Skip to main content
All state-changing operations on UpsideMAX — placing orders, cancelling orders, registering accounts, adjusting margin, and more — use a single endpoint: POST /exchange. The operation to perform is determined entirely by the action.type field inside the JSON body, not by the URL. This action-based routing means your HTTP client only ever needs to know one write URL; you change the payload to change the operation.

​
Endpoint

​
Envelope Structure

Every POST /exchange request body is a JSON object with the following top-level fields:

​
Fields

​
object
required
The operation payload. Must contain a type string that identifies the action (e.g. "order", "cancel", "registerAccount"). All other fields are action-specific.
​
string
required
Identifies which action to perform. It also selects the EIP-712 signing path — funds/permission actions use a typed struct, everything else uses the Agent path. See Authentication.Common values: order, cancel, cancelByCloid, modify, registerAccount, updateLeverage, updateIsolatedMargin.
​
object
required
EIP-712 ECDSA signature (secp256k1) over the action. The server recovers the signer’s Ethereum address from this signature to authorize the operation — there are no API keys.
​
string
required
The r component of the ECDSA signature. Must be a 0x-prefixed lowercase hex string representing a 32-byte value (66 characters total).
​
string
required
The s component of the ECDSA signature. Same format as r.
​
integer
required
The recovery parameter. Must be 27 or 28 (Ethereum convention: 27 + recovery_bit).
​
integer
required
An int64 Unix millisecond timestamp. Must be unique per signer. Used as replay protection — the server rejects any previously seen nonce from the same address.
​
string
Optional. The Ethereum address of a vault for which the signer is acting as a proxy. When present, the server verifies that the signer is an authorized agent of the vault and applies the operation to the vault’s account. This is a separate vault-proxy mechanism (not currently enabled on Devnet) — delegated agent trading does not use it: an agent signs with its own key and the server routes to the master account from the recovered signer, so trade actions ignore vaultAddress.
​
string
Optional. The domain.chainId your client used when signing a typed-path action, as a 0x-prefixed hex string. Defaults to 0x2627 (9767). Sits at the top level of the envelope and is not part of the signed message. See Authentication.
​
string
Conditional. A 6-character alphanumeric alpha test invitation code required by registerAccount in gated environments. Include this field at the top level of the envelope — not inside action. This field is not included in the signed message.

​
Action-Based Routing

Unlike a traditional REST API where POST /orders creates an order and DELETE /orders/:id cancels one, UpsideMAX routes every write operation through POST /exchange. Routing is determined by action.type in the body. This keeps the transport layer simple and makes it easy to batch operations in a single request structure.
The table below maps action.type values to their operations:

​
Example Request

The following example places a limit GTC buy order (raw p / s values — scale per the contract’s configs):
See Authentication for instructions on building the signature, and Nonce for nonce generation rules.