 internal_error`.

## Unauthenticated endpoints

| Endpoint | Description |
| -------- | ----------- |
| [`GET /v1/fees`](/api/fees) | Effective venue and Mosaiq fee rates. |
| [`GET /v1/clearinghouseState`](/api/clearinghouse-state) | Account state snapshot for a `user`. |
| [`GET /v1/openOrders`](/api/open-orders) | Live open-order snapshot for a `user`. |
| [`GET /v1/userFills`](/api/user-fills) | Confirmed fills for WebSocket gap recovery. |
| [`GET /v1/userFunding`](/api/user-funding) | Settled funding paid or received by a `user`. |

## Authenticated endpoints

Trading requests use an API key. Key management, funding status, and
withdrawals use a Para JWT. The first Para-authenticated request creates the
Mosaiq account if the wallet is allowlisted.

```http
Authorization: Bearer <api-key or para-jwt>
```

| Endpoint | Auth | Description |
| -------- | ---- | ----------- |
| [`POST /v1/exchange`](/api/exchange) | API key (Para JWT for `withdraw`, either for `deposit`) | Place, modify, cancel, mass cancel, deposit and withdrawal requests. |
| [`GET /v1/apiKey`](/api/api-key) | Para JWT | Active API key metadata. |
| [`POST /v1/apiKey`](/api/api-key) | Para JWT | Create a 30-day API key. |
| [`DELETE /v1/apiKey`](/api/api-key) | Para JWT | Revoke the active API key. |
| [`GET /v1/funding`](/api/funding) | Para JWT | Recent deposit and withdrawal requests. |

## Rate limits

| Limit | Value | Applies to |
| ----- | ----- | ---------- |
| HTTP requests | `600`/minute/IP | Every HTTP request, including WebSocket upgrades. |
| Exchange requests | `120`/minute/user | `POST /v1/exchange` and write WebSocket frames. One request or frame counts once regardless of batch size. Deposit and withdrawal actions count; `/v1/apiKey` and `/v1/funding` do not. |

Approved high-throughput users may receive a higher exchange budget. WebSocket
connection and message limits are listed on the
[user-data WebSocket](/api/websocket#rate-limits) page.

Budgets are token buckets: capacity refills continuously and a burst may spend
the whole minute's budget at once. An exceeded limit returns HTTP `429` with
code `rate_limited`.