Skip to main content

Recent Changes

This page summarizes recent updates to the WebSocket API. For full details, please refer to the relevant channel documentation.

2026-09-01 — Authentication & WebSocket updates​

What changed?

  • HMAC Authentication — Error Responses No Longer Return the Expected Signature
    • Authentication-failure responses for signed requests no longer include the server-computed signature. If you relied on this value while debugging, compute the expected signature on the client side instead.
  • Numeric Precision on Amount Fields
    • Corrected the scale and precision handling of numeric amount fields on transaction endpoints, so values are returned and processed with the expected precision.
  • WebSocket — Funds & Transfers Events
    • Fixed WebSocket message handling for crypto withdrawal events so the correct payload is delivered for Withdrawal Confirmed (405) and Withdrawal Failed (406).

2026-08-18 — Order processing reliability & latency​

What changed?

  • Order Processing — Reliability & Latency
    • Reworked the internal order processing and trading-engine communication pipeline to improve throughput, latency, and recovery under load. There are no changes to API request or response formats.

2026-07-22 — Performance & stability improvements​

What changed?

  • Applied a series of backend performance and stability optimizations across order processing and balance calculation. These changes are internal and do not alter API request or response behavior.

2026-06-23 — Asset changes in the HFT Portal​

What's New

2026-05-05 — API key permissions, fee levels & extended trade history​

What's New

  • API Keys: New Permissions for API Keys
    • Permissions can now be set per API Key, giving you granular control over each key's access scope. All existing API Keys have been migrated to full permissions to ensure uninterrupted access. New permissions :
      • Read
      • Trade
      • Funding
    • For more information you can check our API Key Permissions article.
  • New Endpoints: FeeLevel
    • New endpoints are available to query all fee levels and your currently active fee level (auth. required) via the API.
  • Trade History: Extended Trade History
    • Trade data older than 90 days can now be retrieved via the API.
  • REST API — Orders Endpoint Performance
    • Resolved a performance issue that caused delays when fetching orders via the REST API.

2026-01-21 — WebSocket docs: Cancel All, TLS auth & rate limits​

What changed?

  • Updated Cancel All (504) documentation to reflect enhanced request options while preserving existing message codes:
    • Supports pairSymbol, pairSymbols (up to 20), denominatorSymbol (USDT or TRY) and empty {} body
    • Error examples and semantics aligned with the Cancel Request API
  • Updated WebSocket Authentication documentation with TLS connection details:
    • New secure WebSocket endpoint format: wss://<host>:8443
    • Code examples updated accordingly
  • Added a dedicated WebSocket rate limits documentation page that consolidates rate-limited commands and their per-second limits.
  • Corrected OrderBook subscription wording to clarify that order book data is delivered after the OrderBook Subscription event is subscribed and aligned related OrderBook sections.

2025-09-23 — New WebSocket messages for funds & transfers​

What changed?

  • Added server → client messages for on-chain/balance update events:
    • Withdrawal Confirmed (405): Emitted when a withdrawal is confirmed.
    • Withdrawal Failed (406): Emitted when a withdrawal is failed.
    • Deposit Confirmed (404): Emitted when a deposit is confirmed.
    • Internal Fund Transfer (403): Emitted when an internal transfer is occured.
  • See the WebSocket channel documentation for full schemas and examples.

2025-09-23 — Cancel All Orders via WebSocket​

What changed?

  • Added client → server Cancel All request message (504) with optional pairSymbol.
    • 504|{"pairSymbol":"BTCTRY"} cancels all open orders for BTCTRY.
    • 504|{} cancels all open orders.
  • Added server → client Cancel All Response message (604) returned after processing the request.
    • Returns statusCode: 202 with lists of orderIds, externalOrderIds, and the (nullable) pairSymbol.
  • pairSymbol is nullable; when omitted or {}, the operation applies account-wide.

2025-09-23 — crypto-withdrawals: updatedAt field added​

What changed?

  • Added updatedAt field to the responses of:
    • GET /v1/crypto-withdrawals
    • GET /v1/crypto-withdrawals/{id}
  • This field surfaces the server-side last update timestamp for each withdrawal object to help clients reconcile state changes more reliably.

2025-08-13 — Internal fund transfers rate limit update​

What changed?

  • The rate limit for the endpoint POST v1/internal-fund-transfers/* has been updated to 5 requests per second.

2025-08-05 — Withdrawal address creation via API​

What changed?

  • Added support for creating withdrawal addresses via the API.
  • To withdraw to these newly created addresses through the API, they must first be whitelisted via the HFT Portal.

2025-06-26 — Validation rule update: crypto-deposits & crypto-withdrawals​

What changed?
A validation rule has been updated for the following endpoints:

  • GET /v1/crypto-deposits
  • GET /v1/crypto-withdrawals

From now on, if the request does not include a txHash, both createdAtBefore and createdAtAfter parameters must be provided.

2025-04-29 — Increased rate limits for insert & cancel​

What changed?
The maximum allowed number of WebSocket requests per second for order insert and order cancel operations has been increased:

  • Insert requests: from 100 → 150 per second
  • Cancel requests: from 100 → 300 per second

This change allows clients to submit more orders and cancellations per second, improving throughput for high-frequency trading scenarios.

2025-04-29 — WebSocket authentication now optional​

What changed?
Previously, a WebSocket connection required an Authorization header. Without it, the connection would fail.

Now:

  • Clients can connect without authentication.
  • If connected without auth headers, only public messages will be sent.
  • If authenticated, the session behaves as before and receives private messages such as:
    • order updates,
    • trade messages

This change allows public consumers to connect easily without authentication overhead.

2025-04-29 — New channel: Get Open Orders (503 → 603)​

What is it?
A new request/response WebSocket channel was added to retrieve open orders, filtered by symbol and/or order status.

How to use it:
Send a message via channel 503 with optional fields:

ℹ️ The data source for this channel is in-memory. Only active, partially filled orders are kept in memory and returned.

// Fetch all Untouched orders for BTCTRY
503|{ "ps": "BTCTRY", "st": ["Untouched"] }

// Fetch both Untouched & Partial orders
503|{ "ps": "BTCTRY", "st": ["Untouched", "Partial"] }

// Fetch all orders (no filters)
503|{ "ps": null, "st": [] }

For more information, see: Private Socket Messages