API Reference

The API Reference is organized by endpoint family. It lists bot-facing paths, parameters, request bodies, response schemas and WebSocket payloads. For workflow explanations and code examples, use the Developers guides.

Base URLs

Surface	Type	Base URL
REST API	HTTPS	`https://hit.com/api/v1`
WebSocket	Socket.IO	`wss://markets.hit.com`

Auth Labels

Label	Type	Description
Public	unauthenticated	No credentials are required.
JWT	bearer token or session cookie	User authentication through an `Authorization: Bearer` token or supported authentication cookie.
API key HMAC	signed headers	Trading API key headers: `hit-api-key`, `hit-signature`, `hit-timestamp` and `hit-passphrase`.

Sections

Section	Type	Contents
Authentication	REST and Socket.IO	API key headers and WebSocket auth payload
Events	REST	Event discovery and event volume
Markets	REST	Market lookup, market volume and public activity
Prices	REST	Order books, last trade price and price history
Public Profiles	REST	Public profile summary, P/L, positions and activity
Leaderboards	REST	Combined P/L, volume and liquidity-rewards rankings
Trades	REST	Raw trades and enriched public trade activity
Orders	REST	Create, list and cancel orders
Portfolio	REST	User positions, portfolio value and account activity
Rewards	REST	Dollar-denominated maker rewards and claims
WebSockets	Socket.IO	Namespaces, client messages and server events

Pagination

Paginated REST endpoints return Pagination<T>.

Field	Type	Required	Description
`first`	integer	Yes	One-based index of the first item on the current page.
`last`	integer	Yes	One-based index of the last item on the current page.
`limit`	integer	Yes	Maximum items returned on the current page.
`total`	integer or null	Yes	Total item count when requested with `total=true`; otherwise `null` on endpoints that support skipping totals.
`totalCapped`	boolean	No	`true` when `total` reached the server-side count cap and represents a lower bound rather than an exact count.
`data`	`T[]`	Yes	Page items.

Endpoints that support cursor pagination also return hasMore and nextCursor. Pass the opaque nextCursor value back as the next request’s cursor; do not parse or modify it. Some newer endpoints return page-number pagination instead:

Field	Type	Required	Description
`page`	integer	Yes	Current page number.
`limit`	integer	Yes	Maximum items returned on the current page.
`total`	integer or null	Yes	Total item count when requested.
`pageCount`	integer or null	Yes	Total page count when `total` is available.
`totalCapped`	boolean	No	`true` when `total` and `pageCount` are based on the server-side count cap.
`data`	`T[]`	Yes	Page items.

Rate Limits

Every route is rate limited unless it explicitly opts out; the health endpoints do. Limits are token buckets kept per route and per client. A verified trading API key gets its own bucket, at a higher limit than an unauthenticated caller from the same address. Sending the header is not enough — the key has to verify on a route that checks it. Requests that fail authentication consume the address’s allowance, so repeated rejected requests from one address are held near the base limit. Per-minute limits on the order routes, and what a verified key gets:

Route	Anonymous	Verified API key
`POST /orders`	1500	15000
`POST /orders/{id}/cancel`	1200	12000
`POST /orders/batch`, `POST /orders/batch-cancel`, `POST /orders/cancel`, and the order reads	400	4000
`POST /orders/cancel-all`, `POST /orders/cancel-event`	100	1000

Key management is per hour: creating a key is 5, deactivating one is 10. On an allowed request you get X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. On a rejected request you get 429 with X-RateLimit-Limit, X-RateLimit-Remaining: 0, Retry-After and X-RateLimit-Reset, and this body:

{
  "statusCode": 429,
  "message": "ThrottlerException: Too Many Requests",
  "timestamp": "2026-09-17T16:55:22.000Z",
  "path": "/api/v1/orders"
}

X-RateLimit-Reset does not carry the same quantity on both responses. On a 429 it is the seconds until one token frees up, the same value as Retry-After. On an allowed request it is the seconds until the bucket is full again. Do not read it as one number across both.

A request whose authentication guard rejects it first, with 401, 403 or 503, carries no rate-limit headers at all.

Errors

Errors use standard HTTP status codes with a JSON body when a message is available.

Field	Type	Required	Description
`statusCode`	integer	No	HTTP status code.
`message`	string or string[]	Yes	Error message or validation messages.
`error`	string	No	HTTP error label.

Overview

Market Data

Trading

Realtime

Base URLs

Auth Labels

Sections

Rate Limits

Errors

​Base URLs

​Auth Labels

​Sections

​Pagination

​Rate Limits

​Errors

Base URLs

Auth Labels

Sections

Pagination

Rate Limits

Errors