HTTP API reference

Start with the endpoint-first reference. Each operation has its own page with path/query/body fields, required and nullable markers, constraints, examples and expandable response fields. The SDK method reference covers the higher-level trading, recovery and realtime helpers.

Use direct HTTP when your backend is not Node.js or you need your own transport. For Node.js, start with the SDK quickstart: it handles signing and provides optimized order routing without another service.

Connection and authentication

CRISP supplies an approved HTTPS origin, API key ID, secret and enabled features. The production origin is https://partner-api.crisp.trade; request paths start with /v1. There is no hosted test environment; live requests use production services. Never send credentials from a browser.

Every request needs these headers, including GET requests:

X-Crisp-Partner-Key: your-key-id
X-Crisp-Timestamp: fresh-ISO-8601-UTC-timestamp
X-Crisp-Nonce: new-unique-nonce-for-this-attempt
X-Crisp-Signature: base64-HMAC-of-canonical-request

These are placeholders, not usable credentials. Authentication defines the exact canonical bytes and nonce requirements. The query string is excluded from signing under the current contract; the encoded pathname is included. Mutations marked in the catalogue additionally require Idempotency-Key.

For a runnable Node.js HTTP example without the SDK, download the small signing client next to your server script:

import { createPartnerClient } from './partner-client.mjs';

const request = createPartnerClient({
  origin: process.env.CRISP_PARTNER_API_BASE_URL,
  keyId: process.env.CRISP_PARTNER_API_KEY,
  secret: process.env.CRISP_PARTNER_API_SECRET,
});
const response = await request('/v1/capabilities');
if (!response.ok) throw new Error(`CRISP request failed: HTTP ${response.status}`);
console.log(response.payload.data);

This small client is a signing example, not the SDK: it does not validate typed operations, route directly to execution cells, poll or automatically retry.

SDK input versus HTTP request

Prefer named SDK methods: crisp.getFunding(userId, { details: 'trading' }) maps to GET /v1/accounts/{externalUserId}/wallet/funding?details=trading. Arguments replace the low-level path/query/body wrapper. The following mapping applies when using the compatible generic call() interface:

The SDK operation name is the OpenAPI operationId. Every public HTTP operation is available as a named SDK method and through crisp.call. Named placeOrder and the order helpers additionally select optimized execution routing. Plain HTTP POST /orders is fully supported and uses the same durable intent and execution architecture.

Find an endpoint

Download OpenAPI 3.1 for tooling and artifact hashes to verify downloads. Generated schemas are not request examples: send the JSON fields described by the schema, not the schema itself. Admin and dashboard-session routes are intentionally excluded.

Response and recovery contract

Success bodies contain { data, requestId }; some reads also include asOf and freshness. Errors contain { error: { code, message, requestId } }. A successful HTTP response is not proof of a fill or payout. See lifecycles.

Use bounded retries for transient reads and honor Retry-After. For writes, persist the original intent; a timeout or 5xx can leave the outcome unknown. Read operation recovery before adding automatic retries. Do not generate a new idempotency key merely because the first response was lost.