anthid-com Symbol Risk Controls API

openapi: 3.2.0
info:
  title: Symbol Risk Controls API
  description: Symbol-level risk-limit control configuration
  license:
    name: ''
  version: 0.1.0
servers:
- url: https://api.anthid.com
  description: Production
tags:
- name: Symbol Risk Controls
  description: Symbol-level risk-limit control configuration
paths:
  /v1/controls/accounts/{account_id}/symbols/{symbol}/risk:
    get:
      tags:
      - Symbol Risk Controls
      summary: Get symbol risk control
      description: Returns risk limits for a symbol on a trading account. Users and API keys require Controls Premium and control read access. Services need `control:read` and `x-organization-id`. The organization must own the account.
      operationId: getSymbolRiskControl
      parameters:
      - name: account_id
        in: path
        description: Trading account ID
        required: true
        schema:
          type: string
          format: uuid
        example: 550e8400-e29b-41d4-a716-446655440000
      - name: symbol
        in: path
        description: Trading symbol
        required: true
        schema:
          type: string
        example: AAPL
      - name: x-organization-id
        in: header
        description: Organization id required when reading with service-account credentials
        required: false
        schema:
          type:
          - string
          - 'null'
          format: uuid
      responses:
        '200':
          description: Symbol risk control found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SymbolRiskControl'
              example:
                account_id: 550e8400-e29b-41d4-a716-446655440000
                created_at: '2026-08-12T16:20:00Z'
                max_daily_loss_amount: '1000.0'
                max_daily_loss_percent: '3.0'
                max_order_size: '100.0'
                max_position_size: '500.0'
                organization_id: 550e8400-e29b-41d4-a716-446655440222
                symbol: AAPL
                updated_at: '2026-08-12T16:20:00Z'
                version: 1
        '400':
          description: Path or query parameters are invalid, or the service-account `x-organization-id` header is missing or invalid
          content:
            application/json:
              schema:
                type: string
            text/plain:
              schema:
                type: string
        '401':
          description: Missing or invalid authentication credentials
        '403':
          description: Caller lacks controls entitlement or read permission, or the account is missing or owned by another organization
          content:
            application/json:
              schema:
                type: string
        '404':
          description: Symbol risk control was not found
          content:
            application/json:
              schema:
                type: string
        '429':
          description: Caller exceeded the request rate limit
        '500':
          description: Server error
          content:
            application/json:
              schema:
                type: string
      security:
      - bearerAuth: []
      - clientCredentials: []
      - apiKeyAuth: []
    put:
      tags:
      - Symbol Risk Controls
      summary: Upsert symbol risk control
      description: Creates or replaces risk limits for a symbol on a trading account in the caller's organization. Omitted optional fields are cleared. Requires Controls Premium. Users need an organization admin role; API keys need control edit permission for the account's environment.
      operationId: upsertSymbolRiskControl
      parameters:
      - name: account_id
        in: path
        description: Trading account ID
        required: true
        schema:
          type: string
          format: uuid
        example: 550e8400-e29b-41d4-a716-446655440000
      - name: symbol
        in: path
        description: Trading symbol
        required: true
        schema:
          type: string
        example: AAPL
      requestBody:
        description: Optional loss, position-size, and order-size limits for this account and symbol
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpsertRiskControlRequest'
            example:
              max_daily_loss_amount: '1000'
              max_daily_loss_percent: '3'
              max_order_size: '100'
              max_position_size: '500'
        required: true
      responses:
        '200':
          description: Symbol risk control upserted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SymbolRiskControl'
              example:
                account_id: 550e8400-e29b-41d4-a716-446655440000
                created_at: '2026-08-12T16:20:00Z'
                max_daily_loss_amount: '1000.0'
                max_daily_loss_percent: '3.0'
                max_order_size: '100.0'
                max_position_size: '500.0'
                organization_id: 550e8400-e29b-41d4-a716-446655440222
                symbol: AAPL
                updated_at: '2026-08-12T16:20:00Z'
                version: 1
        '400':
          description: A risk limit is not positive, or JSON syntax or path parameters are invalid
          content:
            application/json:
              schema:
                type: string
            text/plain:
              schema:
                type: string
        '401':
          description: Missing or invalid authentication credentials, or missing organization context
          content:
            application/json:
              schema:
                type: string
        '403':
          description: Caller lacks controls entitlement or edit permission, or the account is missing or owned by another organization
          content:
            application/json:
              schema:
                type: string
        '413':
          description: Request body exceeds the size limit
          content:
            text/plain:
              schema:
                type: string
        '415':
          description: Content-Type must be application/json
          content:
            text/plain:
              schema:
                type: string
        '422':
          description: JSON does not match the request schema
          content:
            text/plain:
              schema:
                type: string
        '429':
          description: Caller exceeded the request rate limit
        '500':
          description: Server error
          content:
            application/json:
              schema:
                type: string
      security:
      - bearerAuth: []
      - apiKeyAuth: []
    delete:
      tags:
      - Symbol Risk Controls
      summary: Delete symbol risk control
      description: Deletes risk limits for a symbol on a trading account in the caller's organization. Requires Controls Premium. Users need an organization admin role; API keys need control edit permission for the account's environment.
      operationId: deleteSymbolRiskControl
      parameters:
      - name: account_id
        in: path
        description: Trading account ID
        required: true
        schema:
          type: string
          format: uuid
        example: 550e8400-e29b-41d4-a716-446655440000
      - name: symbol
        in: path
        description: Trading symbol
        required: true
        schema:
          type: string
        example: AAPL
      responses:
        '200':
          description: Symbol risk control deleted, or was already deleted. `deleted_at` is when it was first removed and does not move on a repeat call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeletedResponse'
              example:
                deleted: true
                deleted_at: '2026-08-12T16:20:00Z'
                resource: symbol_risk_control
        '400':
          description: Path parameters are invalid
          content:
            application/json:
              schema:
                type: string
            text/plain:
              schema:
                type: string
        '401':
          description: Missing or invalid authentication credentials, or missing organization context
          content:
            application/json:
              schema:
                type: string
        '403':
          description: Caller lacks controls entitlement or edit permission, or the account is missing or owned by another organization
          content:
            application/json:
              schema:
                type: string
        '404':
          description: No control of this kind has ever existed in this scope
          content:
            application/json:
              schema:
                type: string
        '429':
          description: Caller exceeded the request rate limit
        '500':
          description: Server error
          content:
            application/json:
              schema:
                type: string
      security:
      - bearerAuth: []
      - apiKeyAuth: []
    patch:
      tags:
      - Symbol Risk Controls
      summary: Patch symbol risk control
      description: Creates or patches risk limits for a symbol on a trading account. Omitted and null fields are unchanged; `clear` removes named fields. Requires Controls Premium. Users need an organization admin role; API keys need control edit permission for the account's environment.
      operationId: patchSymbolRiskControl
      parameters:
      - name: account_id
        in: path
        description: Trading account ID
        required: true
        schema:
          type: string
          format: uuid
        example: 550e8400-e29b-41d4-a716-446655440000
      - name: symbol
        in: path
        description: Symbol
        required: true
        schema:
          type: string
        example: AAPL
      requestBody:
        description: Fields to change, and fields to remove
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchRiskControlRequest'
            example:
              clear:
              - max_position_size
              max_order_size: '100'
        required: true
      responses:
        '200':
          description: Symbol risk control patched
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SymbolRiskControl'
              example:
                account_id: 550e8400-e29b-41d4-a716-446655440000
                created_at: '2026-08-12T16:20:00Z'
                max_daily_loss_amount: '1000.0'
                max_daily_loss_percent: '3.0'
                max_order_size: '100.0'
                max_position_size: null
                organization_id: 550e8400-e29b-41d4-a716-446655440222
                symbol: AAPL
                updated_at: '2026-08-13T09:15:00Z'
                version: 2
        '400':
          description: No fields changed, or a field is both set and cleared, or a limit is not positive; malformed JSON or path parameters also fail
          content:
            application/json:
              schema:
                type: string
            text/plain:
              schema:
                type: string
        '401':
          description: Missing or invalid authentication credentials, or missing organization context
          content:
            application/json:
              schema:
                type: string
        '403':
          description: Caller lacks controls entitlement or edit permission, or the account is missing or owned by another organization
          content:
            application/json:
              schema:
                type: string
        '413':
          description: Request body exceeds the size limit
          content:
            text/plain:
              schema:
                type: string
        '415':
          description: Content-Type must be application/json
          content:
            text/plain:
              schema:
                type: string
        '422':
          description: JSON does not match the request schema
          content:
            text/plain:
              schema:
                type: string
        '429':
          description: Caller exceeded the request rate limit
        '500':
          description: Server error
          content:
            application/json:
              schema:
                type: string
      security:
      - bearerAuth: []
      - apiKeyAuth: []
components:
  schemas:
    SymbolRiskControl:
      type: object
      required:
      - account_id
      - organization_id
      - symbol
      - version
      - created_at
      - updated_at
      properties:
        account_id:
          type: string
          format: uuid
        created_at:
          type: string
          format: date-time
        max_daily_loss_amount:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
        max_daily_loss_percent:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Percent'
        max_order_size:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
        max_position_size:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
        organization_id:
          type: string
          format: uuid
        symbol:
          type: string
        updated_at:
          type: string
          format: date-time
        version:
          type: integer
          format: int64
    Percent:
      type: string
    RiskControlField:
      type: string
      description: Fields of a risk control a PATCH may remove.
      enum:
      - max_daily_loss_amount
      - max_daily_loss_percent
      - max_position_size
      - max_order_size
    DeletedResourceKind:
      type: string
      description: 'The resource a delete acted on.


        Named rather than free text so a caller can branch on it, and so the same

        vocabulary is available when these deletes start emitting events.'
      enum:
      - trading_account
      - test_trading_account
      - broker_credential
      - oauth_client
      - organization
      - user
      - organization_control
      - account_control
      - account_risk_control
      - account_time_control
      - symbol_control
      - symbol_risk_control
      - symbol_time_control
    PatchRiskControlRequest:
      type: object
      properties:
        clear:
          type: array
          items:
            $ref: '#/components/schemas/RiskControlField'
        max_daily_loss_amount:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
        max_daily_loss_percent:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Percent'
        max_order_size:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
        max_position_size:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
    DeletedResponse:
      type: object
      description: 'The body every successful delete returns.


        Deletes are idempotent, so a caller that retries one it is unsure landed

        gets the same 200 as the caller that deleted it. That leaves the caller

        unable to tell the two apart from the status alone, which is what

        `deleted_at` is for: it is the moment the resource was *first* deleted and

        does not move on a repeat call.'
      required:
      - deleted
      - resource
      - deleted_at
      properties:
        deleted:
          type: boolean
          description: 'Always true. A caller checking one field to confirm the outcome does not

            have to special-case which endpoint it called.'
        deleted_at:
          type: string
          format: date-time
          description: When the resource was first deleted, not when this call was made.
        id:
          type:
          - string
          - 'null'
          description: 'Absent for resources keyed by a natural composite key rather than a

            single identifier, which today is every control in the controls service.

            The path already identifies those, so nothing is lost by omitting it.'
        resource:
          $ref: '#/components/schemas/DeletedResourceKind'
    UpsertRiskControlRequest:
      type: object
      properties:
        max_daily_loss_amount:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
        max_daily_loss_percent:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Percent'
        max_order_size:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
        max_position_size:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Quantity'
    Quantity:
      type: string
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    clientCredentials:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Machine bearer token minted via the client_credentials grant.
x-tagGroups:
- name: Organization
  tags:
  - Organization Controls
- name: Account
  tags:
  - Account Manual Controls
  - Account Risk Controls
  - Account Time Controls
- name: Symbols
  tags:
  - Symbol Manual Controls
  - Symbol Risk Controls
  - Symbol Time Controls
  - Effective Controls
- name: Evaluation
  tags:
  - Control Evaluation