Paradex Token API

openapi: 3.2.0
info:
  title: Paradex Token API
  version: 1.142.2
  contact: {}
  description: 'Operations tagged Token across 2 of this provider''s published API definitions: paradex-openapi-prod.json, paradex-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prod.paradex.trade/v1
tags:
- name: Token
paths:
  /account/terminal-token:
    post:
      security:
      - BearerToken: []
      description: 'Mints a short-lived identity attestation for DIME Terminal:

        an ES256 JWT (typ "terminal+JWT", aud "dime-terminal", sub =

        the account address) signed with a dedicated key published in

        the JWKS. It proves account identity to the terminal and

        grants nothing on Paradex itself — no Paradex endpoint

        accepts it. Requires an interactive session authenticated

        with the account''s own key: readonly/API tokens, RPC tokens

        and subkey-scoped tokens are rejected. Sub-accounts and vault

        operators mint attestations for their own address.'
      tags:
      - Token
      summary: Mint a terminal identity token
      responses:
        '200':
          description: Terminal token minted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.AuthResp'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
        '403':
          description: Not an interactive session with the account's own key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
      operationId: postAccountTerminalToken
      x-operation-id-source: derived
    servers:
    - url: https://api.prod.paradex.trade/v1
  /account/tokens:
    get:
      security:
      - BearerToken: []
      description: 'Get all tokens for the authenticated account with optional filtering by kind

        and status.'
      tags:
      - Token
      summary: List tokens
      operationId: list-tokens
      parameters:
      - description: Filter by token kind (e.g., 'jwt', 'api_key')
        name: kind
        in: query
        schema:
          type: string
      - description: Include revoked and expired tokens
        name: with_invalid
        in: query
        schema:
          type: boolean
      responses:
        '200':
          description: List of tokens
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/responses.APIResults'
                - type: object
                  properties:
                    results:
                      type: array
                      items:
                        $ref: '#/components/schemas/responses.ApiToken'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
    post:
      security:
      - BearerToken: []
      description: 'Create a new authentication token for the authenticated account with custom

        name and expiration duration.'
      tags:
      - Token
      summary: Create token
      operationId: create-token
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/requests.CreateToken'
        description: Token creation request
        required: true
      responses:
        '200':
          description: Token created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.CreateTokenResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
        '403':
          description: IP restrictions not enabled for this account
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
    servers:
    - url: https://api.prod.paradex.trade/v1
  /account/tokens/{lookup_id}:
    delete:
      security:
      - BearerToken: []
      description: Revoke an authentication token by its unique identifier.
      tags:
      - Token
      summary: Revoke token
      operationId: revoke-token
      parameters:
      - description: Token lookup ID
        name: lookup_id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Token revoked successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.RevokeTokenResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
    servers:
    - url: https://api.prod.paradex.trade/v1
  /account/tokens/{lookup_id}/allowed-cidrs:
    put:
      security:
      - BearerToken: []
      description: Replace the IP CIDR allowlist for an auth token. Empty array clears the allowlist (unrestricted). Only callable from the main account session; subkey sessions cannot modify token allowlists.
      tags:
      - Token
      summary: Update token IP allowlist
      operationId: update-token-allowed-cidrs
      parameters:
      - description: Token lookup ID
        name: lookup_id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/requests.UpdateAllowedCIDRs'
      responses:
        '200':
          description: Updated token details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiToken'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
        '403':
          description: IP restrictions not enabled for this account
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/responses.ApiError'
    servers:
    - url: https://api.prod.paradex.trade/v1
components:
  schemas:
    responses.AuthResp:
      type: object
      properties:
        jwt_token:
          description: Authentication token
          type: string
          example: eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCJ9.eyJ0eXAiOiJhdCtKV1QiLCJleHAiOjE2ODE0NTI5MDcsImlhdCI6MTY4MTQ1MjYwNywiaXNzIjoiUGFyYWRleCBzdGFnaW5nIiwic3ViIjoiMHg0OTVkMmViNTIzNmExMmI4YjRhZDdkMzg0OWNlNmEyMDNjZTIxYzQzZjQ3M2MyNDhkZmQ1Y2U3MGQ5NDU0ZmEifQ.BPihIbGhnnsuPlReqC9x12JFXldpswg5EdA6tTiDQm-_UHaRz_8RfVBqWc2fPN6CzFsXTq7GowZu-2qMxPvZK_fGcxEhTp2k1r8MUxowlUIT4vPu2scCwrsyIujlCAwS
    responses.CreateTokenResponse:
      type: object
      properties:
        api_token:
          description: The token metadata
          allOf:
          - $ref: '#/components/schemas/responses.ApiToken'
        token:
          description: The generated JWT token
          type: string
          example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
    responses.RevokeTokenResponse:
      type: object
      properties:
        lookup_id:
          description: The lookup ID of the revoked token
          type: string
          example: uuid-123
    responses.ErrorCode:
      type: string
      enum:
      - VALIDATION_ERROR
      - BINDING_ERROR
      - INTERNAL_ERROR
      - NOT_FOUND
      - SERVICE_UNAVAILABLE
      - INVALID_REQUEST_PARAMETER
      - ORDER_ID_NOT_FOUND
      - ORDER_IS_CLOSED
      - ORDER_IS_NOT_OPEN
      - INVALID_ORDER_SIZE
      - CLIENT_ORDER_ID_NOT_FOUND
      - DUPLICATED_CLIENT_ID
      - INVALID_SYMBOL
      - INVALID_TOKEN
      - INVALID_ETHEREUM_ADDRESS
      - INVALID_ETHEREUM_SIGNATURE
      - INVALID_STARKNET_ADDRESS
      - INVALID_STARKNET_SIGNATURE
      - STARKNET_SIGNATURE_VERIFICATION_FAILED
      - ETHEREUM_SIGNER_MISMATCH
      - ETHEREUM_HASH_MISMATCH
      - NOT_ONBOARDED
      - INVALID_TIMESTAMP
      - INVALID_BLOCK_EXPIRATION
      - ACCOUNT_NOT_FOUND
      - MEDIA_NOT_FOUND
      - INVALID_ORDER_SIGNATURE
      - PUBLIC_KEY_INVALID
      - UNAUTHORIZED_ETHEREUM_ADDRESS
      - UNAUTHORIZED_ERROR
      - ETHEREUM_ADDRESS_ALREADY_ONBOARDED
      - EVM_ADDRESS_ALREADY_ONBOARDED
      - MARKET_NOT_FOUND
      - ALLOWLIST_ENTRY_NOT_FOUND
      - USERNAME_IN_USE
      - GEO_IP_BLOCK
      - ETHEREUM_ADDRESS_BLOCKED
      - PROGRAM_NOT_FOUND
      - PROGRAM_NOT_SUPPORTED
      - INVALID_DASHBOARD
      - MARKET_NOT_OPEN
      - MARKET_NOT_SETTLED
      - INVALID_REFERRAL_CODE
      - REQUEST_NOT_ALLOWED
      - PARENT_ADDRESS_ALREADY_ONBOARDED
      - INVALID_PARENT_ACCOUNT
      - INVALID_VAULT_OPERATOR_CHAIN
      - VAULT_OPERATOR_ALREADY_ONBOARDED
      - VAULT_NAME_IN_USE
      - VAULT_NOT_FOUND
      - VAULT_STRATEGY_NOT_FOUND
      - VAULT_LIMIT_REACHED
      - VAULT_DATA_PRIVATE
      - BATCH_SIZE_OUT_OF_RANGE
      - ISOLATED_MARKET_ACCOUNT_MISMATCH
      - NO_ACCESS_TO_MARKET
      - POINTS_SUMMARY_NOT_FOUND
      - ALGO_ID_NOT_FOUND
      - INVALID_DERIVATION_PATH
      - PROFILE_STATS_NOT_FOUND
      - INVALID_CHAIN
      - INVALID_LAYERSWAP_SWAP
      - INVALID_DEPOSIT_ADDRESS
      - SOCIAL_USERNAME_IN_USE
      - INVALID_OAUTH_REQUEST
      - RPI_ACCOUNT_NOT_WHITELISTED
      - SYSTEM_STATUS_POST_ONLY
      - SYSTEM_STATUS_CANCEL_ONLY
      - INVALID_MARKETING_CODE
      - OFFER_NOT_FOUND
      - MARKET_MARGIN_RESTRICTED
      - NOT_UNIQUE
      - ACCOUNT_ALREADY_REFERRED
      - ONBOARDING_PERIOD_EXPIRED
      - ONBOARDING_RATE_LIMITED
      - RFQ_CREATE_BUDGET_EXCEEDED
      - SUBACCOUNTS_LIMIT_EXCEEDED
      - INSUFFICIENT_MIN_CHAIN_BALANCE
      - INSUFFICIENT_EVM_BALANCE
      - PORTFOLIO_MARGIN_ONBOARDING_DISABLED
      - PORTFOLIO_MARGIN_INVALID_ACCOUNT_KIND
      - EVM_VAULT_OPERATORS_DISABLED
      - VAULT_OPERATOR_OWNER_PROOF_REQUIRED
      - INVALID_EVM_SIGNATURE
      - EVM_SIGNATURE_VERIFICATION_FAILED
      - INVALID_SUBKEY
      - SUBKEY_NOT_ACTIVATABLE
      - SUBKEY_REVOKED
      - TOKEN_LIMIT_REACHED
      - INVALID_TOKEN_SCOPE
      - IP_NOT_ALLOWED
      - INSUFFICIENT_TRANSFERRABLE_XP
      - TRANSFER_LIMIT_REACHED
      - XP_TRANSFERS_DISABLED
      - BLOCK_TRADE_NOT_FOUND
      - BLOCK_TRADE_NOT_ENABLED
      - BLOCK_TRADE_EXPIRED
      - BLOCK_TRADE_ALREADY_CANCELLED
      - BLOCK_TRADE_INVALID_STATUS
      - BLOCK_TRADE_UNAUTHORIZED
      - BLOCK_TRADE_MISSING_TRADES
      - BLOCK_TRADE_MISSING_SIGNERS
      - BLOCK_TRADE_MISSING_SIGNATURE
      - BLOCK_TRADE_ACCOUNT_MISMATCH
      - BLOCK_TRADE_INVALID_SIGNATURE
      - BLOCK_TRADE_SIGNER_KEY_UNAUTHORIZED
      - BLOCK_TRADE_REPLAYED_SIGNATURE
      - BLOCK_TRADE_SELF_TRADE
      - OFFER_ALREADY_CANCELLED
      - OFFER_INVALID_STATUS
      - OFFER_UNAUTHORIZED
      - OFFER_PARENT_MISMATCH
      - OFFER_PARENT_NOT_ACCEPTING
      - PORTFOLIO_MARGIN_CONFIG_NOT_FOUND
      - MARGIN_CONFIG_NOT_FOUND
      - MMP_CONFIG_INVALID
      - MMP_NOT_ENABLED
      - MMP_MIN_FREEZE_NOT_ELAPSED
      - MMP_NOT_CONFIGURED
      - RFQ_VENUE_UNAVAILABLE
      x-enum-comments:
        ErrorCodeString_SignerMismatch: '#nosec G101'
      x-enum-varnames:
      - ErrorCode_Validation
      - ErrorCode_Binding
      - ErrorCode_InternalError
      - ErrorCode_NotFound
      - ErrorCode_ServiceUnavailable
      - ErrorCodeString_InvalidParameter
      - ErrorCodeString_OrderIdNotFound
      - ErrorCodeString_OrderIsClosed
      - ErrorCodeString_OrderIsNotOpen
      - ErrorCodeString_InvalidSizeForModifyOrder
      - ErrorCodeString_ClientOrderIdNotFound
      - ErrorCodeString_DuplicatedClientOrderId
      - ErrorCodeString_InvalidSymbol
      - ErrorCodeString_InvalidToken
      - ErrorCodeString_BadEthAddress
      - ErrorCodeString_BadEthSignature
      - ErrorCodeString_BadStarkNetAddress
      - ErrorCodeString_BadStarkNetSignature
      - ErrorCodeString_StarknetSigVerificationFailed
      - ErrorCodeString_SignerMismatch
      - ErrorCodeString_HashMismatch
      - ErrorCodeString_NotOnboarded
      - ErrorCodeString_BadTimestamp
      - ErrorCodeString_BadExpiration
      - ErrorCodeString_AccountIdNotFound
      - ErrorCodeString_MediaNotFound
      - ErrorCodeString_InvalidOrderSignature
      - ErrorCodeString_BadPublicKey
      - ErrorCodeString_UnauthorizedEthAddress
      - ErrorCodeString_UnauthorizedError
      - ErrorCodeString_EthAddressAlreadyOnboarded
      - ErrorCodeString_EvmAddressAlreadyOnboarded
      - ErrorCodeString_MarketNotFound
      - ErrorCodeString_AllowlistNotFound
      - ErrorCodeString_UsernameInUse
      - ErrorCodeString_GeoIPBlock
      - ErrorCodeString_EthAddressBlocked
      - ErrorCodeString_ProgramNotFound
      - ErrorCodeString_ProgramNotSupported
      - ErrorCodeString_InvalidDashboard
      - ErrorCodeString_MarketNotOpen
      - ErrorCodeString_MarketNotSettled
      - ErrorCodeString_InvalidReferralCode
      - ErrorCodeString_RequestNotAllowed
      - ErrorCodeString_ParentAddressAlreadyOnboarded
      - ErrorCodeString_InvalidParentAccount
      - ErrorCodeString_InvalidVaultOperatorChain
      - ErrorCodeString_VaultOperatorAlreadyOnboarded
      - ErrorCodeString_VaultNameInUse
      - ErrorCodeString_VaultNotFound
      - ErrorCodeString_VaultStrategyNotFound
      - ErrorCodeString_VaultLimitReached
      - ErrorCodeString_VaultDataPrivate
      - ErrorCodeString_BatchSizeOutOfRange
      - ErrorCodeString_IsolatedMarketAccountMismatch
      - ErrorCodeString_NoAccessToMarket
      - ErrorCodeString_PointsSummaryNotFound
      - ErrorCodeString_AlgoIdNotFound
      - ErrorCodeString_InvalidDerivationPath
      - ErrorCodeString_ProfileStatsNotFound
      - ErrorCodeString_InvalidChain
      - ErrorCodeString_InvalidLayerswapSwap
      - ErrorCodeString_InvalidDepositAddress
      - ErrorCodeString_SocialUsernameInUse
      - ErrorCodeString_InvalidOAuthRequest
      - ErrorCodeString_RPIAccountNotWhitelisted
      - ErrorCodeString_SystemStatusPostOnly
      - ErrorCodeString_SystemStatusCancelOnly
      - ErrorCodeString_InvalidMarketingCode
      - ErrorCodeString_OfferNotFound
      - ErrorCodeString_MarketMarginRestricted
      - ErrorCodeString_NotUnique
      - ErrorCodeString_AccountAlreadyReferred
      - ErrorCodeString_OnboardingPeriodExpired
      - ErrorCodeString_OnboardingRateLimited
      - ErrorCodeString_RfqCreateBudgetExceeded
      - ErrorCodeString_SubaccountsLimitExceeded
      - ErrorCodeString_InsufficientMinChainBalance
      - ErrorCodeString_InsufficientEvmBalance
      - ErrorCodeString_PortfolioMarginOnboardingDisabled
      - ErrorCodeString_PortfolioMarginInvalidAccountKind
      - ErrorCodeString_EvmVaultOperatorsDisabled
      - ErrorCodeString_VaultOperatorOwnerProofRequired
      - ErrorCodeString_BadEvmSignature
      - ErrorCodeString_EvmSigVerificationFailed
      - ErrorCodeString_InvalidSubkey
      - ErrorCodeString_SubkeyNotActivatable
      - ErrorCodeString_SubkeyRevoked
      - ErrorCodeString_TokenLimitReached
      - ErrorCodeString_InvalidTokenScope
      - ErrorCodeString_IPNotAllowed
      - ErrorCodeString_InsufficientTransferrableXP
      - ErrorCodeString_TransferLimitReached
      - ErrorCodeString_XPTransfersDisabled
      - ErrorCodeString_BlockTradeNotFound
      - ErrorCodeString_BlockTradeNotEnabled
      - ErrorCodeString_BlockTradeExpired
      - ErrorCodeString_BlockTradeAlreadyCancelled
      - ErrorCodeString_BlockTradeInvalidStatus
      - ErrorCodeString_BlockTradeUnauthorized
      - ErrorCodeString_BlockTradeMissingTrades
      - ErrorCodeString_BlockTradeMissingSigners
      - ErrorCodeString_BlockTradeMissingSignature
      - ErrorCodeString_BlockTradeAccountMismatch
      - ErrorCodeString_BlockTradeInvalidSignature
      - ErrorCodeString_BlockTradeSignerKeyUnauthorized
      - ErrorCodeString_BlockTradeReplayedSignature
      - ErrorCodeString_BlockTradeSelfTrade
      - ErrorCodeString_OfferAlreadyCancelled
      - ErrorCodeString_OfferInvalidStatus
      - ErrorCodeString_OfferUnauthorized
      - ErrorCodeString_OfferParentMismatch
      - ErrorCodeString_OfferParentNotAccepting
      - ErrorCodeString_PortfolioMarginConfigNotFound
      - ErrorCodeString_MarginConfigNotFound
      - ErrorCodeString_MmpConfigInvalid
      - ErrorCodeString_MmpNotEnabled
      - ErrorCodeString_MmpMinFreezeNotElapsed
      - ErrorCodeString_MmpNotConfigured
      - ErrorCodeString_RfqVenueUnavailable
    responses.ApiToken:
      type: object
      properties:
        allowed_cidrs:
          description: IP CIDR allowlist; empty means unrestricted
          type: array
          items:
            type: string
          example:
          - '["203.0.113.0/24"]'
        created_at:
          description: Token creation timestamp (nanoseconds since epoch)
          type: integer
          example: 1640995200
        expiry_at:
          description: Expiration timestamp (nanoseconds since epoch)
          type: integer
          example: 1672531200
        kind:
          description: Token type (jwt, api_key, etc.)
          type: string
        last_updated_at:
          description: Last modification timestamp (nanoseconds since epoch)
          type: integer
          example: 1640995200
        lookup_id:
          description: Identifier used for the token lookup
          type: string
          example: uuid-123
        name:
          description: User-provided token name
          type: string
          example: My API Token
        revoked_at:
          description: Revocation timestamp (nanoseconds since epoch, 0 if not revoked)
          type: integer
          example: 0
        token_id:
          description: Unique ID for the auth token
          type: string
          example: token_123
    requests.UpdateAllowedCIDRs:
      type: object
      properties:
        allowed_cidrs:
          description: Full replacement list. Empty = unrestricted.
          type: array
          items:
            type: string
          example:
          - '["203.0.113.0/24"'
          - '"198.51.100.42/32"]'
    responses.APIResults:
      type: object
      properties:
        results:
          description: Array of results
          type: array
          items:
            type: object
    requests.CreateToken:
      type: object
      required:
      - expiry_duration
      - name
      - token_type
      properties:
        allowed_cidrs:
          description: 'Optional IP CIDR allowlist applied atomically at creation, so the token

            is never live unrestricted. Empty/omitted = unrestricted. Max 50 entries;

            same format as PUT /account/tokens/:lookup_id/allowed-cidrs.'
          type: array
          items:
            type: string
          example:
          - '["203.0.113.0/24"'
          - '"198.51.100.42/32"]'
        expiry_duration:
          description: Duration in seconds from now until expiration (1 min to 1 year).
          type: integer
          example: 86400
        name:
          description: User-friendly name for the JWT token.
          type: string
          example: My Long-term Trading Token
        token_type:
          description: Type of token to create.
          type: string
    responses.ApiError:
      type: object
      properties:
        data:
          description: any additional data related to the error
          type: object
        error:
          description: unique immutable string identifier for specific error
          allOf:
          - $ref: '#/components/schemas/responses.ErrorCode'
          example: NOT_ONBOARDED
        message:
          description: detailed description of error and how to address it
          type: string
          example: User has never called /onboarding endpoint
  requestBodies:
    requests.UpdateAllowedCIDRs:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/requests.UpdateAllowedCIDRs'
      description: Replacement CIDR list
      required: true
  securitySchemes:
    BearerToken:
      type: apiKey
      name: Authorization
      in: header
x-refined-from:
- paradex-openapi-prod.json
- paradex-openapi.yml
x-hideTryItPanel: true
x-provenance:
  method: harvested
  publisher: Paradex
  source: https://docs.paradex.trade/openapi/rest-endpoints.yaml
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)