← openoms

OMS API v0.1.0

Point clients at your OMS host ($OMS_URL). Mint a bearer token on the Tokens tab and send it as Authorization: Bearer $OMS_TOKEN.

Authentication
basic_auth
http · basic
Username = key_id, password = secret.
bearer_token
http · bearer
User endpoints: a trading token, `key_id.secret` (Databento-style). Admin endpoints (/admin/*): the static admin token.

admin

GET /admin/accounts
Authbearer_token
Responses
200OK
Example
curl "$OMS_URL/admin/accounts" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/accounts
Authbearer_token
Request body
broker_connection_code *
string
code *
string
external_account_ref *
string
portfolio_id
uuid
status *
string
Responses
200Created
409Already exists
Example
curl "$OMS_URL/admin/accounts" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "broker_connection_code": "",
  "code": "",
  "external_account_ref": "",
  "portfolio_id": null,
  "status": ""
}'
GET /admin/accounts/{id}
Authbearer_token
Parameters
id *
path · uuid
Account ID
Responses
200OK
404Not found
Example
curl "$OMS_URL/admin/accounts/{id}" \
  --header "Authorization: Bearer $OMS_TOKEN"
PATCH /admin/accounts/{id}
Authbearer_token
Parameters
id *
path · uuid
Account ID
Request body
broker_connection_code
string
code
string
external_account_ref
string
portfolio_id
uuid
status
string
Responses
200Updated
404Not found
Example
curl "$OMS_URL/admin/accounts/{id}" \
  -X PATCH \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "broker_connection_code": null,
  "code": null,
  "external_account_ref": null,
  "portfolio_id": null,
  "status": null
}'
GET /admin/broker-connections
Authbearer_token
Responses
200OK
Example
curl "$OMS_URL/admin/broker-connections" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/broker-connections
Authbearer_token
Request body
broker_code *
string
code *
string
environment *
string
status *
string
Responses
200Created
400Invalid environment (must be PAPER or LIVE)
409Already exists
Example
curl "$OMS_URL/admin/broker-connections" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "broker_code": "",
  "code": "",
  "environment": "",
  "status": ""
}'
GET /admin/broker-connections/{code}
Authbearer_token
Parameters
code *
path · string
Broker connection code
Responses
200OK
404Not found
Example
curl "$OMS_URL/admin/broker-connections/{code}" \
  --header "Authorization: Bearer $OMS_TOKEN"
PATCH /admin/broker-connections/{code}
Authbearer_token
Parameters
code *
path · string
Broker connection code
Request body
broker_code
string
environment
string
status
string
Responses
200Updated
400Invalid environment
404Not found
Example
curl "$OMS_URL/admin/broker-connections/{code}" \
  -X PATCH \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "broker_code": null,
  "environment": null,
  "status": null
}'
GET /admin/broker-connections/{code}/credentials

What is configured for one broker connection, with every secret withheld.

Authbearer_token
Parameters
code *
path · string
Broker connection code
Responses
200OK — configured, unconfigured, or error; never a decrypted secret
404Not found
500The credential store could not be read, or the configured master key is invalid
Example
curl "$OMS_URL/admin/broker-connections/{code}/credentials" \
  --header "Authorization: Bearer $OMS_TOKEN"
PUT /admin/broker-connections/{code}/credentials

Save (create or edit) a broker connection's credential.

Authbearer_token
Parameters
code *
path · string
Broker connection code
Request body
A submitted credential form: field name to raw string value, exactly as an HTML form or a JSON object would hand it over. Untyped on purpose — giving each broker its own typed request struct would just move the "which fields did they actually send" question from here into the handler, where the merge rule would have to be reimplemented per broker. `#[serde(flatten)]` so the wire body is the field map itself (`{"host": "...", "port": "4101"}`), not `{"fields": {...}}` — the shape the cockpit form naturally produces.
(any field name)
string value
Responses
200Saved, tested where possible, and reloaded
400The request body was malformed, or could not be parsed into a credential (unknown field, bad port, ...)
404Not found
422The credential did not authenticate; nothing was written
500The credential store could not be read, the master key is invalid or unset, or the reload failed
Example
curl "$OMS_URL/admin/broker-connections/{code}/credentials" \
  -X PUT \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "FIELD_NAME": "VALUE"
}'
DELETE /admin/broker-connections/{code}/credentials

Clear a broker connection's stored credential.

Authbearer_token
Parameters
code *
path · string
Broker connection code
Responses
200Cleared and reloaded — now unconfigured
404Not found
500The credential store could not be read, the master key is invalid, or the reload failed
Example
curl "$OMS_URL/admin/broker-connections/{code}/credentials" \
  -X DELETE \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/broker-connections/{code}/credentials/test

Test the credential already stored for a broker connection, changing

Authbearer_token
Parameters
code *
path · string
Broker connection code
Responses
200Test outcome for the stored credential
400No credential is stored for this connection
404Not found
500The credential store could not be read, or the stored credential could not be decrypted
Example
curl "$OMS_URL/admin/broker-connections/{code}/credentials/test" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/connections/reload

Re-read the credential store and apply what can be applied without a

Authbearer_token
Responses
200Per-connection reload report (codes and outcomes only — no credential material)
500The credential store could not be read, the master key is invalid, or nothing at all decrypted; nothing was changed
Example
curl "$OMS_URL/admin/connections/reload" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/feed-connections

The configured feed connections themselves (rows), distinct from

Authbearer_token
Responses
200OK
Example
curl "$OMS_URL/admin/feed-connections" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/feed-connections/{code}/credentials

What is configured for one feed connection, with every secret withheld.

Authbearer_token
Parameters
code *
path · string
Feed connection code
Responses
200OK — configured, unconfigured, or error; never a decrypted secret
404Not found
500The credential store could not be read, or the configured master key is invalid
Example
curl "$OMS_URL/admin/feed-connections/{code}/credentials" \
  --header "Authorization: Bearer $OMS_TOKEN"
PUT /admin/feed-connections/{code}/credentials

Save (create or edit) a feed connection's credential. See

Authbearer_token
Parameters
code *
path · string
Feed connection code
Request body
A submitted credential form: field name to raw string value, exactly as an HTML form or a JSON object would hand it over. Untyped on purpose — giving each broker its own typed request struct would just move the "which fields did they actually send" question from here into the handler, where the merge rule would have to be reimplemented per broker. `#[serde(flatten)]` so the wire body is the field map itself (`{"host": "...", "port": "4101"}`), not `{"fields": {...}}` — the shape the cockpit form naturally produces.
(any field name)
string value
Responses
200Saved, tested where possible, and reloaded
400The request body was malformed, or could not be parsed into a credential (unknown field, ...)
404Not found
422The credential did not authenticate; nothing was written
500The credential store could not be read, the master key is invalid or unset, or the reload failed
Example
curl "$OMS_URL/admin/feed-connections/{code}/credentials" \
  -X PUT \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "FIELD_NAME": "VALUE"
}'
DELETE /admin/feed-connections/{code}/credentials

Clear a feed connection's stored credential. See

Authbearer_token
Parameters
code *
path · string
Feed connection code
Responses
200Cleared and reloaded — now unconfigured
404Not found
500The credential store could not be read, the master key is invalid, or the reload failed
Example
curl "$OMS_URL/admin/feed-connections/{code}/credentials" \
  -X DELETE \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/feed-connections/{code}/credentials/test

Test the credential already stored for a feed connection, changing

Authbearer_token
Parameters
code *
path · string
Feed connection code
Responses
200Test outcome for the stored credential
400No credential is stored for this connection
404Not found
500The credential store could not be read, or the stored credential could not be decrypted
Example
curl "$OMS_URL/admin/feed-connections/{code}/credentials/test" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/feeds

The configured data feeds: the ranked market-data source policy plus how many

Authbearer_token
Responses
200OK
Example
curl "$OMS_URL/admin/feeds" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/instruments
Authbearer_token
Parameters
search *
path · string
limit *
path · int64
Responses
200OK
Example
curl "$OMS_URL/admin/instruments" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/instruments/expiry-sweep

Run the instrument expiry pass now, instead of waiting for the hourly tick.

Authbearer_token
Responses
200Expiry sweep summary
Example
curl "$OMS_URL/admin/instruments/expiry-sweep" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/orders
Authbearer_token
Parameters
status
query · string
portfolio_id
query · uuid
instrument_id
query · string
principal_id
query · uuid
broker_connection_code
query · string
side
query · string
since
query · date-time
until
query · date-time
limit
query · int64
offset
query · int64
client_order_id
query · string
Free-text reference set at submit time — not unique, so this can match several rows sharing one strategy's generated tag.
Responses
200OK
Example
curl "$OMS_URL/admin/orders" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/orders/{id}/events
Authbasic_authbearer_token
Parameters
id *
path · uuid
Order ID
Responses
200The order's audit trail, oldest event first
400Invalid UUID
404Order not found
Example
curl "$OMS_URL/admin/orders/{id}/events" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/portfolios
Authbearer_token
Responses
200OK
Example
curl "$OMS_URL/admin/portfolios" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/portfolios
Authbearer_token
Request body
base_currency
string
code *
string
default_account_id
uuid
name *
string
status *
string
Responses
200Created
409Already exists
Example
curl "$OMS_URL/admin/portfolios" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "base_currency": null,
  "code": "",
  "default_account_id": null,
  "name": "",
  "status": ""
}'
GET /admin/portfolios/{id}
Authbearer_token
Parameters
id *
path · uuid
Portfolio ID
Responses
200OK
404Not found
Example
curl "$OMS_URL/admin/portfolios/{id}" \
  --header "Authorization: Bearer $OMS_TOKEN"
PATCH /admin/portfolios/{id}
Authbearer_token
Parameters
id *
path · uuid
Portfolio ID
Request body
base_currency
string
code
string
default_account_id
uuid
name
string
status
string
Responses
200Updated
404Not found
Example
curl "$OMS_URL/admin/portfolios/{id}" \
  -X PATCH \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "base_currency": null,
  "code": null,
  "default_account_id": null,
  "name": null,
  "status": null
}'
GET /admin/principals
Authbearer_token
Parameters
external_subject *
path · string
Responses
200OK
Example
curl "$OMS_URL/admin/principals" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/principals
Authbearer_token
Request body
code *
string
display_name
string
external_subject
string
principal_type *
string
status *
string
Responses
200Created
409Already exists
Example
curl "$OMS_URL/admin/principals" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "code": "",
  "display_name": null,
  "external_subject": null,
  "principal_type": "",
  "status": ""
}'
GET /admin/principals/{id}
Authbearer_token
Parameters
id *
path · uuid
Principal ID
Responses
200OK
404Not found
Example
curl "$OMS_URL/admin/principals/{id}" \
  --header "Authorization: Bearer $OMS_TOKEN"
PATCH /admin/principals/{id}
Authbearer_token
Parameters
id *
path · uuid
Principal ID
Request body
code
string
display_name
string
external_subject
string
principal_type
string
status
string
Responses
200Updated
404Not found
Example
curl "$OMS_URL/admin/principals/{id}" \
  -X PATCH \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "code": null,
  "display_name": null,
  "external_subject": null,
  "principal_type": null,
  "status": null
}'
GET /admin/principals/{id}/grants
Authbearer_token
Parameters
id *
path · uuid
Principal ID
Responses
200OK
Example
curl "$OMS_URL/admin/principals/{id}/grants" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/principals/{id}/grants
Authbearer_token
Parameters
id *
path · uuid
Principal ID
Request body
can_allocate *
boolean
can_trade *
boolean
can_view *
boolean
portfolio_id *
uuid
Responses
200Created
409Grant already exists for this principal/portfolio
Example
curl "$OMS_URL/admin/principals/{id}/grants" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "can_allocate": false,
  "can_trade": false,
  "can_view": false,
  "portfolio_id": ""
}'
PATCH /admin/principals/{id}/grants/{grant_id}
Authbearer_token
Parameters
id *
path · uuid
Principal ID
grant_id *
path · uuid
Grant ID
Request body
can_allocate
boolean
can_trade
boolean
can_view
boolean
Responses
200Updated
404Not found
Example
curl "$OMS_URL/admin/principals/{id}/grants/{grant_id}" \
  -X PATCH \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "can_allocate": false,
  "can_trade": false,
  "can_view": false
}'
DELETE /admin/principals/{id}/grants/{grant_id}
Authbearer_token
Parameters
id *
path · uuid
Principal ID
grant_id *
path · uuid
Grant ID
Responses
204Deleted
404Not found
Example
curl "$OMS_URL/admin/principals/{id}/grants/{grant_id}" \
  -X DELETE \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/principals/{id}/keys
Authbearer_token
Parameters
id *
path · uuid
Principal ID
Responses
200OK
Example
curl "$OMS_URL/admin/principals/{id}/keys" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/principals/{id}/keys
Authbearer_token
Parameters
id *
path · uuid
Principal ID
Request body
name
string
Responses
200Created — plaintext secret included once
Example
curl "$OMS_URL/admin/principals/{id}/keys" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "name": null
}'
DELETE /admin/principals/{id}/keys/{key_id}
Authbearer_token
Parameters
id *
path · uuid
Principal ID
key_id *
path · string
Key ID
Responses
204Revoked
404Not found
Example
curl "$OMS_URL/admin/principals/{id}/keys/{key_id}" \
  -X DELETE \
  --header "Authorization: Bearer $OMS_TOKEN"
DELETE /admin/principals/{id}/sessions

Cut a principal off immediately: revoke every one of its live sessions.

Authbearer_token
Parameters
id *
path · uuid
Principal ID
Responses
200OK
Example
curl "$OMS_URL/admin/principals/{id}/sessions" \
  -X DELETE \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/risk-limits
Authbearer_token
Parameters
portfolio_id *
path · uuid
Responses
200OK
Example
curl "$OMS_URL/admin/risk-limits" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/risk-limits
Authbearer_token
Request body
instrument_id *
string
max_order_notional
double
max_order_quantity
double
max_position_notional
double
max_position_quantity
double
portfolio_id *
uuid
trading_state
string
Responses
200Created
400Invalid trading_state
409Limit already exists for this portfolio/instrument
Example
curl "$OMS_URL/admin/risk-limits" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "instrument_id": "",
  "max_order_notional": 0,
  "max_order_quantity": 0,
  "max_position_notional": 0,
  "max_position_quantity": 0,
  "portfolio_id": "",
  "trading_state": null
}'
GET /admin/risk-limits/{id}
Authbearer_token
Parameters
id *
path · uuid
Risk limit ID
Responses
200OK
404Not found
Example
curl "$OMS_URL/admin/risk-limits/{id}" \
  --header "Authorization: Bearer $OMS_TOKEN"
PATCH /admin/risk-limits/{id}
Authbearer_token
Parameters
id *
path · uuid
Risk limit ID
Request body
max_order_notional
double
max_order_quantity
double
max_position_notional
double
max_position_quantity
double
trading_state
string
Responses
200Updated
400Invalid trading_state
404Not found
Example
curl "$OMS_URL/admin/risk-limits/{id}" \
  -X PATCH \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "max_order_notional": 0,
  "max_order_quantity": 0,
  "max_position_notional": 0,
  "max_position_quantity": 0,
  "trading_state": null
}'
DELETE /admin/risk-limits/{id}
Authbearer_token
Parameters
id *
path · uuid
Risk limit ID
Responses
204Deleted
404Not found
Example
curl "$OMS_URL/admin/risk-limits/{id}" \
  -X DELETE \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /admin/setup-status

What is left to configure. Reuses `credentials::load_brokers`/`load_feeds`

Authbearer_token
Responses
200OK
Example
curl "$OMS_URL/admin/setup-status" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/symbology/backfill
Authbearer_token
Request body
limit
int64
Responses
200Backfill summary
Example
curl "$OMS_URL/admin/symbology/backfill" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "limit": 0
}'
POST /admin/symbology/resolve
Authbearer_token
Request body
cusip
string
exch_code
string
figi
string
isin
string
mic
string
ticker
string
Responses
200Resolution
Example
curl "$OMS_URL/admin/symbology/resolve" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "cusip": null,
  "exch_code": null,
  "figi": null,
  "isin": null,
  "mic": null,
  "ticker": null
}'
GET /admin/trading-tokens
Authbearer_token
Responses
200Active trading tokens
Example
curl "$OMS_URL/admin/trading-tokens" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /admin/trading-tokens
Authbearer_token
Request body
label
string
Human label for this key (shown in the token list). Optional.
portfolio_id
uuid
Optionally entitle the principal to trade this portfolio (adds a `can_trade` grant). Omit if the principal is already granted, or to grant separately.
principal_id *
uuid
Mint the token under this existing principal (the trader/strategy/service it belongs to). Create principals on the Principals admin surface first.
Responses
200Created — single bearer token included once
422Auto-provision needs an active broker connection
Example
curl "$OMS_URL/admin/trading-tokens" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "label": null,
  "portfolio_id": null,
  "principal_id": ""
}'
DELETE /admin/trading-tokens/{key_id}
Authbearer_token
Parameters
key_id *
path · string
Token key id
Responses
204Revoked
404Not found
Example
curl "$OMS_URL/admin/trading-tokens/{key_id}" \
  -X DELETE \
  --header "Authorization: Bearer $OMS_TOKEN"

auth

GET /auth/callback

Completes a login: validates the callback, exchanges the code, resolves

Parameters
code *
path · string
state *
path · string
error *
path · string
Responses
302Login completed; session cookie set, redirects to the validated return_to (default /)
400Malformed callback, or a missing/expired/mismatched login flow
401The provider rejected the login, or the exchanged token failed verification
403The claim gate rejected the identity, or the subject belongs to a non-human or disabled principal
502The identity provider was unreachable
Example
curl "$OMS_URL/auth/callback"
GET /auth/login

Starts a login: mints `state`/`nonce`/a PKCE verifier, remembers them in

Parameters
return_to *
path · string
Responses
302Redirects to the identity provider's authorization endpoint
Example
curl "$OMS_URL/auth/login"
POST /auth/logout

Local logout only: revokes our session and clears our cookie. The IdP's

Responses
204Session revoked and cookie cleared (idempotent)
Example
curl "$OMS_URL/auth/logout" \
  -X POST
GET /auth/me

Who the caller is signed in as, and what they can act on.

Authbasic_authbearer_token
Responses
200OK
401Not authenticated
Example
curl "$OMS_URL/auth/me" \
  --header "Authorization: Bearer $OMS_TOKEN"

handlers

GET /health
Responses
200OK
Example
curl "$OMS_URL/health"

orders

GET /instruments
Authbasic_authbearer_token
Parameters
search *
path · string
limit *
path · int64
Responses
200Matching active instruments
401No credential
Example
curl "$OMS_URL/instruments" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /instruments/options/chain
Authbasic_authbearer_token
Parameters
underlying *
path · string
expiry *
path · date
Responses
200Strike-sorted chain rows
Example
curl "$OMS_URL/instruments/options/chain" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /instruments/options/expiries
Authbasic_authbearer_token
Parameters
underlying *
path · string
Responses
200Sorted distinct expiry dates
Example
curl "$OMS_URL/instruments/options/expiries" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /orders

The caller's own blotter.

Authbasic_authbearer_token
Parameters
status
query · string
portfolio_id
query · uuid
instrument_id
query · string
principal_id
query · uuid
broker_connection_code
query · string
side
query · string
since
query · date-time
until
query · date-time
limit
query · int64
offset
query · int64
client_order_id
query · string
Free-text reference set at submit time — not unique, so this can match several rows sharing one strategy's generated tag.
Responses
200OK
Example
curl "$OMS_URL/orders" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /orders/cancel
Authbasic_authbearer_token
Request body
order_id *
string
reason
string
Responses
204Cancel accepted
400Invalid UUID
404Order not found
409Order state version mismatch
Example
curl "$OMS_URL/orders/cancel" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "order_id": "",
  "reason": null
}'
POST /orders/submit
Authbasic_authbearer_token
Request body
Wire payload for POST /orders/submit. `account_id` is optional — when omitted it is resolved from the portfolio's `default_account_id`; when present it overrides.
account_id
string
Optional account UUID; omit to use the portfolio's default account.
client_order_id *
string
Your own reference string, echoed back on updates.
e.g. my-ref-001
instrument_id
string
Instrument surrogate key (BIGINT as string), not a UUID. Omit when naming the instrument by `symbol` instead.
limit_price
double
Required for `limit` orders; omit for `market`.
order_id *
string
Client-generated UUID; also the idempotency key (a repeat is a 409).
e.g. 3f6b1c2e-8a4d-4e5f-9b21-1c2d3e4f5a6b
order_type *
market | limit
portfolio_id *
string
Portfolio UUID the order books against.
e.g. b2c3d4e5-6f70-4812-93a4-556677889900
quantity *
double
e.g. 1
side *
buy | sell
symbol
string
The instrument's venue-native symbol, as an alternative to `instrument_id`. Accepts the `Symbol@Venue` shorthand (`SPY260918C00770000@OPRA`) or a bare symbol qualified by the `venue` field.
e.g. SPY260918C00770000@OPRA
time_in_force *
day | gtc | ioc | fok
venue
string
Venue (MIC) qualifying `symbol`. Omit when `symbol` already carries `@VENUE`, or when the symbol is unique across venues.
Responses
204Order accepted and routed
400Validation error
403No trade grant for principal/portfolio/account
409Order already exists
422Instrument not found, inactive, no tradeable broker mapping, or rejected by pre-trade risk
502Broker rejected the order
503No broker adapter configured
Example
curl "$OMS_URL/orders/submit" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "account_id": null,
  "client_order_id": "my-ref-001",
  "instrument_id": null,
  "limit_price": null,
  "order_id": "3f6b1c2e-8a4d-4e5f-9b21-1c2d3e4f5a6b",
  "order_type": "market",
  "portfolio_id": "b2c3d4e5-6f70-4812-93a4-556677889900",
  "quantity": 1,
  "side": "buy",
  "symbol": "SPY260918C00770000@OPRA",
  "time_in_force": "day",
  "venue": null
}'
GET /orders/{id}
Authbasic_authbearer_token
Parameters
id *
path · uuid
Order ID
Responses
200OK
400Invalid UUID
404Order not found
Example
curl "$OMS_URL/orders/{id}" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /orders/{id}/allocations
Authbasic_authbearer_token
Parameters
id *
path · uuid
Order ID
Responses
200OK
Example
curl "$OMS_URL/orders/{id}/allocations" \
  --header "Authorization: Bearer $OMS_TOKEN"
POST /orders/{id}/allocations
Authbasic_authbearer_token
Parameters
id *
path · uuid
Block order ID
Request body
splits *
object[]
Responses
200Allocated
403No allocate grant on the block portfolio
404Order not found
422Nothing filled, over-allocation, or invalid target
Example
curl "$OMS_URL/orders/{id}/allocations" \
  -X POST \
  --header "Authorization: Bearer $OMS_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
  "splits": [
    {
      "portfolio_id": "",
      "qty": 0
    }
  ]
}'
GET /orders/{id}/events
Authbasic_authbearer_token
Parameters
id *
path · uuid
Order ID
Responses
200The order's audit trail, oldest event first
400Invalid UUID
403No view grant for principal/portfolio
404Order not found
Example
curl "$OMS_URL/orders/{id}/events" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /portfolios

The portfolios this principal may act on.

Authbasic_authbearer_token
Responses
200OK
Example
curl "$OMS_URL/portfolios" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /portfolios/{id}/positions
Authbasic_authbearer_token
Parameters
id *
path · uuid
Portfolio ID
Responses
200OK
403No view grant for principal/portfolio
Example
curl "$OMS_URL/portfolios/{id}/positions" \
  --header "Authorization: Bearer $OMS_TOKEN"
GET /portfolios/{id}/venues
Authbearer_token
Parameters
id *
path · uuid
Portfolio ID
instrument_id *
path · string
Responses
200OK
403No view grant for principal/portfolio
Example
curl "$OMS_URL/portfolios/{id}/venues" \
  --header "Authorization: Bearer $OMS_TOKEN"