API reference
The HaasOnline public REST API: programmatic access to your markets, bots, backtests, labs, scripts, and accounts - everything the app can do.
Authentication: every request carries Authorization: Bearer <api key>. Keys are prefixed hk_live_ (production) and are created in Settings → API Keys. No other credential type is accepted on this surface.
Errors are RFC 9457 problem details, served as application/problem+json. The code member is the stable machine-readable slug to match on; type links this error’s documentation.
Pagination is cursor-based: pass limit, follow next_cursor until it is null. Cursors are opaque - never construct or decode one.
Market tags are opaque identifiers. Copy market_tag from GET /markets and hand it back wherever a market is referenced; use the structured fields (exchange, base, quote, contract) when you need the components. Never construct or split a tag.
Idempotency: every POST and PUT accepts an optional Idempotency-Key header (recommended on anything you retry). The first request under a key stores its outcome for 24 hours; a retry with the same key and the same request returns the stored response with Idempotency-Replayed: true instead of repeating the operation, and a request reusing a key with a different body answers 422 idempotency_key_reuse. DELETE needs no key - it is naturally idempotent.