curl --request POST \
--url https://staging.apimonaco.xyz/api/v1/delegated-agents \
--header 'Content-Type: application/json' \
--header 'X-Monaco-Signature: <api-key>' \
--data '
{
"agentAddress": "0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5",
"allowedActions": [
"CREATE_ORDER",
"CANCEL_ORDER"
],
"allowedTradingPairIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"name": "market-maker-bot",
"expiresAt": "2026-12-31T23:59:59Z",
"allowedMarginAccountIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"allowedOrderTypes": [
"LIMIT"
],
"allowedTimeInForce": [
"GTC"
],
"maxLeverage": "10",
"maxOrderNotional": "50000",
"maxOpenOrders": 123,
"ipAllowlist": [
"203.0.113.0/24"
]
}
'import requests
url = "https://staging.apimonaco.xyz/api/v1/delegated-agents"
payload = {
"agentAddress": "0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5",
"allowedActions": ["CREATE_ORDER", "CANCEL_ORDER"],
"allowedTradingPairIds": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"name": "market-maker-bot",
"expiresAt": "2026-12-31T23:59:59Z",
"allowedMarginAccountIds": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"allowedOrderTypes": ["LIMIT"],
"allowedTimeInForce": ["GTC"],
"maxLeverage": "10",
"maxOrderNotional": "50000",
"maxOpenOrders": 123,
"ipAllowlist": ["203.0.113.0/24"]
}
headers = {
"X-Monaco-Signature": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-Monaco-Signature': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
agentAddress: '0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5',
allowedActions: ['CREATE_ORDER', 'CANCEL_ORDER'],
allowedTradingPairIds: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
name: 'market-maker-bot',
expiresAt: '2026-12-31T23:59:59Z',
allowedMarginAccountIds: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
allowedOrderTypes: ['LIMIT'],
allowedTimeInForce: ['GTC'],
maxLeverage: '10',
maxOrderNotional: '50000',
maxOpenOrders: 123,
ipAllowlist: ['203.0.113.0/24']
})
};
fetch('https://staging.apimonaco.xyz/api/v1/delegated-agents', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging.apimonaco.xyz/api/v1/delegated-agents",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'agentAddress' => '0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5',
'allowedActions' => [
'CREATE_ORDER',
'CANCEL_ORDER'
],
'allowedTradingPairIds' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'name' => 'market-maker-bot',
'expiresAt' => '2026-12-31T23:59:59Z',
'allowedMarginAccountIds' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'allowedOrderTypes' => [
'LIMIT'
],
'allowedTimeInForce' => [
'GTC'
],
'maxLeverage' => '10',
'maxOrderNotional' => '50000',
'maxOpenOrders' => 123,
'ipAllowlist' => [
'203.0.113.0/24'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Monaco-Signature: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://staging.apimonaco.xyz/api/v1/delegated-agents"
payload := strings.NewReader("{\n \"agentAddress\": \"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5\",\n \"allowedActions\": [\n \"CREATE_ORDER\",\n \"CANCEL_ORDER\"\n ],\n \"allowedTradingPairIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"name\": \"market-maker-bot\",\n \"expiresAt\": \"2026-12-31T23:59:59Z\",\n \"allowedMarginAccountIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"allowedOrderTypes\": [\n \"LIMIT\"\n ],\n \"allowedTimeInForce\": [\n \"GTC\"\n ],\n \"maxLeverage\": \"10\",\n \"maxOrderNotional\": \"50000\",\n \"maxOpenOrders\": 123,\n \"ipAllowlist\": [\n \"203.0.113.0/24\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Monaco-Signature", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://staging.apimonaco.xyz/api/v1/delegated-agents")
.header("X-Monaco-Signature", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"agentAddress\": \"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5\",\n \"allowedActions\": [\n \"CREATE_ORDER\",\n \"CANCEL_ORDER\"\n ],\n \"allowedTradingPairIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"name\": \"market-maker-bot\",\n \"expiresAt\": \"2026-12-31T23:59:59Z\",\n \"allowedMarginAccountIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"allowedOrderTypes\": [\n \"LIMIT\"\n ],\n \"allowedTimeInForce\": [\n \"GTC\"\n ],\n \"maxLeverage\": \"10\",\n \"maxOrderNotional\": \"50000\",\n \"maxOpenOrders\": 123,\n \"ipAllowlist\": [\n \"203.0.113.0/24\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://staging.apimonaco.xyz/api/v1/delegated-agents")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Monaco-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"agentAddress\": \"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5\",\n \"allowedActions\": [\n \"CREATE_ORDER\",\n \"CANCEL_ORDER\"\n ],\n \"allowedTradingPairIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"name\": \"market-maker-bot\",\n \"expiresAt\": \"2026-12-31T23:59:59Z\",\n \"allowedMarginAccountIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"allowedOrderTypes\": [\n \"LIMIT\"\n ],\n \"allowedTimeInForce\": [\n \"GTC\"\n ],\n \"maxLeverage\": \"10\",\n \"maxOrderNotional\": \"50000\",\n \"maxOpenOrders\": 123,\n \"ipAllowlist\": [\n \"203.0.113.0/24\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "123e4567-e89b-12d3-a456-426614174000",
"ownerUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentAddress": "0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5",
"name": "<string>",
"isActive": true,
"expiresAt": "<string>",
"revokedAt": "<string>",
"allowedActions": [
"<string>"
],
"allowedTradingPairIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"allowedMarginAccountIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"allowedOrderTypes": [
"<string>"
],
"allowedTimeInForce": [
"<string>"
],
"maxLeverage": "<string>",
"maxOrderNotional": "<string>",
"maxOpenOrders": 123,
"ipAllowlist": [
"<string>"
]
}Upsert delegated agent
Register or update a delegated agent.
Master accounts only. Creates (or updates, keyed on agent_address) a
delegation linking the calling owner to an agent wallet, together with the
policy that constrains what the agent may do on the owner’s behalf. An
owner holds at most 10 active, unexpired agents; a new one past that is
rejected until one is revoked or expires. Binding an agent to one margin
account (allowed_margin_account_ids) makes it that sub-account’s key.
curl --request POST \
--url https://staging.apimonaco.xyz/api/v1/delegated-agents \
--header 'Content-Type: application/json' \
--header 'X-Monaco-Signature: <api-key>' \
--data '
{
"agentAddress": "0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5",
"allowedActions": [
"CREATE_ORDER",
"CANCEL_ORDER"
],
"allowedTradingPairIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"name": "market-maker-bot",
"expiresAt": "2026-12-31T23:59:59Z",
"allowedMarginAccountIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"allowedOrderTypes": [
"LIMIT"
],
"allowedTimeInForce": [
"GTC"
],
"maxLeverage": "10",
"maxOrderNotional": "50000",
"maxOpenOrders": 123,
"ipAllowlist": [
"203.0.113.0/24"
]
}
'import requests
url = "https://staging.apimonaco.xyz/api/v1/delegated-agents"
payload = {
"agentAddress": "0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5",
"allowedActions": ["CREATE_ORDER", "CANCEL_ORDER"],
"allowedTradingPairIds": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"name": "market-maker-bot",
"expiresAt": "2026-12-31T23:59:59Z",
"allowedMarginAccountIds": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"allowedOrderTypes": ["LIMIT"],
"allowedTimeInForce": ["GTC"],
"maxLeverage": "10",
"maxOrderNotional": "50000",
"maxOpenOrders": 123,
"ipAllowlist": ["203.0.113.0/24"]
}
headers = {
"X-Monaco-Signature": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-Monaco-Signature': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
agentAddress: '0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5',
allowedActions: ['CREATE_ORDER', 'CANCEL_ORDER'],
allowedTradingPairIds: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
name: 'market-maker-bot',
expiresAt: '2026-12-31T23:59:59Z',
allowedMarginAccountIds: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
allowedOrderTypes: ['LIMIT'],
allowedTimeInForce: ['GTC'],
maxLeverage: '10',
maxOrderNotional: '50000',
maxOpenOrders: 123,
ipAllowlist: ['203.0.113.0/24']
})
};
fetch('https://staging.apimonaco.xyz/api/v1/delegated-agents', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging.apimonaco.xyz/api/v1/delegated-agents",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'agentAddress' => '0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5',
'allowedActions' => [
'CREATE_ORDER',
'CANCEL_ORDER'
],
'allowedTradingPairIds' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'name' => 'market-maker-bot',
'expiresAt' => '2026-12-31T23:59:59Z',
'allowedMarginAccountIds' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'allowedOrderTypes' => [
'LIMIT'
],
'allowedTimeInForce' => [
'GTC'
],
'maxLeverage' => '10',
'maxOrderNotional' => '50000',
'maxOpenOrders' => 123,
'ipAllowlist' => [
'203.0.113.0/24'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Monaco-Signature: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://staging.apimonaco.xyz/api/v1/delegated-agents"
payload := strings.NewReader("{\n \"agentAddress\": \"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5\",\n \"allowedActions\": [\n \"CREATE_ORDER\",\n \"CANCEL_ORDER\"\n ],\n \"allowedTradingPairIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"name\": \"market-maker-bot\",\n \"expiresAt\": \"2026-12-31T23:59:59Z\",\n \"allowedMarginAccountIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"allowedOrderTypes\": [\n \"LIMIT\"\n ],\n \"allowedTimeInForce\": [\n \"GTC\"\n ],\n \"maxLeverage\": \"10\",\n \"maxOrderNotional\": \"50000\",\n \"maxOpenOrders\": 123,\n \"ipAllowlist\": [\n \"203.0.113.0/24\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Monaco-Signature", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://staging.apimonaco.xyz/api/v1/delegated-agents")
.header("X-Monaco-Signature", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"agentAddress\": \"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5\",\n \"allowedActions\": [\n \"CREATE_ORDER\",\n \"CANCEL_ORDER\"\n ],\n \"allowedTradingPairIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"name\": \"market-maker-bot\",\n \"expiresAt\": \"2026-12-31T23:59:59Z\",\n \"allowedMarginAccountIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"allowedOrderTypes\": [\n \"LIMIT\"\n ],\n \"allowedTimeInForce\": [\n \"GTC\"\n ],\n \"maxLeverage\": \"10\",\n \"maxOrderNotional\": \"50000\",\n \"maxOpenOrders\": 123,\n \"ipAllowlist\": [\n \"203.0.113.0/24\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://staging.apimonaco.xyz/api/v1/delegated-agents")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Monaco-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"agentAddress\": \"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5\",\n \"allowedActions\": [\n \"CREATE_ORDER\",\n \"CANCEL_ORDER\"\n ],\n \"allowedTradingPairIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"name\": \"market-maker-bot\",\n \"expiresAt\": \"2026-12-31T23:59:59Z\",\n \"allowedMarginAccountIds\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"allowedOrderTypes\": [\n \"LIMIT\"\n ],\n \"allowedTimeInForce\": [\n \"GTC\"\n ],\n \"maxLeverage\": \"10\",\n \"maxOrderNotional\": \"50000\",\n \"maxOpenOrders\": 123,\n \"ipAllowlist\": [\n \"203.0.113.0/24\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "123e4567-e89b-12d3-a456-426614174000",
"ownerUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentAddress": "0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5",
"name": "<string>",
"isActive": true,
"expiresAt": "<string>",
"revokedAt": "<string>",
"allowedActions": [
"<string>"
],
"allowedTradingPairIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"allowedMarginAccountIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"allowedOrderTypes": [
"<string>"
],
"allowedTimeInForce": [
"<string>"
],
"maxLeverage": "<string>",
"maxOrderNotional": "<string>",
"maxOpenOrders": 123,
"ipAllowlist": [
"<string>"
]
}Authorizations
Ed25519 session-key request signing. Every authenticated request carries three headers: X-Monaco-PublicKey (64-char lowercase-hex session public key), X-Monaco-Timestamp (Unix milliseconds, within 30s of server time), and X-Monaco-Signature (hex ed25519 signature). The signature is over METHOD\npath?query\ntimestamp_ms\nSHA256_hex(body), where the body hash is the SHA-256 of the empty byte string when there is no body. Obtain the session keypair from POST /api/v1/auth/challenge followed by POST /api/v1/auth/verify.
Body
Agent wallet address (EVM, 42 chars including 0x)
"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5"
Required JSON array of actions the agent may perform: CREATE_ORDER, CANCEL_ORDER, REPLACE_ORDER, READ, MANAGE_RISK_BUCKETS. Every delegated session may read the owner's data; a policy listing only READ, or no action, is a read-only key. MANAGE_RISK_BUCKETS lets the agent move a margin account's free collateral into that account's own risk buckets (POST /api/v1/margin/risk-buckets/collateral/transfer-in), only for an account listed in allowedMarginAccountIds and, if the policy lists markets, only into an isolated risk bucket on a listed market. No action lets an agent move collateral any other way. Any other value is rejected.
1["CREATE_ORDER", "CANCEL_ORDER"]
Required JSON array of trading pair UUIDs. Each listed scope must match: with markets and margin accounts both listed, an order needs a listed market AND a listed account. Send [] for account-only scope; both scopes empty permit no orders.
1Optional human-friendly label for the agent
"market-maker-bot"
Delegation expiry timestamp (ISO 8601). Ends delegated reads, trading, and session refresh. Omit for the default of 14 days from now; at most 180 days ahead.
"2026-12-31T23:59:59Z"
Optional JSON array of margin account UUIDs the agent is bound to. When listed, an order must be on one of these accounts (and on a listed market, if any are listed). Omitted, null, or [] leaves the account unrestricted; both scopes empty permit no orders.
1Optional JSON array of permitted order types (LIMIT, MARKET). Omitted, null, or [] means unrestricted order types.
1["LIMIT"]
Optional JSON array of permitted time-in-force values (GTC, IOC, FOK). Omitted, null, or [] means unrestricted time in force.
1["GTC"]
Maximum leverage the agent may use (decimal string). Omit for no limit.
"10"
Maximum order notional (price * quantity, decimal string). Omit for no limit.
"50000"
Unsupported legacy field. Requests that set maxOpenOrders are rejected; no concurrent open-order cap is enforced. Omit this field.
Optional JSON array of up to 20 IP addresses or CIDR ranges the agent may create its delegated session from. Omitted, null, or [] allows any address.
1["203.0.113.0/24"]
Response
OK
Delegation UUID
"123e4567-e89b-12d3-a456-426614174000"
Owner account UUID the agent acts on behalf of
Agent wallet address (EVM)
"0x742d35cc6634c0532925a3b8d4060f31e2c3d8b5"
Human-friendly label for the agent
Whether the delegation is active
Delegation expiry timestamp (ISO 8601), if set
Revocation timestamp (ISO 8601), if revoked
Actions the agent may perform
1Trading pair UUIDs the agent may trade
1Margin account UUIDs the agent may trade against
1Permitted order types. Empty means unrestricted.
1Permitted time-in-force values. Empty means unrestricted.
1Maximum leverage (decimal string), if set
Maximum order notional (decimal string), if set
Legacy field; no concurrent open-order cap is enforced. New or updated policies leave it unset.
IP addresses and CIDR ranges the agent may create its delegated session from, normalized. Empty allows any address.
1Was this page helpful?