Partner API overview

The Partner API lets a white-label partner - a business running its own book of end-users on top of HaasOnline - manage those users and their bots over rest.haasapi.com. A modern REST API with bearer authentication and no request signing.

Note

This surface is for partners. An individual trading your own account wants the main API reference; the partner routes manage the end-users you own.

The model

• You are the partner. Your API key authenticates you; the API resolves your partner identity from it. Every partner route is scoped to you on the server - you only ever see and act on your own end-users.
• Your end-users are the exchange accounts you provision. Each is addressed by an opaque user_id and carries your own external_id reference. The internal account id and the exchange credentials are never exposed on the wire.
• Isolation is structural, not a filter. There is no request parameter that widens your view to another partner’s users - the scoping is the authenticated identity itself.

Authentication

Partner routes authenticate with a bearer key - no request signing. Your key carries the partner scope (alongside read); an ordinary trading key is refused from the partner surface with 403 insufficient_scope. For production integrations we recommend pinning the key to your server IPs with a per-key IP allow-list.

curl "https://rest.haasapi.com/v1/partner/users" \
  -H "Authorization: Bearer hk_live_YOUR_KEY"

Available today

Area	What you can do
Users	List your roster, read one end-user, provision a new one (real or simulated), and remove one
Bots	Create and start a bot from a strategy template, copy a master bot (native copy-trading), edit, start, stop and delete, and preview a grid before you commit
Bot activity	Read a bot’s live orders, open and closed positions, a position’s fills, and its logs
Backtests	Run a strategy against history for an end-user, then poll status and read the results, logs and positions
Signals	Drive a signal (webhook) bot from your own source - push a trade action to a bot’s token, and read back the last signal sent
Info	List the exchanges you are enabled for and their tradable markets - the reference reads before you provision
Strategies	Browse the strategy templates and their configuration schema

Provisioning validates the exchange API keys before the account is created, and the credentials are write-only - no read ever returns them. Bot config uses the strategy’s snake_case keys (see Strategies), decimals cross the wire as strings, timestamps are RFC 3339, responses are snake_case, errors are RFC 9457 problem documents, and lists page with an opaque cursor.