REST API

• Send a User-Agent. REST requests and WebSocket handshakes without a User-Agent header are refused with 403. Most HTTP libraries send one already; some WebSocket clients, such as Node's ws, do not unless you set it. See Authentication.

Combos (preview)

Combos, one contract across several markets priced by request for quote, are documented as an early look so you can plan for them. They are not available to try yet, and the protocol may change before release. See Combos and the combo negotiation channel.

Python SDK 0.6.0

The Python SDK is on PyPI. Trade on STX from Python with typed methods instead of hand-built, hand-signed requests.

pip install stx-python

• A blocking client, STX, and an asyncio client, AsyncSTX, with a method for every REST route.
• Requests and the WebSocket handshake are signed with your API key. There is no login call and no session to refresh.
• Stream order books, trades and your own orders, fills, positions and balance on one connection that keeps itself alive and reconnects for you.
• Walk long lists without handling pages yourself, with iter_markets(), iter_orders() and the rest.
• Every response is a typed model, and money and quantities arrive as strings exactly as the API sends them, never floats.
• Retries are safe: an order is never sent twice after an uncertain failure.
• Pick an exchange by name, such as region="us", env="demo", or set your key once in a credentials profile.

Start with the Python SDK guide. Runnable examples are in stx-python-demo.

TypeScript SDK 0.6.3

The TypeScript SDK is on npm. Trade on STX from Node.js with typed methods instead of hand-built, hand-signed requests.

npm install @stxapp/stx-typescript

• Read markets and your account, and place and cancel orders, with every response typed in your editor.
• Stream order books, trades and your own orders, fills, balance and positions. The SDK signs the connection, keeps it alive and reconnects for you.
• Keep one live, always current view of your account with accountView().
• Walk long lists without handling pages yourself, with iterMarkets(), iterOrders() and the rest.
• Retries are safe: an order is never sent twice after an uncertain failure.
• Set your key once, in environment variables or a credentials profile, and switch between the US and Ontario exchanges with one option.

Start with the TypeScript SDK guide.

Since 0.6.0:

• balance(), positions() and placeOrders() work on every STX exchange, with the same results everywhere.
• placeOrders() checks the whole list before placing any order: an over-long list or a malformed order is refused with nothing placed.

REST API

• GET /api/v1/positions returns your open positions, largest first. It is the same body the positions:{user_id} channel sends on join, so one REST read can seed the state that channel then keeps current. See List open positions.
• GET /api/v1/fills takes order_ids and returns only the fills those orders produced. It combines with market_ids and status. See List fills.
• Name your client. Send a User-Agent such as acme-mm/1.4 (python/3.13) on REST calls and the WebSocket handshake. It is optional and never rejected, and it lets us find your calls when you report something. See Identify your client.

WebSockets

• order_slip:{user_id} costs an order before you place it: risk, fee, and how much would fill at once and at which prices, pushed again whenever the book moves. Nothing is placed. It replaces betslip:{user_id}, which still works but sends money rounded to two decimals; moving is a topic change plus parsing money and quantities as decimal strings. See Order slip.
• events carries traded volume per event, one number across every market on it. No authentication. See Events.

OAuth for apps

Apps can act for STX members with their consent: the authorization code flow with PKCE, tokens limited to the scopes the member approved, and a member can disconnect at any time. See ISV.

dotnet add package STX.Sdk

C# SDK 1.6.0

API keys. Authenticate with an Ed25519 API key, signed per request. No login call, no token expiry, no refresh cycle. Email and password authentication continues to work exactly as it does today.

services.ConfigureSTXServices(
    STXEnvironment.OntarioDemo,
    STXApiKeyCredentials.FromPemFile(keyId, "~/.stx/ontario.pem"));

See Request signing for creating a key and choosing its scope.

Named environments. Supply credentials, not URLs.

• STXEnvironment.OntarioDemo, USDemo, OntarioProduction
• STXEnvironment.Custom(...) for anything else; passing URLs directly still works
• These resolve to demo.stxapp.ca, demo.stxapp.io and stxapp.ca, which may differ from the host your integration uses today. Check firewall and allowlist rules before switching

Identity. STXIdentityService.GetMeAsync() returns your user id, account id and scope. Call it once at startup before joining any user-scoped channel: channel topics are keyed on the user id, and an API key has no login response to carry it.

.NET 10. A net10.0 build ships alongside net8.0. A .NET 8 or 9 app resolves the net8.0 build as before; nothing needs to change.

Debug symbols are embedded, so SDK frames in stack traces carry file names and line numbers.

Reliability

• A failed token refresh no longer stops the host process. It is reported through the session message callback instead
• Login and token refresh are retried; previously they were the only calls with no retry
• Retries exclude credential errors, 401, 403 and 429. HTTP 404 is retried, since that is what an ingress returns mid-deployment
• Failures preserve the cause as InnerException instead of a bare "Request Failed"

Removed. STXProfileService and STXUserProfile. Use STXIdentityService and STXIdentity.

C# SDK 1.6.1

• STXTrade.Action no longer throws when serialised with System.Text.Json, which affected ASP.NET endpoints returning trade history
• If you installed 1.6.0 in the days before this announcement, the identity types were named STXViewerService and STXViewer in that build. They are STXIdentityService and STXIdentity from 1.6.1 onwards; GetMeAsync() is unchanged

Money and quantities are now strings. Responses carry money as a dollar amount and quantities as decimals, both as strings.

To port, divide by 100 any money field you were reading or sending as a whole number of cents. These fields on GET /api/v1/markets were already in dollars and keep their value: price, bids[].price, offers[].price and recent_trades[].price. Parse money with a decimal type rather than a float.

Placing orders. Send price in quotes to POST /api/v1/orders, for example "price": "0.49". A price sent without quotes, such as 49 or 0.49, is rejected with a 400.

Use total_fee for a trade's fee. It is the full fee for the trade.

New WebSocket topics. The new account topics carry the same events as before, with money and quantities as strings like REST:

Also new:

• account:{user_id} carries all of the above on one topic.
• orderbook, ticker and trades carry public market data for any set of markets on a single join.

See WebSocket channels.

Effective 2026-09-16

Prices have at most two decimal places. "0.49" and "0.4900" are accepted; "0.495" is rejected with a 400.

quantity must be in quotes too. Send "quantity": "10"; a quantity sent without quotes, such as 10, is rejected with a 400.

GET /api/v1/trades is now GET /api/v1/fills. Results are under fills instead of trades, and the row fields keep their names (trade_id, trade_fee). The old path returns 404.

New REST endpoints: GET /api/v1/portfolio/fees and GET /api/v1/portfolio/adjustments.