# agency-openapi Documentation > Documentation for agency-openapi Append .md to any documentation page URL to get its markdown version. ## API Reference - [Overview](https://enterprise-docs.itigerup.com/reference/overview.md) - [Terminology](https://enterprise-docs.itigerup.com/reference/terminology.md) - [Rate Limits](https://enterprise-docs.itigerup.com/reference/rate-limit.md) - [AI](https://enterprise-docs.itigerup.com/reference/ai.md) - [Overview](https://enterprise-docs.itigerup.com/reference/overview-authentication.md) - [App Registration](https://enterprise-docs.itigerup.com/reference/oauth-2.md) - [Server Authorization](https://enterprise-docs.itigerup.com/reference/server-authorization.md) - [User Authorization](https://enterprise-docs.itigerup.com/reference/user-authorization.md) - [Tokens and Authorization Code](https://enterprise-docs.itigerup.com/reference/tokens-and-authorization-code.md) - [Other](https://enterprise-docs.itigerup.com/reference/other.md) - [Authorization Endpoint](https://enterprise-docs.itigerup.com/reference/get-v1-authorize.md): User authorization. The redirected URI will includes three query parameters `code`, `scope`, and `state`, which are explained in [User Authorization](../user-authorization.md), as shown below: ```text http://localhost:3846/callback?code=FMshefOQLlDr9MlnmqvYfHtuwHc9Z8i0rmlNCfTgAXI.ANWTllIRbRl9NILsLBbC-sbGyTHQfnaQp8a9vT9A9Gs&scope=uuid+api.basic%3Aread&state=erw34123we43234423e4 ``` ### User Login If the User is not logged in (automatically determined by the cookie value of the user's browser), the Server will return HTTP status code 303 to redirect the browser to the login page, and the complete authorization request information is carried in the `next` query parameter. After the User successfully logs in, the browser will automatically redirect back to the Authorization Endpoint to complete the subsequent authorization process. ### Error Response If the `client_id` does not exist, or the `redirect_uri` is not valid, the Authorization Server will display the error to the user without redirecting back to the App. If any other error occurs, the Authorization Server will redirect back to `redirect_uri` with `error`, `error_description`, and `state` parameters. If `response_mode` is provided in the request, the Authorization Server will construct the redirection using the requested mode. For explanation of errors, please refer to Section 5.2 of [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2). ### Examples #### User not logged in ```bash curl --request GET \ --url 'https://openapi-sandbox.tigerfintech.com/oauth2/v1/authorize?client_id=3e8a7a0c39ce4aa4ad2655b70a5d995e&response_type=code&scope=uuid%20api.basic%3Aread&audience=openapi&redirect_uri=http%3A%2F%2Flocalhost%3A3846%2Fcallback&state=erw34123we43234423e4' ``` Redirect the User's browser to Tiger OpenAPI's login page. ```http HTTP/1.1 303 See Other Date: Wed, 19 Oct 2022 05:38:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 487 Connection: keep-alive Location: https://openapi-sandbox.tigerfintech.com/login?client_id=3e8a7a0c39ce4aa4ad2655b70a5d995e&redirect_uri=https%3A%2F%2Fopenapi-sandbox.tigerfintech.com%2Foauth2%2Fv1%2Fauthorize%3Faudience%3Dopenapi%26client_id%3D3e8a7a0c39ce4aa4ad2655b70a5d995e%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A3846%252Fcallback%26response_type%3Dcode%26scope%3Duuid%2Bapi.basic%253Aread%26state%3Derw34123we43234423e4&response_type=code&scope=uuid+api.basic%3Aread Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD, DELETE, PUT Access-Control-Allow-Headers: Referer,Accept,Origin,User-Agent,Authorization,NT,X-CustomHeader,Keep-Alive,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Connection,DNT,x-ca-key,x-ca-timestamp,x-ca-nonce,x-ca-signature Access-Control-Expose-Headers: Verification-Url Access-Control-Max-Age: 1000 Server: TIGR ``` After the user successfully logs in, redirect the User's browser back to Authorization Endpoint, then redirect the User's browser again to `redirect_uri`. ```http HTTP/1.1 303 See Other Date: Wed, 19 Oct 2022 05:40:02 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-store Location: http://localhost:3846/callback?code=FMshefOQLlDr9MlnmqvYfHtuwHc9Z8i0rmlNCfTgAXI.ANWTllIRbRl9NILsLBbC-sbGyTHQfnaQp8a9vT9A9Gs&scope=uuid+api.basic%3Aread&state=erw34123we43234423e4 Pragma: no-cache Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD, DELETE, PUT Access-Control-Allow-Headers: Referer,Accept,Origin,User-Agent,Authorization,NT,X-CustomHeader,Keep-Alive,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Connection,DNT,x-ca-key,x-ca-timestamp,x-ca-nonce,x-ca-signature Access-Control-Expose-Headers: Verification-Url Access-Control-Max-Age: 1000 Server: TIGR ``` #### User Already logged in ```bash curl --request GET \ --url 'https://openapi-sandbox.tigerfintech.com/oauth2/v1/authorize?client_id=3e8a7a0c39ce4aa4ad2655b70a5d995e&response_type=code&scope=uuid%20api.basic%3Aread&audience=openapi&redirect_uri=http%3A%2F%2Flocalhost%3A3846%2Fcallback&state=erw34123we43234423e4' -H 'Cookie: oauth2_session=a9828804-97c2-4b2d-a64d-90becceda366' ``` Redirect the User's browser to `redirect_uri`. ```http HTTP/1.1 303 See Other Date: Wed, 19 Oct 2022 05:44:14 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-store Location: http://localhost:3846/callback?code=BzmWW7_PH3gVXhm5rPvwKsywumdtkI65T8PW9w8gTWw.ElxmmakhXEAFbA0nZ75OJJzRHaX9zIMV487qyNPYBsI&scope=uuid+api.basic%3Aread&state=erw34123we43234423e4 Pragma: no-cache Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD, DELETE, PUT Access-Control-Allow-Headers: Referer,Accept,Origin,User-Agent,Authorization,NT,X-CustomHeader,Keep-Alive,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Connection,DNT,x-ca-key,x-ca-timestamp,x-ca-nonce,x-ca-signature Access-Control-Expose-Headers: Verification-Url Access-Control-Max-Age: 1000 Server: TIGR ``` #### Error ```bash curl --request GET \ --url 'https://openapi-sandbox.tigerfintech.com/oauth2/v1/authorize?client_id=3e8a7a0c39ce4aa4ad2655b70a5d995e&response_type=code&scope=uuid%20api.basic%3Awrite&audience=openapi&redirect_uri=http%3A%2F%2Flocalhost%3A3846%2Fcallback&state=erw34123we43234423e4' -H 'Cookie: oauth2_session=a9828804-97c2-4b2d-a64d-90becceda366' ``` Redirect the User's browser to `redirect_uri`. ```http HTTP/1.1 303 See Other Date: Wed, 19 Oct 2022 05:48:35 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-store Location: http://localhost:3846/callback?error=invalid_scope&error_description=The+requested+scope+is+invalid%2C+unknown%2C+or+malformed.+The+OAuth+2.0+Client+is+not+allowed+to+request+scope+%27api.basic%3Awrite%27.&state=erw34123we43234423e4 Pragma: no-cache Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD, DELETE, PUT Access-Control-Allow-Headers: Referer,Accept,Origin,User-Agent,Authorization,NT,X-CustomHeader,Keep-Alive,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Connection,DNT,x-ca-key,x-ca-timestamp,x-ca-nonce,x-ca-signature Access-Control-Expose-Headers: Verification-Url Access-Control-Max-Age: 1000 Server: TIGR ``` Request IP not in the whitelist error: ```json {"error":"invalid_client","error_description":"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The access IP is not in the allow list."} ``` Missing some required param or the code is expired error: Code expired time is 10 minutes ```json {"error":"invalid_request","error_description":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Make sure that the various parameters are correct, be aware of case sensitivity and trim your parameters. Make sure that the client you are using has exactly whitelisted the redirect_uri you specified."} ``` The redirect_uri is incorrect error: The redirect uri needs to match the callback address reserved in the Tiger backend ```json {"error":"invalid_grant","error_description":"The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. The 'redirect_uri' from this request does not match the one from the authorize request."} ``` - [Token Introspection](https://enterprise-docs.itigerup.com/reference/post-v1-introspect.md): The App's Server introspects the issued token. Comply with [RFC7662](https://datatracker.ietf.org/doc/html/rfc7662) ### NOTE 1. `Content-Type` MUST be `application/x-www-form-urlencoded`; 1. The App MUST authenticate itself, via either Secret Basic or Secret Post method; 1. `Content-Type` of the response is `application/json;charset=UTF-8`; 1. If the token provided is issued to another App, the Authorization Server will respond with "inactive"; 1. For explanation of errors, please refer to Section 5.2 of [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2). ### Example ``` token: eyJhbGciOiJSUzI1NiIsImtpZCI6Im1mNXZkMWR6IiwidHlwIjoiSldUIn0.eyJjbGllbnRfaWQiOiIzZThhN2EwYzM5Y2U0YWE0YWQyNjU1YjcwYTVkOTk1ZSIsImV4cCI6MTY0Mzg4Njk4OCwiaWF0IjoxNjQzMDIyNzUzLCJpc3MiOiJodHRwczovL3Rlc3Qtb2F1dGgudGlnZXJmaW50ZWNoLmNvbS9vYXV0aDIiLCJqdGkiOiI1M2NhOTc1Ni1jN2U3LTQ1MzAtOGFhNC0wMzQxMGE1MjM4MmMiLCJuYmYiOjE2NDMwMjI3NTMsInNjcCI6WyJ1dWlkIiwib2ZmbGluZSJdLCJzdWIiOiI1MzQ4OTUwNTUxMjc0In0.n7QvvPd4RjSQEXLEoXvY3Ytjxks3FHHNtbuhFuDZaXPB3UKxsLC79YRaj6C1ZIRdMps02IHxrxruq9Mf2bOygHUccYOtl56noLjfpkZNIhgVy-DpbGu8LuVyWWEnTeuBbBDpmraTM49bJyPMIZ5Ze8k8LKQRuYrsXEGW6ZGtE3bwM94-ZLdRtPrutxNS-BlzLuPovpERdWMVprUS5OJ9E2J8h3pUM5QT4xQ-zZeDpjSKaGs4WCW8bA1qAVpXO4vzALm3AnPoH1k4_Gsxx0zsw-92D8TjvVIAlcRbZ3_XNj_IcP2YlQ5SNd03yw_1qoOzrvbpc3VGTmP5exGPmwIJtw token_type_hint: access_token scope: uuid offline ``` - [Token Revocation](https://enterprise-docs.itigerup.com/reference/post-v1-revoke.md): The App's Server revokes the issued token. Comply with [RFC7009](https://datatracker.ietf.org/doc/html/rfc7009) ### NOTE 1. `Content-Type` MUST be `application/x-www-form-urlencoded`; 1. The App MUST authenticate itself, via either Secret Basic or Secret Post method; 1. The response will ALWAYS be empty; 1. For explanation of errors, please refer to Section 5.2 of [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2). ### Example ``` token: eyJhbGciOiJSUzI1NiIsImtpZCI6Im1mNXZkMWR6IiwidHlwIjoiSldUIn0.eyJjbGllbnRfaWQiOiIzZThhN2EwYzM5Y2U0YWE0YWQyNjU1YjcwYTVkOTk1ZSIsImV4cCI6MTY0Mzg4Njk4OCwiaWF0IjoxNjQzMDIyNzUzLCJpc3MiOiJodHRwczovL3Rlc3Qtb2F1dGgudGlnZXJmaW50ZWNoLmNvbS9vYXV0aDIiLCJqdGkiOiI1M2NhOTc1Ni1jN2U3LTQ1MzAtOGFhNC0wMzQxMGE1MjM4MmMiLCJuYmYiOjE2NDMwMjI3NTMsInNjcCI6WyJ1dWlkIiwib2ZmbGluZSJdLCJzdWIiOiI1MzQ4OTUwNTUxMjc0In0.n7QvvPd4RjSQEXLEoXvY3Ytjxks3FHHNtbuhFuDZaXPB3UKxsLC79YRaj6C1ZIRdMps02IHxrxruq9Mf2bOygHUccYOtl56noLjfpkZNIhgVy-DpbGu8LuVyWWEnTeuBbBDpmraTM49bJyPMIZ5Ze8k8LKQRuYrsXEGW6ZGtE3bwM94-ZLdRtPrutxNS-BlzLuPovpERdWMVprUS5OJ9E2J8h3pUM5QT4xQ-zZeDpjSKaGs4WCW8bA1qAVpXO4vzALm3AnPoH1k4_Gsxx0zsw-92D8TjvVIAlcRbZ3_XNj_IcP2YlQ5SNd03yw_1qoOzrvbpc3VGTmP5exGPmwIJtw token_type_hint: access_token ``` - [Token Endpoint](https://enterprise-docs.itigerup.com/reference/post-v1-token.md): The App's Server fetches tokens. ### NOTE 1. `Content-Type` MUST be `application/x-www-form-urlencoded`; 1. The App MUST authenticate itself, via either Secret Basic or Secret Post method; 1. `access_token` is JSON Web Token; 1. When the grant type is `client_credentials`, the `sub` payload claim of `access_token` is `client:{client_id}`; 1. `Content-Type` of the response is `application/json;charset=UTF-8`; 1. For explanation of errors, please refer to Section 5.2 of [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2). ### Example #### Authorization Code Grant Type ``` grant_type: authorization_code code: yfz_7OBH9Eektoyb70GKcRTqmnshAQuolLqNzr63Vgs.z4591d8Yg9m7-KcygngZ9kO38rpGvdde7jjHKhLDM08 redirect_uri: 'http://localhost:3846/callback' ``` #### Refresh Token Grant Type ``` grant_type: refresh_token refresh_token: YU7w7bnP9dfp5-TBKTXRaPPT0BvkgSag5xHyGVVMo80.UL6_E30Zxk1F5GwQT2VzQLKr19c1HobG9MkdBDdi4LM ``` #### Client Credentials Grant Type ``` grant_type: client_credentials scope: api.users:write audience: openapi ``` - [Contract Overview](https://enterprise-docs.itigerup.com/reference/contract-overview.md): In this module, we provide a function to get information on contracts for different investment products available on Tiger Brokers. Some of the information, such as lot size, currency, and margin, are essential for taking further actions to trade. It is recommended that you call the API in this module first to request contract information before placing an order if you are not sure about the relevant information on the instrument you are going to trade. - [Get Contract Details](https://enterprise-docs.itigerup.com/reference/get-contract-detail.md): Get Contract Details - [Overview](https://enterprise-docs.itigerup.com/reference/overview-trade.md) - [Place Order](https://enterprise-docs.itigerup.com/reference/place-order.md): Place Common Order - [Modify Order](https://enterprise-docs.itigerup.com/reference/modify-order.md): Modify a common order. This method does not support allocation orders. > Allocation orders do not support modification. - [Get orders](https://enterprise-docs.itigerup.com/reference/get-api-v1-orders.md): Query orders - [Get Allocation Orders](https://enterprise-docs.itigerup.com/reference/get-allocation-orders.md): Batch get allocation orders. - [Place Allocation Order](https://enterprise-docs.itigerup.com/reference/allocations-place-order.md): Place Allocation Order - [Get Allocation Order](https://enterprise-docs.itigerup.com/reference/get-allocation-order.md): Get a single allocation order. This method does not support common orders. - [Allocation Preview Order](https://enterprise-docs.itigerup.com/reference/allocations-preview-order.md): Check an allocation order, including order parameter verification and margin adequacy. - [Get Allocation Sub Orders](https://enterprise-docs.itigerup.com/reference/get-allocation-sub-orders.md): Batch get allocation sub-account orders. - [Cancel Order](https://enterprise-docs.itigerup.com/reference/cancel-order.md): Cancel an order. This method supports both common orders and allocation orders. - [Check Order](https://enterprise-docs.itigerup.com/reference/check-order.md): Check whether the capital/position is sufficient. Returns information on estimated commissions, margin usage, etc. - [Place Forex Order](https://enterprise-docs.itigerup.com/reference/place-forex-order.md): Place Forex Order - [Forex Order Preview](https://enterprise-docs.itigerup.com/reference/preview-forex-order.md): Preview Forex Order - [Get forex quotes](https://enterprise-docs.itigerup.com/reference/get-forex-quotes.md): Query forex quotes - [Place Multiple Order](https://enterprise-docs.itigerup.com/reference/place-multiple-order.md): Place multiple orders, such as an OCA order. - [Get order detail](https://enterprise-docs.itigerup.com/reference/get-api-v1-order-detail.md): Query order detail - [Preview Order](https://enterprise-docs.itigerup.com/reference/preview-order.md): Validate the order, including parameter verification and margin adequacy. - [Get Order Transactions](https://enterprise-docs.itigerup.com/reference/get-transactions.md): Query transaction records. - [Examples](https://enterprise-docs.itigerup.com/reference/examples.md) - [Overview](https://enterprise-docs.itigerup.com/reference/overview-account.md) - [Get Assets](https://enterprise-docs.itigerup.com/reference/get-assets.md): Get account assets, the assets are calculated in real time. > grossPositionValue: the market value of all positions will be calculated in the primary currency - [Get consolidated asset](https://enterprise-docs.itigerup.com/reference/get-consolidated-asset.md): Get consolidated asset - [Get Positions](https://enterprise-docs.itigerup.com/reference/get-positions.md): Get account positions, the positions are calculated in real time. - [Get account status](https://enterprise-docs.itigerup.com/reference/get-account-status-1.md): Get account ID of the user - [Get Sub Accounts](https://enterprise-docs.itigerup.com/reference/get-sub-accounts.md): Get the list of sub-account IDs under the specified master account. The `masterAccountId` parameter must exactly match the master account bound to your client credentials. Requests with any other value are rejected with HTTP 400. - [Overview](https://enterprise-docs.itigerup.com/reference/overview-quote.md) - [Get Trading Calendar](https://enterprise-docs.itigerup.com/reference/get-trading-calendar.md): Get trading calendar for a market - [Get Corporate Actions](https://enterprise-docs.itigerup.com/reference/get-corp-actions.md): Get Corporate Actions - [Get Dividend Details](https://enterprise-docs.itigerup.com/reference/get-dividend-details.md): Get Dividend Details - [Overview](https://enterprise-docs.itigerup.com/reference/overview-events.md) - [Event Object](https://enterprise-docs.itigerup.com/reference/event-object.md) - [Get Event Info](https://enterprise-docs.itigerup.com/reference/get-events.md): Retrieve event data. Supports both HTTP short-polling and long-polling modes. Long-polling behavior: 1. If eventId is not specified, the interface will use the current request time as the starting point and query events generated after that time until an event occurs or the request times out. 2. If eventId is specified, the interface will use the event corresponding to that eventId as the starting point and query all events that occur after it until an event is generated or the request times out. Note: The result does not include the event corresponding to the specified eventId.