API Reference

The full REST API reference is at /api-docs. It covers market data, account, signals, automation, analytics, and the read-only admin/monitor surfaces. No endpoint exposes secrets.

Read-only observability lives under /api/monitor/*. Every monitor surface is read-only, holds mutationAuthority=NONE, and carries no trading authority.

• /api/monitor/operator-compact-truth — compact operator cockpit truth
• /api/monitor/live-readiness-decision-packet — go-live decision packet
• /api/monitor/evidence-loop-closure-truth — evidence loop closure
• /api/monitor/pre-dispatch-root-cause-truth — dominant-blocker root cause
• /api/monitor/runtime-constitution-truth — runtime constitution vs enforced config
• /api/monitor/candidate-quality-v3 — cost-aware candidate quality
• /api/monitor/execution-throttle-truth — rate-limit / retry / idempotency posture
• /api/monitor/anti-manipulation-truth — manipulation / spoofing / trap posture
• /api/monitor/restart-continuity-truth — safe-to-auto-resume verdict
• /api/monitor/protection-blocker-truth — protection-attach / unprotected posture
• /api/monitor/telegram-dynamic-truth — dynamic Telegram digest source
• /api/monitor/public-status-truth — never-naked-Unknown status verdict
• /api/monitor/security-rbac-truth — security / RBAC posture
• /api/monitor/go-live-readiness-snapshot — go-live readiness snapshot
• /api/autotrading/status — autotrading engine state + top blockers

All monitor endpoints are read-only with mutationAuthority=NONE — they observe and explain, they never place, close, size, or promote a trade.

• POST /api/emergency-stop — role-protected (hasAnyRole ADMIN, TRADER) + audited
• POST /api/autotrading/pause — role-protected + audited

Control endpoints are the only mutating surfaces. They are role-protected and every action is audited. They can pause or emergency-stop — they can never open a position, activate a book, or force live.