Base URLs & discovery

Environments

Environment	Base URL
Production	https://api.troncharts.xyz

There is no public staging host today. To rehearse against something other than production, use a paper account on the production API — that is what the Sandbox section is for.

White-label deployments answer on their own domain. If you are integrating against a branded venue, use that venue’s host — the API surface is identical and the tenant is resolved from the host. See Tenancy.

The two public prefixes

• /api/v1/* — the versioned REST surface. Everything documented here.
• /ws/* — three WebSocket channels: /ws/market, /ws/risk, /ws/quotes.

A handful of unversioned reads (/api/branding, /api/theme, /api/features) exist for front ends that render a tenant’s chrome before a session exists. They need no credential, but they are still tenant-scoped, and with no credential there is nothing to read the tenant from: call them from an origin registered on your tenant or send X-Tenant-Slug, or a request that resolves to no tenant gets 404 {"error":"unknown_tenant_origin"}. Send a valid bearer and they read your credential’s tenant like everything else.

Don’t hardcode — discover

Which venues are wired, which order types they accept, and which symbols trade differ per deployment and change without an API version bump. Three endpoints tell you at runtime:

Endpoint	Answers
GET /api/v1/discovery	A curated catalog of the most-used endpoints with the credential tier each needs, plus bearer-mint URLs and the /ws/risk and /ws/market streams. No auth, no tenant.
GET /api/v1/venues	Which venue adapters are enabled here, with their asset classes and supported order types.
GET /api/v1/symbols/{venue}	The tradeable symbol list for one venue.

Discovery is hand-maintained and deliberately partial — the catalog is a decision, not an index. It does not list every route documented here (/api/v1/venues among them), and its streams array names only /ws/risk and /ws/market, not /ws/quotes.

It does carry a scope field, on the entries that need firm:operate:

{ "path": "/api/v1/firms", "methods": ["GET"], "summary": "List prop firms",
  "tier": "readonly", "scope": "firm:operate" }

No entry carries prop:manage or tenant:config, and nothing in the catalog describes your credential — it describes endpoints. For the complete surface read the OpenAPI spec; to confirm a scope you hold, call an endpoint it gates and read the 403.

curl -s https://api.troncharts.xyz/api/v1/discovery | jq '.endpoints | length'
curl -s https://api.troncharts.xyz/api/v1/venues \
  -H "authorization: Bearer $TOKEN" \
  -H "x-tenant-slug: $TC_TENANT_SLUG" | jq '.venues[].slug'

Building a venue picker off /api/v1/venues instead of a constant means a newly enabled venue appears in your UI without a release.

Symbol format

Symbols carry a venue suffix — BTC.HL, ETH.HL, WINFUT.B3. Always take them from GET /api/v1/symbols/{venue} rather than constructing them; the suffix is part of how the platform resolves pricing.