Partner API¶
Institutional partners get programmatic access beyond the public read-only surface: order placement, vault performance and risk telemetry, and operational controls, scoped to the partner's own vaults.
Access is provisioned during onboarding
The partner API is not open registration. Endpoint-level documentation, credentials, and environment details are provided as part of partner onboarding — contact info@arkonix.xyz.
Authentication model¶
Requests are authenticated with HMAC-SHA256 request signing (the scheme used by major exchange APIs):
| Header | Contents |
|---|---|
X-API-KEY |
Your API key identifier |
X-SIGNATURE |
HMAC-SHA256(api_secret, sorted_query_params + body) |
X-TIMESTAMP |
Unix timestamp of the request |
Design properties of the scheme:
- The secret never travels. Only signatures do; the secret signs requests client-side.
- Replay protection. Timestamps are validated against a tight window, so captured requests can't be replayed later.
- Full-request coverage. The signature covers query parameters and body, so signed requests can't be tampered with in transit.
This surface is included in the scope of the platform's independent security audits, including signature-replay, timing-attack, and cross-partner key-confusion testing.
What's available¶
At a high level, partner credentials unlock:
- Vault telemetry — performance metrics, drawdown, and circuit-breaker state for the partner's vaults.
- Order flow — programmatic order placement and status tracking on supported venues.
- Operational controls — wallet and membership management scoped to the partner organization.
For UI-level integration (deposits, redemptions, financial data in your own product), you likely want the Vault SDK rather than the partner API — the SDK requires no credentials at all.