Ripio Trade - API Documentation (v4.0)

You can create API Credentials on: https://trade.ripio.com/market/api/token.

After creating the API Credentials, you'll need to save in a safe place two pieces of information, an API Token and a Secret Key. The credentials are required respectively to Authenticate and Sign all Private REST Requests.

Attention: The Secret Key can only be viewed once and cannot be retrieved later. If you lose the Secret Key, delete the set of credentials and create a new one.

Each endpoint requires a type of access, which can be Read, Buy/Sell, Cryptocurrency withdrawals, or can contain all of these, each one for its own function. It is possible for the token to be Read only, or it may have several types, if it has any other type of access such as: Buy/Sell or Cryptocurrency withdrawals, it will also be Read by default.

For all private routes, these Headers are required:

Timestamp Security is a security method to guarantee the validation of the acceptable time window, in addition to guaranteeing the uniqueness of the request Signature.

• All Private Requests also require a Header parameter, Timestamp, which must be the timestamp in milliseconds of when the request was created and sent. Can be generated with Date.now() if you're using JavaScript, for example.

• An additional parameter, Timestamp-tolerance, non-required, may be sent to specify the max number of milliseconds after the timestamp, that the request is valid. If Timestamp-tolerance is not sent, it defaults to 5000 (5 seconds).

• It is recommended to use a small Timestamp-tolerance of 5000 (5 seconds) or less. The maximum value is 60,000 (60 seconds).

To create a signature for all Private Requests, you must encrypt the hash-based message using sha256 HMAC and encode it in Base64.

The message must contain:

Timestamp + HTTP Method + Path + JSON Payload

• Not including the '+' sign, just concatenate the content into a string.

• The Timestamp is the same as the one sent in the Header.

• For GET Requests, it is necessary to consider the PATH without Query Params. For example, this route: /withdrawals/estimate-rate/ADA?network=cardano_testnet. Just /withdrawals/estimate-fee is considered. Additionally, the BODY is considered an empty String.

• JSON Payload must be a string and must be the same as the one sent in the request Body.

IMPORTANT: To prevent an invalid signature, avoid using unnecessary decimal places in the request body properties. For instance, use 1 instead of 1.0. Alternatively, you can also send numbers as strings in the request body, ensuring they are in the same format but as strings. For example:

{
  'amount': '0.01',
  'pair': 'BTC_BRL',
  'price': '300000', 
  'side': 'buy', 
  'type': 'limit'
}

We provide functional examples of how to authenticate with this API, written in various programming languages. You can find these examples in our GitHub repository: https://github.com/ripio/trade.

The error code is returned in the property code of the response body.

HTTP Code: 400

Adjust the request to match what the documentation or the error message says and try again.

• 40000 - Invalid parameters.
• 40010 - Order amount below minimum.
• 40011 - Insufficient funds.
• 40020 - Order already canceled.
• 40021 - Order executed completely.
• 40021 - No orders to cancel.
• 40030 - Withdrawal limit exceeded.
• 40031 - Withdrawal amount below minimum.
• 40032 - Prevention against duplicated withdrawal. Try again after ten minutes.
• 40033 - Destination wallet not authorized.
• 40034 - Non existent destination account.
• 40035 - Minimum amount to create non existent wallet not reached.
• 40040 - Withdrawals temporarily blocked.
• 40041 - Withdrawals blocked due to TFA recovery request.
• 40050 - TFA not enabled.
• 40090 - Unsupported operation.

HTTP Code: 401

The authentication is necessary to access the resource.

• 40100 - Not authorized

HTTP Code: 401

• 40100 - Blocked token

Contact the support team to recover access.

HTTP Code: 403

Forbidden access to the resource.

• 40300 - Forbidden Access

HTTP Code: 404

Check the request URL.

• 40400 - Not found

HTTP Code: 429

Wait and try again.

• 42900 - Requests limit reached

HTTP Code: 500

Try again and contact the support team in case the error persists.

• 50000 - Internal server error
• 50001 - Error to get data
• 50002 - External communication error
• 50003 - Internal communication error

HTTP Code: 503

Wait and try again.

• 503 - Maintenance in course

The public endpoints have a reduced requests limit and a 30 seconds cache.

For increased limits, use the private endpoints.