Getting Started

Authentication and request IDs

All requests using the TT REST API must include:

An Application Key in the header

x-api-key=<application key>

Additionally, most requests also require:

A Token in the header.

Authorization=Bearer <token>

A request ID passed as a query string
- requestId=<app_name>-<company_name>--<new_guid>

Note: The TT REST API documentation provides the ability to create and send
test requests. These test requests also need the above-mentioned parameters where required by the endpoint.

Application keys

Application Keys are created using the Setup application. An Application
Key is associated with the login used to create it and the key will inherit the login’s permissions and
access to data for the environment in which the key was created. Separate application keys are
required for making requests from the UAT and Live environments.

Consult the documentation for more information on the environments used by
the TT REST API as well as creating application keys.

Tokens

For all TT REST endpoints, users must obtain a token.

To request a token, you send your application key and application secret within a POST request to the ‘/token’
endpoint. Full documentation can be found at the bottom of this page.

When using the token in subsequent requests, Bearer is added to the front of the token you receive.

Note: Tokens are set to expire after a given period of time. This period of time is communicated in
the response to your token request as the “seconds_until_expiry” value. Your application will need to generate a new
token before its token expires.

Providing a Request ID

All endpoints require a query parameter named requestId. Its value must be of the form:

<app_name>-<company_name>–<new_guid>

where:

<app_name> is a user-generated string used to identify the specific application making the call.
<company_name> is a user-generated string used to identify the user’s company.
<new_guid> is the globally
unique identifier for this request. Each separate request should have a distinct identifier so that it
can be traced. GUIDs can be created
using a GUID generator.

To avoid issues when submitting your request and requestId, you must adhere to the following format
requirements:

Do not use special characters: TT strongly recommends you avoid using special characters ($ & + , / :
; = ? @ ” <> # % { } | \ ^ ~ [ ] `) when creating your requestId. These characters may
cause failures when passed to some TT backend components.
Do not include spaces: Your requestId cannot include blank spaces.
Match the case sensitivity of the requestId parameter: The request will only work if
the query parameter uses the appropriate ‘lower camelcase’ format: requestId. Alternate
case structures (e.g., requestid, requestID, or
requestiD) may result in a failed request.

Note Requests submitted without the requestId query parameter
will be rejected.

Creating a Globally Unique Identifier

To create a unique identifier, you can use an online GUID Generator like guid.one or
any other GUID generator available online.

These tools generate completely random values (e.g., 47a1e1c4-0c94-4fb3-94a9-d772382458a3) that meet
the criteria for creating a value used for identification.

Note: You must includes all characters, including hyphens, when using this value to access TT REST
API.

For additional information on GUID values, visit guid.one/guid.

Using Authentication and request IDs in test calls within documentation

The TT REST API documentation lets you make test calls for endpoints for all services. The Ledger, Monitor and Risk
services require a token for addtional authentication. The documentation simplifies the process of authorizing your
requests and for specifying a sample value for the new requestId parameter required for requests in these services.

Rather than requiring you to authorize each request individually, the documentation provides an
Authorize button that lets you enter the necessary authorization once for all calls in the service.
When you click the Authorize button, you can enter the API key and token in the dialog box, as shown.

Enter your TT REST API Application Key from Setup.
Enter “Bearer ” followed by the token (include a space, but do not include the quotes).

For any endpoint, you can click the Try it out button, populate the parameters, and execute the test
request. While using the documentation to test your requests, a sample requestId parameter, in the proper format, is
automatically populated so you need not generate a new GUID for each test request.

Note: The sample requestId is valid only for test calls made from the
documentation. When making requests from your application, you must generate a new and unique GUID for every
request.

Token Requests

To get a token, you send your application key and application secret within a POST request to generate a token.
Expand the ‘/token’ documentation below to view the required parameters for generating a token.

Before you begin

Application key usage plans and message limits

Using the TT REST API requires you to select a usage plan for the application key that can incur additional costs. TT offers the following usage plans for TT REST application keys:

For more information about the costs associated with the usage plans, contact TT Customer Success.

^* Note: You can manage users, accounts, permissions and risk through the various endpoints in the TT REST API. Due to the amount of data that can be sent in POST endpoints, the TT REST API limits their frequency to one POST request every ten seconds. Most daily maintenance and activity will not be affected by these limits and can be accomplished normally on week days.

Getting an Application Key and Application Secret

Prerequisite

Prior to creating your own application key, your company’s administrator must enable the Can create TT Rest API key setting for the user. For more information, refer to the Enabling API Key Creation section in the Setup help.

Creating an Application Key

To create an application key:

Introduction to TT REST API

The TT REST API 2.0 gives you the tools you need to leverage the power of the TT platform within your own applications. You can access the same product information services, risk management and market connectivity used by the TT platform – all through an easy-to-use REST API.

The TT REST API provide a number of resources:

Note: When submitting requests, all API urls are case sensitive and should include the endpoint name in lowercase. For example, using https://ttrestapi.trade.tt/TTUser/ext_uat_cert/ results in a 403 server error.

You must use https://ttrestapi.trade.tt/ttuser/ext_uat_cert/ in order to properly reach the API.

To view a sample application which makes use of the TT REST API, visit TT’s public Github repository.

Note: The ttledger and ttmonitor services are not intended to be used as a real-time feed since there may be delays between the time at which order and fill events occur and the time when they are available via TT REST API. Applications requiring a real-time feed should use TT .NET SDK or TT FIX.

Environments: directing your requests

TT provides two environments for use with the TT REST API, a UAT environment which is used when developing and testing your application, and a production environment. Requests to the TT REST API target the environment and requested service use the following base URL:ttrestapi.trade.tt/<service>/<environment>.

Note: To ensure proper routing of all requests, users must use an HTTP library that supports 303 redirects.

Certificate/SSL Validation

Certificate pinning, sometimes known as SSL pinning, is a process that you can use in your application to validate a remote host by associating that host directly with its X.509 certificate or public key instead of with a certificate hierarchy. The application therefore uses pinning to bypass SSL/TLS certificate chain validation.

The typical SSL validation process checks signatures throughout the certificate chain from the root certificate authority (CA) certificate through the subordinate CA certificates, if any. It also checks the certificate for the remote host at the bottom of the hierarchy. Your application can instead pin to the certificate for the remote host to say that only that certificate and not the root certificate or any other in the chain is trusted.

You can add the remote host’s certificate or public key to your application during development. Alternatively, the application can add the certificate or key when it first connects to the host.

Warning

TT does not support certificate pinning for this service.

Response Payload Sizes

In cases where the TT REST API attempts to send too much data in response to a request, users may receive a 413 (content too large) error. In such cases, users should set the Accept-Encoding parameter in the HTTP header to “gzip”. As a result, the TT REST API will compress the data before transmitting it.

Staying Current with TT REST API Releases

It is important to stay current on all of the latest changes that TT makes in the TT REST API. You can subscribe for automated email notifications when new versions of the TT REST API are released by clicking the ‘Subscribe’ button on the TT Release Notes web page. Although we strive to keep the interface completely backwards compatible in new versions, there may be instances where this is not possible and, as such, will require developers to recompile and/or make code changes.

TT REST API endpoints accessed via apigateway.trade.tt are serviced through a single instance located in the U.S. To improve resiliency, TT deployed a new version of TT REST API to multiple instances around the globe in the past year. Non-U.S. client applications communicate with a local regional instance, and automatic failover occurs if that local instance becomes unavailable. This provides improved performance along with the seamless operation of all applications.

To access this new version, clients must update the target URL of their applications from apigateway.trade.tt to https://ttrestapi.trade.tt. Clients who continue to use the legacy URL will be impacted in the event of an outage of the single U.S. instance. Furthermore, non-U.S. clients will continue to be subject to possible latency timeouts. As such, TT strongly recommends that clients migrate to the endpoints via https://ttrestapi.trade.tt to avoid business continuity issues.

Contacting TT Support

If you need help with TT REST API issues, you can submit a support ticket. To submit a support ticket, visit the TT Support Center page in the Resources section of the TT website and click OPEN A TICKET.

Migrating from TT REST 1.0 to 2.0

TT REST API 1.0 was deprecated on June 30, 2021. The following can help with migrating applications to TT REST API
2.0.

A restructuring of the original version of the TT REST API was undertaken to improve its underlying design. As a
result, a new version was created in which the names of the individual services were changed so as to differentiate it
from the original version. Furthermore, the “RISK” service offered in the original version has been split up into
several smaller services in the new version.

TT REST API Services 1.0	TT REST API Services 2.0
ttid	ttid /keyusage, /usersprovision
PDS	ttpds /currencyrates /instrument, /instrumentdata, /instruments /markets, /micodes, /mics /product, /products, /productdata, /productfamilies, /productfamily
LEDGER	ttledger /fills /orderdata, /orders /postitionmodifications, /tradingaccountfills
MONITOR	ttmonitor /adminfill, /creditutilization /position, /sod
RISK	ttsetup /commondata, /company /ordertagdefaults, /organizations /report, /ttcommondata, /connections ttuser /user, /users ttaccount /account, /accounts, /accountuser, /accountusers ttgroup /riskgroups, /usergroups

However, the new version presents an interface which closely mimics that of the original version to minimize
migration efforts. The following is a list of the changes that were made to the interface which may impact your
application. Fields and endpoints that are marked as deprecated will remain in the new version until the original
version is no longer available.

NOTE: As a product, TT REST API 1.0 will be deprecated on June 30, 2021. Until then, TT REST API 1.0
will remain a fully supported production product, however, no additional enhancements will be made to it.

Key to Interface Changes

The tables below use the following colors to represent each interface change impact:

The highlighted changes have a high impact to the interface. These
changes require most users to modify their code to reflect the change.
The highlighted changes have a medium impact to the interface. These
changes may impact fewer users but require all users to verify their code can adapt to the change.
The highlighted changes have a low impact to the interface. These
changes impact the fewer number of users. All users should verify their code can adapt to the change.

Interface Changes – ttid

No interface changes.

Interface Changes – PDS

Note: For the TT REST API 2.0, the PDS endpoint (ttpds) now requires a user generated token. For more
information on tokens, refer to the Tokens section the help.

ttpds

ttpds – GET

Method	Endpoint	Changes
GET	/currencyrates	The currency_rate object is returned when only one rate is requested. The currency_rates array is returned when more than one rate is requested.
GET	/instruments	Changed the type of the lastPage field from a boolean to a string.

Interface Changes – Ledger

TTLEDGER

TTLEDGER – GET

Method	Endpoint	Changes
GET	/fills	Changed the type of the aggressorIndicator and externallyCreated fields from a string to a boolean. Changed the type of the exchLeavesQty from a string to a number.
GET	/tradingaccountfills	Changed the type of the aggressorIndicator and externallyCreated fields from a string to a boolean. Changed the type of the exchLeavesQty from a string to a number.

Interface Changes – Monitor

TTMONITOR

TTMONITOR – GET

Method	Endpoint	Changes
GET	/position	Changed the type of the lastPage field from a boolean to a string. Deprecated the productPosition query parameter and replaced with two new endpoints called: /productposition and /productposition/{accountId}.

Interface Changes – Risk

TTSETUP

TTSETUP – GET

Method	Endpoint	Changes
GET	/commondata	Deprecated the /commondata endpoint and replaced with a new endpoint called /ttcommondata.
GET	/ordertagdefaults/fields	The value of the lastPage field was changed from True to true.

TTSETUP – POST

Method	Endpoint	Changes
POST	/company/productmargin	Deprecated the /company/productmargin endpoint and replaced with a new endpoint called /company/productmargins.
POST	/ordertagdefaults/profiles	Deprecated the customerId field and replaced with a new field called profileId.

TTSETUP – DELETE

Method	Endpoint	Changes
DELETE	/company/productmargin	Deprecated the /company/productmargin endpoint and replaced with a new endpoint called /company/productmargins.

TTUSER

TTUSER – GET

Method	Endpoint	Changes
GET	/user	Changed the type of the PrimaryPhoneExt field from an integer to a string. Changed the type of the SecPhoneExt field from an integer to a string.
GET	/user/accesslines	Changed the type of the revision field from a string to an integer.
GET	/user/privatelines	Deprecated the /user/privatelines endpoint and replaced with a new endpoint called /user/accesslines.
GET	/user/{userId}	Deprecated the last_page field and replaced with a new field called lastPage. Deprecated the next_page_key field and replaced with a new field called nextPageKey.
GET	/user/{userId}/risklimits	Deprecated the /user/{userId}/risklimits endpoint and replaced with an existing endpoint called /user/{userId}/limits.
GET	/user/{userId}/marketdata	Deprecated the last_page field and replaced with a new field called lastPage.
GET	/user/{userId}/profile	Deprecated the last_page field and replaced with a new field called lastPage.

TTUSER – POST

Method	Endpoint	Changes
POST	/users/limits/contract	Deprecated the userContractRiskLimits object and replaced with a new object called contractLimits.
POST	/users/limits/ipspread	Deprecated the userIPSpreadRiskLimits object and replaced with a new object called interProductLimits.
POST	/users/limits/product	Deprecated the userProductRiskLimits object and replaced with a new object called productLimits.
POST	/users/limits/limitsettings	Deprecated the userRiskLimitSettings object and replaced with a new object called riskLimitSettings.
POST	/user/risklimit/contract	Deprecated the /user/risklimit/contract endpoint and replaced with a new endpoint called /users/limits/contract.
POST	/user/risklimit/ipspread	Deprecated the /user/risklimit/ipspread endpoint and replaced with a new endpoint called /users/limits/ipspread.
POST	/user/risklimit/product	Deprecated the /user/risklimit/product endpoint and replaced with a new endpoint called /users/limits/product. REQUEST and RESPONSE Deprecated the productLimits–>outright_rejectOrderExceedingLevelDepth field and replaced with a new field called productLimits–>rejectOrderExceedingLevelDepth. Deprecated the productLimits–>outright_marketDepthCheck field and replaced with a new field called productLimits–>marketDepthCheck. Deprecated the productLimits–>outright_maxChildSliceSize field and replaced with a new field called productLimits–>maxChildSliceSize.
POST	/user/risklimitsettings	Deprecated the /user/risklimitsettings endpoint and replaced with a new endpoint called /users/limits/limitsettings.

TTUSER – DELETE

Method	Endpoint	Changes
DELETE	/user/risklimit	Changed the deleted field to isDeleted.

TTACCOUNT

TTACCOUNT – GET

Method	Endpoint	Changes
GET	/accounts	Deprecated the parentId field and replaced with a new field called parentAccountId.
GET	/account/{accountId}	Changed the type of the riskSettings->dailyCreditLimit field from a string to a number. Removed the default value of the riskSettings->positionResetTime field and set it to 0. Removed the default value for the riskSettings->positionResetTimeZone field and set it to None.
GET	/account/{accountId}/children	The value of the lastPage field was changed from True to true. Deprecated the parentId field and replaced with a new field called parentAccountId.
GET	/account/{accountId}/limits	Deprecated the productLimits–>outright_rejectOrderExceedingLevelDepth field and replaced with a new field called productLimits–>rejectOrderExceedingLevelDepth. Deprecated the productLimits–>outright_marketDepthCheck field and replaced with a new field called productLimits–>marketDepthCheck. Deprecated the productLimits–>outright_maxChildSliceSize field and replaced with a new field called productLimits–>maxChildSliceSize.
GET	/account/{accountId}/risksettings	Changed the type of the riskSettings->dailyCreditLimit field from a string to a number. Removed the default value of the riskSettings->positionResetTime field and set it to 0. Removed the default value of the riskSettings->positionResetTimeZone field and set it to None.
GET	/accountuser	Changed the name of the LastPage variable to lastPage.

TTACCOUNT – POST

Method	Endpoint	Changes
POST	/accounts/risklimits/contract	Deprecated the /accounts/risklimits/contract endpoint and replaced with a new endpoint called /account/limits/contract.
POST	/accounts/risklimits/ipspread	Deprecated the /accounts/risklimits/ipspread endpoint and replaced with a new endpoint called /account/limits/ipspread.
POST	/accounts/risklimits/product	Deprecated the /accounts/risklimits/product endpoint and replaced with a new endpoint called /account/limits/product.
POST	/accounts/limits/contract	Deprecated the accountContractRiskLimits field and replaced with a new field called contractLimits.
POST	/accounts/limits/ipspread	Deprecated the accountIPSpreadRiskLimits field and replaced with a new field called interProductLimits.
POST	/accounts/limits/product	Deprecated the accountProductRiskLimits field and replaced with a new field called productLimits.
POST	/accounts/limits/limitsettings	Deprecated the accountRiskLimitSettings field and replaced with a new field called riskLimitSettings.
POST	/account/risklimit/contract	(RESPONSE) Removed the trailing space in the outright_priceDriftCheckIntervalLifetimePct field. Deprecated the /account/risklimit/contract endpoint and replaced with a new endpoint called /accounts/limits/contract.
POST	/account/risklimit/ipspread	Deprecated the /account/risklimit/ipspread endpoint and replaced with a new endpoint called /accounts/limits/ipspread.
POST	/account/risklimit/product	Deprecated the /account/risklimit/product endpoint and replaced with a new endpoint called /accounts/limits/product. Deprecated the productLimits–>outright_rejectOrderExceedingLevelDepth field and replaced with a new field called productLimits–>rejectOrderExceedingLevelDepth. Deprecated the productLimits–>outright_marketDepthCheck field and replaced with a new field called productLimits–>marketDepthCheck. Deprecated the productLimits–>outright_maxChildSliceSize field and replaced with a new field called productLimits–>maxChildSliceSize.
POST	/account/risklimitsettings	Deprecated the /account/risklimitsettings endpoint and replaced with a new endpoint called /accounts/limits/limitsettings.
POST	/account/risksettings	(REQUEST) Changed the type of the riskSettings->dailyCreditLimit field from a string to a number. (RESPONSE) Changed type of the riskSettings->dailyCreditLimit field from a string to a number. (RESPONSE) Removed the default value of the riskSettings->positionResetTime field and set it to 0. (RESPONSE) Removed the default value of the riskSettings->positionResetTimeZone field and set it to None.
POST	/accountuser	Deprecated the /accountuser endpoint and replaced with a new endpoint called /accountusers.

TTACCOUNT – DELETE

Method	Endpoint	Changes
DELETE	/account/{accountId}	Changed the type of the isDeleted field from an integer to a boolean.
DELETE	/account/risklimit	Changed the deleted field to isDeleted.
DELETE	/accountuser/{Id}	(RESPONSE) Changed the name of the account field to accountuser.

TTGROUP

TTGROUP – GET

Method	Endpoint	Changes
GET	/riskgroups	Removed the productLimits->environment field. Changed the type of the riskSettings->dailyCreditLimit field from a string to a number.
GET	/riskgroups/{riskgroupid}/limits	Removed the productLimits->environment field. Changed the type of the riskSettings->dailyCreditLimit field from a string to a number. Removed the empty string default value for the interProductLimits->productid field. Removed the empty string default value from the contractLimits->instrumentMaturity field. Changed the type of the contractLimits->instrumentMaturity field from an integer to a string.
GET	/usergroups/{userGroupId}	Removed the privateLines and settings objects.
GET	/usergroups/{userGroupId}/connectivity	Removed the /usergroups/{userGroupId}/connectivity endpoint.
GET	/usergroups/{userGroupId}/settings	Removed the /usergroups/{userGroupId}/settings endpoint.

TTGROUP – POST

Method	Endpoint	Changes
POST	/riskgroups/riskgrouprisklimits/contract	Deprecated the /riskgroups/riskgrouprisklimits/contract endpoint and replaced with a new endpoint called /riskgroups/limits/contract.
POST	/riskgroups/riskgrouprisklimits/ipspread	Deprecated the /riskgroups/riskgrouprisklimits/ipspread endpoint and replaced with a new endpoint called /riskgroups/limits/ipspread.
POST	/riskgroups/riskgrouprisklimits/product	(REQUEST) Changed the type of the riskSettings->dailyCreditLimit field from a string to a number. (REQUEST) Changed the type of the contractLimits->instrumentMaturity field from an integer to a string. (RESPONSE) Changed the type of the riskSettings->dailyCreditLimit field from a string to a number. (RESPONSE) Changed the type of the contractLimits->instrumentMaturity field from an integer to a string. (RESPONSE) Changed the type of the contractLimits->instrumentMaturity field from an integer to a string. Deprecated the /riskgroups/riskgrouprisklimits/product endpoint and replaced with a new endpoint called /riskgroups/limits/product.
POST	/riskgroups/riskgrouprisklimitsettings	Deprecated the /riskgroups/riskgrouprisklimitsettings endpoint and replaced with a new endpoint called /riskgroups/limits/limitsettings.
POST	/usergroups/connectivity/privatelines	Removed the /usergroups/connectivity/privatelines endpoint.
POST	/usergroups/connectivity/settings	Removed the /usergroups/connectivity/settings endpoint.

TTGROUP – DELETE

Method	Endpoint	Changes
DELETE	/riskgroups/{riskgroupid}	Changed the type of the isDeleted field from an integer to a boolean.
DELETE	/riskgroups/riskgroupaccounts	Changed the type of the isDeleted field from an integer to a boolean.
DELETE	/riskgroups/riskgrouprisklimits	Changed the isDeleted field from integer to boolean.
DELETE	/usergroups/connectivity/privatelines	Removed the /usergroups/connectivity/privatelines endpoint.
DELETE	/usergroups/users/{userId}	Deprecated the /usergroups/users/{userId} endpoint and replaced with a new endpoint called /usergroups/users.

テーマ

言語

文字サイズ

行間

読みやすさ

文字間隔

画像ズーム

Authentication and request IDs

Authentication and request IDs

Application keys

Tokens

Providing a Request ID

Creating a Globally Unique Identifier

Using Authentication and request IDs in test calls within documentation

Token Requests

Before you begin

Application key usage plans and message limits

Getting an Application Key and Application Secret

Prerequisite

Creating an Application Key

Introduction to TT REST API

Environments: directing your requests

Certificate/SSL Validation

Response Payload Sizes

Staying Current with TT REST API Releases

Contacting TT Support

Migrating from TT REST 1.0 to 2.0

Key to Interface Changes

Interface Changes – ttid

Interface Changes – PDS

ttpds

ttpds – GET

Interface Changes – Ledger

TTLEDGER

TTLEDGER – GET

Interface Changes – Monitor

TTMONITOR

TTMONITOR – GET

Interface Changes – Risk

TTSETUP

TTSETUP – GET

TTSETUP – POST

TTSETUP – DELETE

TTUSER

TTUSER – GET

TTUSER – POST

TTUSER – DELETE

TTACCOUNT

TTACCOUNT – GET

TTACCOUNT – POST

TTACCOUNT – DELETE

TTGROUP

TTGROUP – GET

TTGROUP – POST

TTGROUP – DELETE