Ondo Finance

Ondo Finance API Keys API

The API Keys API from Ondo Finance — 3 operation(s) for api keys.

GitHub OpenAPI

Documentation

📖
Quickstart
https://docs.ondo.finance/api-reference/quickstart

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/ondo-finance/refs/heads/main/openapi/ondo-finance-api-keys-api-openapi.yml

Other Resources

🔗
Protobuf
https://raw.githubusercontent.com/api-evangelist/ondo-finance/refs/heads/main/grpc/ondo-finance-gm-backend.proto
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/ondo-finance/refs/heads/main/errors/ondo-finance-error-codes.yml
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/ondo-finance/refs/heads/main/openapi/ondo-finance-perps-ws-openapi-original.json

OpenAPI Specification

ondo-finance-api-keys-api-openapi.yml Raw ↑ 
openapi: 3.0.4
info:
  title: GM Backend Account API Keys API
  description: An API spec for the Ondo GM Backend API.
  version: 1.0.0
servers:
- url: https://api.gm.ondo.finance
  description: GM Backend API
tags:
- name: API Keys
paths:
  /v1/api_keys:
    get:
      summary: List API Keys
      description: Returns API keys for the authenticated account.
      operationId: listApiKeys
      tags:
      - API Keys
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      responses:
        '200':
          description: List of API keys
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/GenericResponse'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/ApiKeyInfo'
              example:
                success: true
                result:
                - keyId: key_abc123
                  name: Trading Bot
                  createdAt: '2025-01-01T00:00:00Z'
                  scopes:
                  - read
                  - trade
                  whitelistedIPs:
                  - 192.168.1.1
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
    post:
      summary: Create API Key
      description: Create a new API key. The secret is returned only once.
      operationId: createApiKey
      tags:
      - API Keys
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiKeysCreateRequest'
      responses:
        '200':
          description: Created API key (includes secret)
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/GenericResponse'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ApiKeyCreateResult'
              example:
                success: true
                result:
                  keyId: key_abc123
                  name: Trading Bot
                  createdAt: '2025-01-01T00:00:00Z'
                  scopes:
                  - read
                  - trade
                  secretKey: sk_live_abc123def456ghi789...
        '400':
          description: Bad request. The request was malformed or failed validation.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: false
                  error:
                    type: string
                    description: Human-readable error message
                  error_code:
                    type: string
                    enum:
                    - bad_query_param
              example:
                success: false
                error: Description of the error
                error_code: bad_query_param
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /v1/api_keys/{apiKeyID}:
    delete:
      summary: Delete API Key
      description: Delete an API key by ID.
      operationId: deleteApiKey
      tags:
      - API Keys
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      parameters:
      - name: apiKeyID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericResponse'
              example:
                success: true
        '400':
          description: Bad request. The request was malformed or failed validation.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: false
                  error:
                    type: string
                    description: Human-readable error message
                  error_code:
                    type: string
                    enum:
                    - api_key_not_found
              example:
                success: false
                error: Description of the error
                error_code: api_key_not_found
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /v1/api_keys/{apiKeyID}/ip_whitelist:
    post:
      summary: Set API Key IP Whitelist
      description: Set or update IP whitelist for an API key.
      operationId: setApiKeyIpWhitelist
      tags:
      - API Keys
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      parameters:
      - name: apiKeyID
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiKeyWhitelistRequest'
      responses:
        '200':
          description: Updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericResponse'
              example:
                success: true
        '400':
          description: Bad request. The request was malformed or failed validation.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: false
                  error:
                    type: string
                    description: Human-readable error message
                  error_code:
                    type: string
                    enum:
                    - api_key_not_found
                    - too_many_ips
              example:
                success: false
                error: Description of the error
                error_code: api_key_not_found
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
    delete:
      summary: Remove API Key IP Whitelist Entry
      description: Remove an IP address from the whitelist for an API key.
      operationId: deleteApiKeyIpWhitelist
      tags:
      - API Keys
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      parameters:
      - name: apiKeyID
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - ip
              properties:
                ip:
                  type: string
                  description: IP address to remove from the whitelist
      responses:
        '200':
          description: IP removed from whitelist
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericResponse'
              example:
                success: true
        '400':
          description: Bad request. The request was malformed or failed validation.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: false
                  error:
                    type: string
                    description: Human-readable error message
                  error_code:
                    type: string
                    enum:
                    - api_key_not_found
              example:
                success: false
                error: Description of the error
                error_code: api_key_not_found
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  responses:
    Forbidden:
      description: Access denied. The authenticated account does not have permission.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - account_closed
                - account_not_allowed
                - forbidden
                - ip_not_permitted
                - key_doesnt_have_scope
          example:
            success: false
            error: Description of the error
            error_code: account_not_allowed
    TooManyRequests:
      description: Rate limit exceeded. Slow down request frequency.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - too_many_requests
          example:
            success: false
            error: Description of the error
            error_code: too_many_requests
    Unauthorized:
      description: Authentication required. Provide a valid JWT or API key.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - api_key_not_found
                - auth_expired
                - auth_invalid
                - auth_missing
                - failed_to_decode_hex_signature
                - failed_to_parse_timestamp
                - signature_mismatch
                - timestamp_too_far
          example:
            success: false
            error: Description of the error
            error_code: auth_missing
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - server_is_busy
                - service_unavailable
                - unknown
          example:
            success: false
            error: Description of the error
            error_code: unknown
  schemas:
    ApiKeyCreateResult:
      type: object
      required:
      - keyId
      - name
      - createdAt
      - scopes
      - secretKey
      properties:
        keyId:
          type: string
          description: API key ID
        name:
          type: string
          description: Key name
        createdAt:
          type: string
          format: date-time
          description: When the key was created
        scopes:
          type: array
          items:
            type: string
          description: Permitted scopes
        secretKey:
          type: string
          description: API secret key. Only returned once at creation time.
    ApiKeysCreateRequest:
      type: object
      required:
      - name
      - scopes
      properties:
        name:
          type: string
          description: Human-readable name for the API key
          example: Trading Bot
        scopes:
          type: array
          items:
            type: string
          description: Permission scopes for the API key
          example:
          - read_only
          - transfer
    ApiKeyWhitelistRequest:
      type: object
      required:
      - ip
      properties:
        ip:
          type: string
          description: IP address to whitelist
          example: 192.168.1.1
    ApiKeyInfo:
      type: object
      required:
      - keyId
      - name
      - createdAt
      - scopes
      properties:
        keyId:
          type: string
          description: API key ID
        name:
          type: string
          description: Key name
        createdAt:
          type: string
          format: date-time
          description: When the key was created
        scopes:
          type: array
          items:
            type: string
          description: Permitted scopes
        whitelistedIPs:
          type: array
          items:
            type: string
          description: Whitelisted IP addresses
    GenericResponse:
      type: object
      required:
      - success
      properties:
        success:
          type: boolean
          description: Whether the request was successful
          example: true
        error:
          type: string
          description: Error message, present only on failure
          example: ''
        error_code:
          type: string
          description: Semantic error code. See each endpoint's error responses for the specific codes it can return.
        deprecated:
          type: string
          description: Deprecation notice, if applicable
          example: ''
  securitySchemes:
    apiKey:
      type: apiKey
      name: x-api-key
      in: header