NIOX Developer API

Introduction

The NIOX API gives you programmatic access to market data, trading, and account operations. Field names, JSON shapes, and pagination conventions match the de-facto industry standard used by major centralized exchanges so existing bot tooling (CCXT-style libraries) works without per-exchange shims.

There are three layers — explore each from the sidebar:

• Public Market Data — REST endpoints, no auth, IP-rate-limited.
• WebSocket Streams — push-style market data over a single multiplexed connection.
• Trading + Account — JWT (web UI) or HMAC-signed API key (bots). Same endpoints, two auth methods.

Base URLs

REST:

https://api.niotx.com

WebSocket (combined stream):

wss://ws.niotx.com/ws/v1/stream

Authentication

Endpoints under /api/v1/public/ need no authentication. Trading and account endpoints accept either:

• JWT — used by the web UI. Standard Authorization: Bearer <token> header.
• HMAC-signed API key — used by bots. See the next section for the full signing protocol.

When both styles are valid on the same endpoint, the API key path takes priority if the X-API-Key header is present. Otherwise the JWT path runs unchanged.

HMAC signing

Create an API key from your account page. The plaintext secret is returned exactly once at creation — store it immediately. Every signed request carries three headers:

• X-API-Key — your public key id (niox_pk_…).
• X-Timestamp — current time in ms epoch. Tolerance ±30s.
• X-Signature — hex HMAC-SHA256 of the canonical message, signed with your secret.

Canonical message

<timestamp_ms> + <METHOD> + <path> + <query_string> + sha256(body)

All concatenated as one string, no delimiters. The body hash is the hex SHA-256 of the raw request body (empty string when there's no body). Query string is the raw URL-encoded string (no leading ?).

curl example — signed GET

TS=$(date +%s000)
PATH_="/api/v1/trade/orders/open/"
MSG="${TS}GET${PATH_}"
SIG=$(printf '%s' "$MSG" | openssl dgst -sha256 -hmac "$NIOX_API_SECRET" | awk '{print $2}')

curl "https://api.niotx.com${PATH_}" \
  -H "X-API-Key: $NIOX_API_KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG"

curl example — signed POST (place LIMIT BUY)

BODY='{"symbol":"BTCUSDT","side":"BUY","type":"LIMIT","quantity":"0.001","price":"50000","timeInForce":"GTC"}'
TS=$(date +%s000)
BODY_HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 | awk '{print $2}')
MSG="${TS}POST/api/v1/trade/order${BODY_HASH}"
SIG=$(printf '%s' "$MSG" | openssl dgst -sha256 -hmac "$NIOX_API_SECRET" | awk '{print $2}')

curl -X POST https://api.niotx.com/api/v1/trade/order \
  -H "X-API-Key: $NIOX_API_KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG" \
  -H "Content-Type: application/json" \
  -d "$BODY"

Permissions are checked per request — keys with onlyread are rejected on trading endpoints, etc. Granting thewithdraw permission requires a current TOTP code in the create/update request.

Rate limits

Public market-data endpoints: 1200 req/min/IP(industry-standard default). Listing-format endpoints:60 req/min/IP. Authenticated endpoints use per-user DRF throttles.

Every public response carriesX-Used-Weight-1m and the alias X-MBX-USED-WEIGHT-1m(for CCXT-style libraries that already look for that name) — track these to pace your requests against your IP's rolling-60s weight total. Heavier endpoints cost more weight per call (ping = 1, exchangeInfo = 10, ticker/24hr all-symbols = 40).

Conventions

• All numeric values are JSON strings to preserve full decimal precision.
• Timestamps are unix milliseconds (UTC).
• Symbol format: standard endpoints use BTCUSDT (concatenated, uppercase). Listing-format endpoints use BTC_USDT (underscore-delimited).
• WebSocket subscribe payloads accept both {"action":"subscribe"} (native) AND {"method":"SUBSCRIBE"} (CCXT-style).

Ping

Connectivity check. Returns an empty object on success.

Server Time

Server's current Unix epoch time in milliseconds. Use this if your local clock drifts more than 30s from ours (HMAC signature requests will be rejected outside that window).

Response fields

Exchange Info

Exchange metadata + every active symbol with its trading filters (PRICE_FILTER, LOT_SIZE, NOTIONAL). Read this on startup; cache it for the session.

Response fields

Order Book Depth

Top-N bid/ask levels. bids are sorted highest-first, asks lowest-first. Each level is [price, quantity], both string-encoded.

Query parameters

Response fields

Recent Trades

Most recent trades (newest first). Includes the trade ID, fill price, quantity, and which side was the maker.

Query parameters

Response fields

Historical Trades (cursor)

Trade history with cursor pagination. Pass fromId to walk forward from a known ID.

Query parameters

Response fields

Klines (candles)

OHLCV candles for a symbol + interval. Returns oldest-first. Each row is the 12-element industry-standard array: [openTime, open, high, low, close, volume, closeTime, quoteVolume, trades, takerBuyBaseVolume, takerBuyQuoteVolume, ignore].

Query parameters

24h Ticker

Full 24h price/volume statistics. Returns one object when symbol is given, or an array of every active pair when omitted. Heavy endpoint when called without symbol (weight 40); prefer the WebSocket !ticker@arr stream for continuous updates.

Query parameters

Response fields

Last Price

Last trade price only. Lightest ticker endpoint. Returns one object or an array of all pairs.

Query parameters

Response fields

Book Ticker

Best bid/ask + quantity only. Use this to spot quote when you don't need the full 24h stats.

Query parameters

Response fields

Average Price

Mean trade price over the last 5 minutes. Returns 404 if no trades occurred in that window.

Query parameters

Response fields

Exchange Summary (CMC)

Per-pair summary in CoinMarketCap-compatible schema. Used by CMC's exchange-tracking integration.

Response fields

Pairs

Every active trading pair on the exchange. Used by aggregators to discover what is tradable before subscribing to ticker / orderbook / trade streams.

Response fields

Tickers

24-hour pricing and volume for every active pair. Polled by listing aggregators at ~1-minute intervals.

Response fields

Orderbook (listing format)

Top-of-book depth for a single pair. Each entry is [price, quantity], both string-encoded for full precision.

Query parameters

Response fields

Historical Trades (listing format)

Recent trades for a pair, grouped by side. trade_id is the engine execution ID, never a unix timestamp.

Query parameters

Response fields

Place Order

Place a limit, market, stop-loss, or take-profit order. Both /api/v1/trade/order (singular, for CCXT-style libraries) and /api/v1/trade/orders/ (plural, used by the web UI) route to the same handler. Accepts both industry-standard and internal field names — the endpoint normalises before validation.

Body fields

Response fields

curl

BODY='{"symbol":"BTCUSDT","side":"BUY","type":"LIMIT","quantity":"0.001","price":"50000","timeInForce":"GTC"}'
TS=$(date +%s000)
BODY_HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 | awk '{print $2}')
MSG="${TS}POST/api/v1/trade/order${BODY_HASH}"
SIG=$(printf '%s' "$MSG" | openssl dgst -sha256 -hmac "$NIOX_API_SECRET" | awk '{print $2}')

curl -X POST https://api.niotx.com/api/v1/trade/order \
  -H "X-API-Key: $NIOX_API_KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG" \
  -H "Content-Type: application/json" \
  -d "$BODY"

Cancel Order

Cancel an open order by its server-assigned ID. The singular alias /api/v1/trade/order/{order_id} resolves to the same view.

Query parameters

Response fields

Open Orders

Your currently open orders (status = new or partially_filled). Paginated.

Query parameters

Response fields

Order History

Filled, cancelled, and rejected orders. Same pagination as open orders.

Query parameters

Trade Fills

Individual fill records (one per match). Use this to compute realized P&L per trade.

Query parameters

My Profile

Your account profile: email, base currency, total balance, KYC status, 2FA status.

Response fields

Create API Key

Issue a new API key. The plaintext `secret` is returned in this response exactly once — save it immediately. After this, only the public `key` is ever returned. Granting `can_withdraw: true` requires submitting a current TOTP code in the same request.

Body fields

Response fields

List API Keys

All your API keys. Secrets are never returned — use them from your own records.

Response fields

Update API Key

Update label, IP whitelist, or permissions. Granting `can_withdraw: true` (turning it on for a key that was previously without it) requires a TOTP code.

Query parameters

Body fields

Revoke API Key

Permanently revoke a key. The deletion is immediate — any in-flight request signed with this key will start failing within seconds.

Query parameters

One WSS connection multiplexes many streams. Subscribe via JSON after connect, or pass ?streams=foo/bar in the URL for instant subscription. Up to 30 streams per connection; the server auto-closes after 24 hours (clients should reconnect).

Subscribe

{"method":"SUBSCRIBE","params":["btcusdt@trade","btcusdt@depth"],"id":1}

Unsubscribe

{"method":"UNSUBSCRIBE","params":["btcusdt@trade"],"id":2}

Connect via wscat

wscat -c "wss://ws.niotx.com/ws/v1/stream?streams=btcusdt@trade/btcusdt@depth"

Trade

Individual trades as they execute. Carries the trade ID `t` for client-side dedup. The high-water mark guarantees each trade is emitted at most once per connection.

Subscribe param

btcusdt@trade

Event fields

Example message

{
  "stream": "btcusdt@trade",
  "data": {
    "e": "trade",
    "E": 1779011120306,
    "s": "BTCUSDT",
    "t": 70141750,
    "p": "78156.03",
    "q": "0.000497",
    "T": 1779011120306,
    "m": false
  }
}

24h Ticker

Full 24h rolling ticker. Fires once per real trade (≈5/s on active pairs).

Subscribe param

btcusdt@ticker

Event fields

Example message

{"stream":"btcusdt@ticker","data":{"e":"24hrTicker","E":1779011200000,"s":"BTCUSDT","c":"78119.71","o":"78100.69","h":"78369.88","l":"77654.50","v":"94.32","q":"7367633.28","p":"19.02","P":"0.0244","b":"78097.06","a":"78143.94","n":19896}}

Mini Ticker

Lightweight 24h subset — close, open, high, low, volume. No bid/ask, no count.

Subscribe param

btcusdt@miniTicker

Event fields

Example message

{"stream":"btcusdt@miniTicker","data":{"e":"24hrMiniTicker","E":1779011200000,"s":"BTCUSDT","c":"78119.71","o":"78100.69","h":"78369.88","l":"77654.50","v":"94.32","q":"7367633.28"}}

Book Ticker

Best bid/ask + quantity only. The lightest live-quote stream.

Subscribe param

btcusdt@bookTicker

Event fields

Example message

{"stream":"btcusdt@bookTicker","data":{"e":"bookTicker","u":1779011200,"s":"BTCUSDT","b":"78097.06","B":"0.045","a":"78143.94","A":"0.038"}}

Order Book Depth (full)

Full top-20 orderbook snapshot. Optional cadence suffix: @100ms or @1000ms.

Subscribe param

btcusdt@depth

Event fields

Example message

{"stream":"btcusdt@depth","data":{"s":"BTCUSDT","bids":[["78097.06","0.04"]],"asks":[["78143.94","0.03"]],"lastUpdateId":1779011200}}

Order Book Depth (partial)

Partial-book snapshot. The server slices the full top-20 to your requested level count before sending — useful for bandwidth-sensitive clients.

Subscribe param

btcusdt@depth5

Event fields

Example message

{"stream":"btcusdt@depth5","data":{"s":"BTCUSDT","bids":[…5 levels…],"asks":[…5 levels…],"lastUpdateId":1779011200}}

Kline / Candle

Live updates for the current candle. Intervals: 1m, 5m, 15m, 30m, 1h, 4h, 1d, 1w.

Subscribe param

btcusdt@kline_1m

Event fields

Example message

{"stream":"btcusdt@kline_1m","data":{"e":"kline","E":1779011200000,"s":"BTCUSDT","k":{"t":1779011160000,"T":1779011219999,"s":"BTCUSDT","i":"1m","o":"78100","c":"78120","h":"78130","l":"78090","v":"0.5","q":"39062.5","n":3,"x":false}}}

All Tickers

Array of every pair's 24h ticker in a single message. Fires once every 5 seconds.

Subscribe param

!ticker@arr

Event fields

Example message

{"stream":"!ticker@arr","data":{"e":"allMiniTickers","E":1779011200000,"tickers":[{"s":"BTCUSDT","c":"78119.71",...},{"s":"ETHUSDT","c":"2222.47",...}]}}

All Mini Tickers

Same cadence as !ticker@arr but with the mini-ticker subset only.

Subscribe param

!miniTicker@arr

Event fields

Example message

{"stream":"!miniTicker@arr","data":{"e":"allMiniTickers","E":1779011200000,"tickers":[…]}}

Errors

Public market-data endpoints use the industry-standard{code, msg} shape with negative integer codes:

Trading endpoints use DRF's standard{error, message, details} shape on 4xx responses.