# Base URLs & discovery

## Environments

| Environment | Base URL |
| --- | --- |
| Production | `https://api.troncharts.xyz` |

There is no public staging host today. To rehearse against something other than
production, use a paper account on the production API — that is what the
[Sandbox](https://docs.troncharts.xyz/docs/sandbox/overview/) section is for.

White-label deployments answer on their own domain. If you are integrating
against a branded venue, use that venue's host — the API surface is identical
and the tenant is resolved from the host. See [Tenancy](https://docs.troncharts.xyz/docs/auth/tenancy/).

## The two public prefixes

- `/api/v1/*` — the versioned REST surface. Everything documented here.
- `/ws/*` — three WebSocket channels: `/ws/market`, `/ws/risk`, `/ws/quotes`.

A handful of unversioned reads (`/api/branding`, `/api/theme`, `/api/features`)
exist for front ends that render a tenant's chrome before a session exists.
They need no credential, but they are still **tenant-scoped**: a request that
resolves to no tenant gets `404 {"error":"unknown_tenant_origin"}`, so call them
from an origin registered on your tenant or send `X-Tenant-Slug`.

## Don't hardcode — discover

Which venues are wired, which order types they accept, and which symbols
trade differ per deployment and change without an API version bump. Three
endpoints tell you at runtime:

| Endpoint | Answers |
| --- | --- |
| `GET /api/v1/discovery` | A curated catalog of the most-used endpoints: bearer-mint URLs, the WS streams, and each listed endpoint's required credential tier. No auth, no tenant. |
| `GET /api/v1/venues` | Which venue adapters are enabled here, with their asset classes and supported order types. |
| `GET /api/v1/symbols/{venue}` | The tradeable symbol list for one venue. |

Discovery is hand-maintained and deliberately partial. It does not list the
scope-gated prop, firm, and tenant-config surfaces, it does not list every
route documented here (`/api/v1/venues` among them), and it reports only the
`tier` a route needs — never the `firm:operate` / `prop:manage` /
`tenant:config` scopes. For the complete surface read the
[OpenAPI spec](https://docs.troncharts.xyz/docs/reference/specs/).

```bash
curl -s https://api.troncharts.xyz/api/v1/discovery | jq '.endpoints | length'
curl -s https://api.troncharts.xyz/api/v1/venues \
  -H "authorization: Bearer $TOKEN" \
  -H "x-tenant-slug: $TC_TENANT_SLUG" | jq '.venues[].slug'
```

Building a venue picker off `/api/v1/venues` instead of a constant means a
newly enabled venue appears in your UI without a release.

## Symbol format

Symbols carry a venue suffix — `BTC.HL`, `ETH.HL`, `WINFUT.B3`. Always take
them from `GET /api/v1/symbols/{venue}` rather than constructing them; the
suffix is part of how the platform resolves pricing.