{ "info": { "_postman_id": "d6c1ffa6-1537-4a3b-9e24-12ce0938ae33", "name": "STX REST API (v1)", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "_exporter_id": "876370", "_collection_link": "https://go.postman.co/collection/876370-d6c1ffa6-1537-4a3b-9e24-12ce0938ae33?source=collection_link", "description": "Signed with an Ed25519 API key. Set stx_access_key and stx_private_key as environment variables, and server_url to https://demo.stxapp.io. Verified against demo.stxapp.io on 2026-08-24." }, "item": [ { "name": "Orders", "item": [ { "name": "Create Order", "event": [ { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "POST", "header": [ { "key": "STX-ACCESS-KEY", "value": "{{STX-ACCESS-KEY}}", "type": "text" }, { "key": "STX-ACCESS-TIMESTAMP", "value": "{{STX-ACCESS-TIMESTAMP}}", "type": "text" }, { "key": "STX-ACCESS-SIGNATURE", "value": "{{STX-ACCESS-SIGNATURE}}", "type": "text" } ], "body": { "mode": "raw", "raw": "\n\n{\n \"market_id\": \"855faa81-7115-4f4f-b492-389fbd8c1ed8\",\n \"order_type\": \"limit\",\n \"action\": \"buy\",\n \"price\": 42,\n \"quantity\": 5,\n \"expiration\": \"good_till_time\",\n \"expiration_time\": 1798761600000000\n }", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{server_url}}/api/v1/orders", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "orders" ] } }, "response": [] }, { "name": "orders", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/orders", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "orders" ] } }, "response": [] }, { "name": "get order", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/orders/1cd38a77-e171-4b21-a35a-d1daa9eee0af", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "orders", "1cd38a77-e171-4b21-a35a-d1daa9eee0af" ] } }, "response": [] }, { "name": "cancel order", "event": [ { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "DELETE", "header": [ { "key": "STX-ACCESS-KEY", "value": "{{STX-ACCESS-KEY}}", "type": "text" }, { "key": "STX-ACCESS-TIMESTAMP", "value": "{{STX-ACCESS-TIMESTAMP}}", "type": "text" }, { "key": "STX-ACCESS-SIGNATURE", "value": "{{STX-ACCESS-SIGNATURE}}", "type": "text" } ], "body": { "mode": "raw", "raw": "\n\n", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{server_url}}/api/v1/orders/cedff3c1-e1d0-45c8-b2e8-8994da88a558", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "orders", "cedff3c1-e1d0-45c8-b2e8-8994da88a558" ] } }, "response": [] }, { "name": "cancel all", "event": [ { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "DELETE", "header": [ { "key": "STX-ACCESS-KEY", "value": "{{STX-ACCESS-KEY}}", "type": "text" }, { "key": "STX-ACCESS-TIMESTAMP", "value": "{{STX-ACCESS-TIMESTAMP}}", "type": "text" }, { "key": "STX-ACCESS-SIGNATURE", "value": "{{STX-ACCESS-SIGNATURE}}", "type": "text" } ], "body": { "mode": "raw", "raw": "\n\n", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{server_url}}/api/v1/orders/all", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "orders", "all" ] } }, "response": [] }, { "name": "batch cancel orders", "event": [ { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "DELETE", "header": [ { "key": "STX-ACCESS-KEY", "value": "{{STX-ACCESS-KEY}}", "type": "text" }, { "key": "STX-ACCESS-TIMESTAMP", "value": "{{STX-ACCESS-TIMESTAMP}}", "type": "text" }, { "key": "STX-ACCESS-SIGNATURE", "value": "{{STX-ACCESS-SIGNATURE}}", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"orders\": [\n {\n \"order_id\": \"62688ded-0ddb-4eb0-ad55-1e22ee3edb6f\"\n },\n {\n \"order_id\": \"df34ae3d-d021-4b7d-8ae3-5d23198fd307\"\n },\n {\n \"order_id\": \"2ee567dd-2aa1-4945-b668-af112e61ac20\"\n }\n ]\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{server_url}}/api/v1/orders/batched", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "orders", "batched" ] } }, "response": [] } ] }, { "name": "Markets/Trades/Events", "item": [ { "name": "events", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/events?status=scheduled", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "events" ], "query": [ { "key": "status", "value": "scheduled" } ] } }, "response": [] }, { "name": "markets", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/markets?competitions=MLB,NFL&status=open&trading=true", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "markets" ], "query": [ { "key": "competitions", "value": "MLB,NFL" }, { "key": "status", "value": "open" }, { "key": "trading", "value": "true" } ] } }, "response": [] }, { "name": "trades", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [], "body": { "mode": "raw", "raw": "", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{server_url}}/api/v1/trades", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "trades" ] } }, "response": [] } ] }, { "name": "Account", "item": [ { "name": "account market stats", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "noauth" }, "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/account/market_stats", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "account", "market_stats" ] } }, "response": [] }, { "name": "Tnc accept", "request": { "method": "POST", "header": [], "body": { "mode": "raw", "raw": "{\n \"version\": \"1.0.8\",\n \"device_id\": \"postman local\",\n \"accept_terms\": true,\n \"accept_privacy\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{server_url}}/api/v1/tnc/accept", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "tnc", "accept" ] } }, "response": [] } ] }, { "name": "Portfolio", "item": [ { "name": "loyalty", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/portfolio/loyalty", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "portfolio", "loyalty" ] } }, "response": [] }, { "name": "settlements", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/portfolio/settlements", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "portfolio", "settlements" ] } }, "response": [] }, { "name": "deposits", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/portfolio/deposits", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "portfolio", "deposits" ] } }, "response": [] }, { "name": "withdrawals", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{server_url}}/api/v1/portfolio/withdrawals", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "portfolio", "withdrawals" ] } }, "response": [] } ] }, { "name": "Identity", "item": [ { "name": "me", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } }, { "listen": "test", "script": { "exec": [ "" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [], "body": { "mode": "raw", "raw": "" }, "url": { "raw": "{{server_url}}/api/v1/me", "host": [ "{{server_url}}" ], "path": [ "api", "v1", "me" ] } }, "response": [] } ] } ], "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "packages": {}, "requests": {}, "exec": [ "// ============================================================================", "// BetStack REST API \u2014 Ed25519 signing helpers (COLLECTION-level Pre-request Script)", "//", "// Paste this into the collection's (or folder's) \"Pre-request Script\" tab.", "// Postman runs collection -> folder -> request pre-request scripts in the", "// same JS context for a given send, so the `nacl` object and helper", "// functions declared here (as plain top-level vars/functions, not inside an", "// IIFE) are visible to the per-request script in", "// \"postman_request_sign_ed25519.js\" \u2014 split this way so the ~600-line", "// tweetnacl-js payload lives in one place instead of being duplicated into", "// every request's own script.", "//", "// Postman's sandbox has no Ed25519 primitive, so this inlines tweetnacl-js", "// (public domain, https://github.com/dchest/tweetnacl-js) to sign locally.", "// ============================================================================", "", "// `require` shadowed so tweetnacl's optional Node `crypto` PRNG hookup is", "// skipped (unused \u2014 Ed25519 signing here is deterministic, no randomness", "// needed) without touching any real global `require` Postman relies on.", "var module = { exports: {} };", "var require = void 0; // eslint-disable-line no-unused-vars", "", "// ---- tweetnacl-js v1.0.3 (nacl.min.js), verbatim ----", "!function(i){\"use strict\";var m=function(r,n){this.hi=0|r,this.lo=0|n},v=function(r){var n,e=new Float64Array(16);if(r)for(n=0;n>>32-n}function b(r,n){var e=255&r[n+3];return(e=(e=e<<8|255&r[n+2])<<8|255&r[n+1])<<8|255&r[n+0]}function B(r,n){var e=r[n]<<24|r[n+1]<<16|r[n+2]<<8|r[n+3],t=r[n+4]<<24|r[n+5]<<16|r[n+6]<<8|r[n+7];return new m(e,t)}function p(r,n,e){var t;for(t=0;t<4;t++)r[n+t]=255&e,e>>>=8}function S(r,n,e){r[n]=e.hi>>24&255,r[n+1]=e.hi>>16&255,r[n+2]=e.hi>>8&255,r[n+3]=255&e.hi,r[n+4]=e.lo>>24&255,r[n+5]=e.lo>>16&255,r[n+6]=e.lo>>8&255,r[n+7]=255&e.lo}function u(r,n,e,t,o){var i,a=0;for(i=0;i>>8)-1}function A(r,n,e,t){return u(r,n,e,t,16)}function _(r,n,e,t){return u(r,n,e,t,32)}function U(r,n,e,t,o){var i,a,f,u=new Uint32Array(16),c=new Uint32Array(16),w=new Uint32Array(16),y=new Uint32Array(4);for(i=0;i<4;i++)c[5*i]=b(t,4*i),c[1+i]=b(e,4*i),c[6+i]=b(n,4*i),c[11+i]=b(e,16+4*i);for(i=0;i<16;i++)w[i]=c[i];for(i=0;i<20;i++){for(a=0;a<4;a++){for(f=0;f<4;f++)y[f]=c[(5*a+4*f)%16];for(y[1]^=h(y[0]+y[3]|0,7),y[2]^=h(y[1]+y[0]|0,9),y[3]^=h(y[2]+y[1]|0,13),y[0]^=h(y[3]+y[2]|0,18),f=0;f<4;f++)u[4*a+(a+f)%4]=y[f]}for(f=0;f<16;f++)c[f]=u[f]}if(o){for(i=0;i<16;i++)c[i]=c[i]+w[i]|0;for(i=0;i<4;i++)c[5*i]=c[5*i]-b(t,4*i)|0,c[6+i]=c[6+i]-b(n,4*i)|0;for(i=0;i<4;i++)p(r,4*i,c[5*i]),p(r,16+4*i,c[6+i])}else for(i=0;i<16;i++)p(r,4*i,c[i]+w[i]|0)}function E(r,n,e,t){U(r,n,e,t,!1)}function x(r,n,e,t){return U(r,n,e,t,!0),0}var d=new Uint8Array([101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107]);function K(r,n,e,t,o,i,a){var f,u,c=new Uint8Array(16),w=new Uint8Array(64);if(!o)return 0;for(u=0;u<16;u++)c[u]=0;for(u=0;u<8;u++)c[u]=i[u];for(;64<=o;){for(E(w,c,a,d),u=0;u<64;u++)r[n+u]=(e?e[t+u]:0)^w[u];for(f=1,u=8;u<16;u++)f=f+(255&c[u])|0,c[u]=255&f,f>>>=8;o-=64,n+=64,e&&(t+=64)}if(0>>=8}var z=new Uint32Array([5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,252]);function R(r,n,e,t,o,i){var a,f,u,c,w=new Uint32Array(17),y=new Uint32Array(17),l=new Uint32Array(17),s=new Uint32Array(17),h=new Uint32Array(17);for(u=0;u<17;u++)y[u]=l[u]=0;for(u=0;u<16;u++)y[u]=i[u];for(y[3]&=15,y[4]&=252,y[7]&=15,y[8]&=252,y[11]&=15,y[12]&=252,y[15]&=15;0>>=8;for(c=c+l[16]|0,l[16]=3&c,c=5*(c>>>2)|0,u=0;u<16;u++)c=c+l[u]|0,l[u]=255&c,c>>>=8;c=c+l[16]|0,l[16]=c}for(u=0;u<17;u++)h[u]=l[u];for(k(l,z),a=0|-(l[16]>>>7),u=0;u<17;u++)l[u]^=a&(h[u]^l[u]);for(u=0;u<16;u++)s[u]=i[u+16];for(s[16]=0,k(l,s),u=0;u<16;u++)r[n+u]=l[u];return 0}function P(r,n,e,t,o,i){var a=new Uint8Array(16);return R(a,0,e,t,o,i),A(r,n,a,0)}function M(r,n,e,t,o){var i;if(e<32)return-1;for(T(r,0,n,0,e,t,o),R(r,16,r,32,e-32,r),i=0;i<16;i++)r[i]=0;return 0}function N(r,n,e,t,o){var i,a=new Uint8Array(32);if(e<32)return-1;if(L(a,0,32,t,o),0!==P(n,16,n,32,e-32,a))return-1;for(T(r,0,n,0,e,t,o),i=0;i<32;i++)r[i]=0;return 0}function O(r,n){var e;for(e=0;e<16;e++)r[e]=0|n[e]}function C(r){var n,e;for(e=0;e<16;e++)r[e]+=65536,n=Math.floor(r[e]/65536),r[(e+1)*(e<15?1:0)]+=n-1+37*(n-1)*(15===e?1:0),r[e]-=65536*n}function F(r,n,e){for(var t,o=~(e-1),i=0;i<16;i++)t=o&(r[i]^n[i]),r[i]^=t,n[i]^=t}function Z(r,n){var e,t,o,i=v(),a=v();for(e=0;e<16;e++)a[e]=n[e];for(C(a),C(a),C(a),t=0;t<2;t++){for(i[0]=a[0]-65517,e=1;e<15;e++)i[e]=a[e]-65535-(i[e-1]>>16&1),i[e-1]&=65535;i[15]=a[15]-32767-(i[14]>>16&1),o=i[15]>>16&1,i[14]&=65535,F(a,i,1-o)}for(e=0;e<16;e++)r[2*e]=255&a[e],r[2*e+1]=a[e]>>8}function G(r,n){var e=new Uint8Array(32),t=new Uint8Array(32);return Z(e,r),Z(t,n),_(e,0,t,0)}function q(r){var n=new Uint8Array(32);return Z(n,r),1&n[0]}function D(r,n){var e;for(e=0;e<16;e++)r[e]=n[2*e]+(n[2*e+1]<<8);r[15]&=32767}function I(r,n,e){var t;for(t=0;t<16;t++)r[t]=n[t]+e[t]|0}function V(r,n,e){var t;for(t=0;t<16;t++)r[t]=n[t]-e[t]|0}function X(r,n,e){var t,o,i=new Float64Array(31);for(t=0;t<31;t++)i[t]=0;for(t=0;t<16;t++)for(o=0;o<16;o++)i[t+o]+=n[t]*e[o];for(t=0;t<15;t++)i[t]+=38*i[t+16];for(t=0;t<16;t++)r[t]=i[t];C(r),C(r)}function j(r,n){X(r,n,n)}function H(r,n){var e,t=v();for(e=0;e<16;e++)t[e]=n[e];for(e=253;0<=e;e--)j(t,t),2!==e&&4!==e&&X(t,t,n);for(e=0;e<16;e++)r[e]=t[e]}function J(r,n){var e,t=v();for(e=0;e<16;e++)t[e]=n[e];for(e=250;0<=e;e--)j(t,t),1!==e&&X(t,t,n);for(e=0;e<16;e++)r[e]=t[e]}function Q(r,n,e){var t,o,i=new Uint8Array(32),a=new Float64Array(80),f=v(),u=v(),c=v(),w=v(),y=v(),l=v();for(o=0;o<31;o++)i[o]=n[o];for(i[31]=127&n[31]|64,i[0]&=248,D(a,e),o=0;o<16;o++)u[o]=a[o],w[o]=f[o]=c[o]=0;for(f[0]=w[0]=1,o=254;0<=o;--o)F(f,u,t=i[o>>>3]>>>(7&o)&1),F(c,w,t),I(y,f,c),V(f,f,c),I(c,u,w),V(u,u,w),j(w,y),j(l,f),X(f,c,f),X(c,u,y),I(y,f,c),V(f,f,c),j(u,f),V(c,w,l),X(f,c,g),I(f,f,w),X(c,c,f),X(f,w,l),X(w,u,a),j(u,y),F(f,u,t),F(c,w,t);for(o=0;o<16;o++)a[o+16]=f[o],a[o+32]=c[o],a[o+48]=u[o],a[o+64]=w[o];var s=a.subarray(32),h=a.subarray(16);return H(s,s),X(h,h,s),Z(r,h),0}function W(r,n){return Q(r,n,e)}function $(r,n){return a(n,32),W(r,n)}function rr(r,n,e){var t=new Uint8Array(32);return Q(t,e,n),x(r,o,t,d)}var nr=M,er=N;function tr(){var r,n,e,t=0,o=0,i=0,a=0,f=65535;for(e=0;e>>16,i+=(n=arguments[e].hi)&f,a+=n>>>16;return new m((i+=(o+=t>>>16)>>>16)&f|(a+=i>>>16)<<16,t&f|o<<16)}function or(r,n){return new m(r.hi>>>n,r.lo>>>n|r.hi<<32-n)}function ir(){var r,n=0,e=0;for(r=0;r>>n|r.lo<>>n|r.hi<>>n|r.hi<>>n|r.lo<>(7&o)&1),yr(n,r),yr(r,r),lr(r,n,t)}function vr(r,n){var e=[v(),v(),v(),v()];O(e[0],t),O(e[1],f),O(e[2],w),X(e[3],t,f),hr(r,e,n)}function gr(r,n,e){var t,o=new Uint8Array(64),i=[v(),v(),v(),v()];for(e||a(n,32),wr(o,n,32),o[0]&=248,o[31]&=127,o[31]|=64,vr(i,o),sr(r,i),t=0;t<32;t++)n[t+32]=r[t];return 0}var br=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]);function pr(r,n){var e,t,o,i;for(t=63;32<=t;--t){for(e=0,o=t-32,i=t-12;o>4)*br[o],e=n[o]>>8,n[o]&=255;for(o=0;o<32;o++)n[o]-=e*br[o];for(t=0;t<32;t++)n[t+1]+=n[t]>>8,r[t]=255&n[t]}function Ar(r){var n,e=new Float64Array(64);for(n=0;n<64;n++)e[n]=r[n];for(n=0;n<64;n++)r[n]=0;pr(r,e)}function _r(r,n,e,t){var o,i,a=new Uint8Array(64),f=new Uint8Array(64),u=new Uint8Array(64),c=new Float64Array(64),w=[v(),v(),v(),v()];wr(a,t,32),a[0]&=248,a[31]&=127,a[31]|=64;var y=e+64;for(o=0;o>7&&V(r[0],c,r[0]),X(r[3],r[0],r[1])}(u,t))return-1;for(o=0;o bytes (atob/btoa are provided by the pm sandbox) ----", "function base64ToBytes(b64) {", " var binary = atob(b64);", " var bytes = new Uint8Array(binary.length);", " for (var i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);", " return bytes;", "}", "", "function bytesToBase64(bytes) {", " var binary = \"\";", " for (var i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);", " return btoa(binary);", "}", "", "// UTF-8 encode without relying on TextEncoder (not guaranteed in every", "// Postman sandbox version); the signed message is always ASCII in practice", "// (digits, HTTP method, URI path/query), but this handles the general case.", "function utf8Bytes(str) {", " var bytes = [];", " for (var i = 0; i < str.length; i++) {", " var c = str.charCodeAt(i);", " if (c < 0x80) {", " bytes.push(c);", " } else if (c < 0x800) {", " bytes.push(0xc0 | (c >> 6), 0x80 | (c & 0x3f));", " } else {", " bytes.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 0x3f), 0x80 | (c & 0x3f));", " }", " }", " return new Uint8Array(bytes);", "}", "", "// Extract the raw 32-byte Ed25519 seed from either a PKCS#8 PEM (as returned", "// by BetStack.Auth.ApiKeys.generate_ed25519_pem_pair/0 \u2014 a fixed 16-byte DER", "// prefix followed by the 32-byte seed) or a bare base64 seed.", "function extractSeed(input) {", " var b64 = input.trim();", " if (b64.indexOf(\"BEGIN PRIVATE KEY\") !== -1) {", " b64 = b64", " .replace(/-----BEGIN PRIVATE KEY-----/, \"\")", " .replace(/-----END PRIVATE KEY-----/, \"\")", " .replace(/\\s+/g, \"\");", " }", " var bytes = base64ToBytes(b64);", " return bytes.length === 32 ? bytes : bytes.slice(bytes.length - 32);", "}", "", "// ============================================================================", "// BetStack REST API (/api/v1) \u2014 Ed25519 request signing (REQUEST-level Pre-request Script)", "//", "// Requires \"postman_collection_nacl_lib_ed25519.js\" to have already run as", "// the COLLECTION's (or folder's) Pre-request Script \u2014 it defines the global", "// `nacl` object and helpers (extractSeed / utf8Bytes / bytesToBase64) this", "// script uses. Populates STX-ACCESS-KEY / STX-ACCESS-TIMESTAMP /", "// STX-ACCESS-SIGNATURE per lib/bet_stack/auth/api_keys.ex", "// (BetStack.Auth.ApiKeys.verify_request/5) and docs/rest_api_conventions.md.", "//", "// Set these two variables (environment or collection) before sending:", "// stx_access_key \u2014 the key_id returned when the API key was created", "// stx_private_key \u2014 the Ed25519 private key, either as:", "// - the PKCS#8 PEM blob (\"-----BEGIN PRIVATE KEY-----...\")", "// shown once at key creation, or", "// - the raw 32-byte seed, base64-encoded", "// ============================================================================", "", "(function () {", " if (typeof nacl === \"undefined\" || typeof extractSeed === \"undefined\") {", " throw new Error(", " \"nacl signing helpers not found \u2014 paste postman_collection_nacl_lib_ed25519.js \" +", " \"into this collection's (or folder's) Pre-request Script tab first.\"", " );", " }", "", " var accessKey =", " pm.environment.get(\"stx_access_key\") || pm.collectionVariables.get(\"stx_access_key\");", " var privateKeyInput =", " pm.environment.get(\"stx_private_key\") || pm.collectionVariables.get(\"stx_private_key\");", "", " if (!accessKey || !privateKeyInput) {", " throw new Error(", " \"Set stx_access_key and stx_private_key (environment or collection variables) before sending this request.\"", " );", " }", "", " // ---- signing message: timestamp_ms <> METHOD <> path(+query) ----", " var timestamp = Date.now().toString();", " var method = pm.request.method.toUpperCase();", " var path = pm.request.url.getPathWithQuery();", " var message = timestamp + method + path;", "", " // ---- sign ----", " var seed = extractSeed(privateKeyInput);", " var keyPair = nacl.sign.keyPair.fromSeed(seed);", " var signature = nacl.sign.detached(utf8Bytes(message), keyPair.secretKey);", " var signatureB64 = bytesToBase64(signature);", "", " // ---- set the auth headers on the outgoing request ----", " pm.request.headers.upsert({ key: \"STX-ACCESS-KEY\", value: accessKey });", " pm.request.headers.upsert({ key: \"STX-ACCESS-TIMESTAMP\", value: timestamp });", " pm.request.headers.upsert({ key: \"STX-ACCESS-SIGNATURE\", value: signatureB64 });", "})();", "" ] } }, { "listen": "test", "script": { "type": "text/javascript", "packages": {}, "requests": {}, "exec": [ "" ] } } ], "variable": [ { "key": "server_url", "value": "https://demo.stxapp.io" } ] }