Authentication

auth-token

Authenticate apiKey/apiSecret to obtain an access token and refresh token (including expiry information).

POST
/api/v3/auth/token

Request Body

TypeScript Definitions

Use the request body type in TypeScript.

bodyobjectrequired
apiKeystringrequired

API key issued by SSI/FastConnect for the application.

apiSecretstringrequired

API secret corresponding to the `apiKey`.

otpstring | nulloptional

OTP code (SMS OTP or SmartOTP) required if you want the issued token to have trading permission. If used only for querying data (data, query trading), OTP is not required.

transactionIdstring | nulloptional

Transaction ID returned from the `auth/requestOtp` API when the account uses 2FA type SmartOTP and has triggered the mobile approval flow via the iBoard app.

Response Headers

X-RATELIMIT-LIMITstringoptional

Request limit within the period.

X-RATELIMIT-REMAININGstringoptional

Number of requests remaining in the current period.

X-RATELIMIT-RESETstringoptional

Time at which the request limit resets.

Response Body

application/json

application/json

curl -X POST "https://api.ssi.com.vn/api/v3/auth/token" \  -H "Content-Type: application/json" \  -d '{    "apiKey": "string",    "apiSecret": "string"  }'

Success.

{
  "tokenType": "Bearer",
  "accessToken": "string",
  "expiresAt": 1772075293023,
  "refreshToken": "string",
  "refreshExpiresAt": 1772075293023
}

Invalid request.

{
  "code": 400,
  "msg": "apiKey is required"
}

auth-requestOtpPOST

Send a request to obtain an OTP for transaction authentication. For accounts with 2FA type SMS/Email, the OTP is sent to the registered email/phone number. For accounts with 2FA type SmartOTP, the customer receives an approval request on the iBoard mobile app and can use the returned `transactionId` to call `auth/token`.

account-infoGET

Retrieve the customer's list of trading accounts. An account can be one of three types CASH (regular); MARGIN (margin); DERIVATIVE (derivatives). * DERIVATIVE (derivatives)