Authentication & Rate Limits

Authentication and rate limits for public market-data and authenticated trading endpoints.

Authentication

Market Data (public)

The market-data endpoints - GET /fapi/v1/price/kline, GET /fapi/v1/price/mark-kline, and the WebSocket stream wss://trade.mudrex.com/fapi/v1/price/ws/linear - are public and read-only.

Trading API

To call any private (trading) endpoint under /fapi/v1 you must:

• Verify your identity — complete KYC (PAN & Aadhaar) verification and enable two-factor authentication (TOTP) on your Mudrex account.
• Generate an API key — create a key in your dashboard and copy the secret. The secret is shown only once; store it securely.

Required headers:

Example request

curl -X POST "https://trade.mudrex.com/fapi/v1/futures/BTCUSDT/order?is_symbol" \
  -H "Content-Type: application/json" \
  -H "X-Authentication: your-secret-key" \
  -d '{
    "leverage": "5",
    "quantity": "0.001",
    "order_price": "107526",
    "order_type": "LONG",
    "trigger_type": "MARKET",
    "is_takeprofit": true,
    "is_stoploss": true,
    "stoploss_price": "106900",
    "takeprofit_price": "110000",
    "reduce_only": false
  }'

Rate Limits

Market-data and trading limits are tracked independently. Market data is limited per IP; the trading API is limited per API key across three tiers (default, core-trading, wallet).

Market Data - REST

Per-minute call limiting (no weight-based scheme).

On exceeding the limit, the server responds with HTTP 429 Too Many Requests and a Retry-After header. See Retries and window reset.

Market Data - WebSocket

• A ticker stream (ticker@5s / ticker@1s) counts as 1 subscription regardless of how many assets it tracks; the ticker asset count is unlimited and does not contribute to the cap.
• Exceeding the subscription cap returns application error 429 subscription limit reached.
• Exceeding the connection-creation limit returns HTTP 429 Too Many Requests with a Retry-After header. See Retries and window reset.

Trading API - default endpoints

Applies to all trading endpoints not covered by the core-trading or wallet tiers below.

Trading API - core trading endpoints

Applies to: POST /futures/{asset_id}/order, DELETE /futures/orders/{order_id}, POST /futures/positions/{position_id}/add-margin, POST & PATCH /futures/positions/{position_id}/riskorder, POST /futures/positions/{position_id}/reverse, POST /futures/positions/{position_id}/close/partial, POST /futures/positions/{position_id}/close, GET & POST /futures/{asset_id}/leverage.

Trading API - wallet endpoints

Applies to: POST /wallet/funds, POST /wallet/futures/transfer, and the INR transfer endpoint POST /futures/transfers/inr.

On exceeding any trading limit, the server responds with HTTP 429 and a rate-limit error, including a Retry-After header. See Retries and window reset.

The currency you trade in (USDT or INR) does not change which limit applies - limits are per key and per endpoint tier, not per currency.

Retries and window reset

On HTTP 429, the response includes a Retry-After header with the number of seconds to wait before retrying. Wait at least that long before sending another request.

Limits use fixed clock windows, not rolling windows. Each window resets at the start of its next period (for example, a per-minute limit resets at the top of every minute). A client that continues calling across a reset may briefly exceed the stated limit when measured over a sliding wall-clock interval; that is expected.

Error responses

For the full error reference - both market-data (REST + WebSocket) and trading API, including currency-related cases — see the Errors page. In short: REST errors return success: false with an errors array of { code, text }; WebSocket errors return an error object of { code, msg }.