BaaS API

The dotQuant BaaS API (baas.dotquant.io) is an HTTP API that lets you drive your account programmatically — any application, script, or service, in any language, using your API Key and Tenant ID.

The API uses a command-based design: all write operations are CloudEvents sent to a command endpoint; reads use conventional GET endpoints and platform queries. This is intentional — the system is built on event sourcing, so commands are dispatched to an internal message queue rather than modifying resources in-place, and results arrive as events.

Key capabilities:
- Subscribe and manage price feeds and watchlist panels
- Compile strategies, backtest them (synchronous query), run them live, and route their signals
- Design, enable, and manage portfolios — proposals, approvals, steering, performance
- Place and follow manual orders; read broker cash and positions
- Read analyses, key metrics, news sentiment, and live price event streams

Base URL: https://baas.dotquant.io

All endpoints are tenant-scoped: https://baas.dotquant.io/api/best/tenants/{tenantId}/...

All BaaS API endpoints require your dotQuant API Key.

Header format:

X-Api-Key: <your-api-key>

Where to find your credentials — go to your Account page in the dashboard:
- Tenant ID: shown at the top of the Account card. Use the copy button to copy it. This goes into the {tenantId} path segment of every request.
- API Key: shown on the AI Configuration page (the sparkle icon in the topbar). Click Generate New API Key if you haven't created one yet.

Keep your API Key secret — it grants full access to your tenant.

Three independent limits are enforced on every request.

1. Global limit — per IP address
120 requests per 60-second sliding window across all endpoints. Exceeding it returns 429 Too Many Requests with a Retry-After header (seconds to wait).

2. Write limit — per Tenant ID
Applies to command ingestion (POST/PUT). 120 requests per 60-second sliding window. Same 429 + Retry-After response.

3. Auth failure limit — per IP address
If an IP sends 10 requests that result in 401 Unauthorized within a 60-second window, that IP is blocked for the remainder of the window. The counter resets on a successful authenticated request — legitimate clients are never penalised.

Handling 429 responses: read the Retry-After header (integer, seconds) and wait that duration before retrying.

Note: the values above are platform defaults; production values may differ.

List all schemas:
GET https://baas.dotquant.io/api/best/tenants/{tenantId}/api/trading/schemas

Returns the command types your tenant supports and their versions.

Fetch a specific schema:
GET https://baas.dotquant.io/api/best/tenants/{tenantId}/api/trading/schemas/{schema}/{version}

Returns the full JSON Schema document (application/schema+json) for that command version. Schemas are strict (additionalProperties: false) — validate your payloads before sending.

Replace $TENANT_ID and $API_KEY with your values from the Account page.

List available command schemas:

curl https://baas.dotquant.io/api/best/tenants/$TENANT_ID/commands \
  -H "X-Api-Key: $API_KEY"

Fetch a specific schema (e.g. subscribe-price-feed v1.0):

curl https://baas.dotquant.io/api/best/tenants/$TENANT_ID/commands/subscribe-price-feed/1.0 \
  -H "X-Api-Key: $API_KEY"

Run a query (e.g. your portfolios, or a symbol's situation):

curl "https://baas.dotquant.io/api/best/tenants/$TENANT_ID/queries/list-portfolios" \
  -H "X-Api-Key: $API_KEY"
curl "https://baas.dotquant.io/api/best/tenants/$TENANT_ID/queries/get-symbol-situation?correlationId=NASDAQ-MSFT" \
  -H "X-Api-Key: $API_KEY"

Send a command — the general CloudEvents envelope (fill data according to the fetched schema):

curl -X POST https://baas.dotquant.io/api/best/tenants/$TENANT_ID/commands \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "specversion": "1.0",
    "id": "'$(uuidgen)'",
    "source": "https://your-agent.example.com",
    "type": "<CommandType>",
    "datacontenttype": "application/json",
    "dataschema": "<catalogue dataschema URI>",
    "time": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'",
    "data": { }
  }'

The response returns the correlation id of the accepted command; results arrive as events on the platform's read models and live channels.

A liveness endpoint is available at:

GET https://api.dotquant.io/healthz

Returns 200 OK with the text Healthy when the API process is running. This is a basic process-level liveness check — it does not report on database connectivity, message queue status, or broker connections.