# CrossTrade API

> Programmatic control of NinjaTrader 8 via REST, WebSocket, and Model Context
> Protocol. Place orders, manage positions, stream quotes, run strategies,
> compile and deploy NinjaScript — from any language or any AI client.

## MCP server (recommended for AI clients, **open beta**)

- Endpoint: `https://app.crosstrade.io/v1/api/mcp` (Streamable HTTP, OAuth 2.1)
- Server card: https://app.crosstrade.io/.well-known/mcp/server-card.json
- OAuth metadata: https://app.crosstrade.io/.well-known/oauth-protected-resource
- Tokens / consent: https://app.crosstrade.io/user/my-account?tab=ai-clients
- Scopes: `mcp:read` (read-only) or `mcp:trade` (full trading)
- Subscription: open beta access is enabled for authenticated users,
  including trial accounts. If open beta is later disabled, MCP access
  returns to the Elite tier.

The MCP surface is a strict superset of REST: every public endpoint plus the
Elite-tier MCP-only tools (backtest, replay, NinjaScript compile/deploy,
indicator queries, drawings, workspaces, alerts).

## Resources for AI agents

- [Full reference (llms-full.txt)](https://app.crosstrade.io/v1/api/llms-full.txt) — every endpoint, parameters, body shapes, examples, in one file
- [OpenAPI 3.1 spec (JSON)](https://app.crosstrade.io/v1/api/openapi.json) — machine-readable REST surface
- [OpenAPI 3.1 spec (YAML)](https://app.crosstrade.io/v1/api/openapi.yaml) — same, YAML
- [Endpoint catalog (JSON)](https://app.crosstrade.io/v1/api/_endpoints) — flat list, easier to grep

## Documentation

- [API overview](https://crosstrade.io/docs/api/overview)
- [Authentication](https://crosstrade.io/docs/api/authentication)
- [Rate limiting](https://crosstrade.io/docs/api/rate-limiting)
- [WebSocket API](https://crosstrade.io/docs/api/websocket-api)
- [AI-assisted development](https://crosstrade.io/docs/api/ai-assisted-development)

## Quick reference

- Base URL: `https://app.crosstrade.io`
- REST auth: `Authorization: Bearer <token>` (issued at `/user/my-account`)
- MCP auth: OAuth 2.1 + PKCE; clients self-register at `/v1/oauth/mcp/register`
- All paths under `/v1/api/...` — there is no `/api/...` prefix
- All responses follow `{"success": true|false, "error": "<code>"?, "data": ...?}`
- Rate limit: 180 req/min per user, 20-burst
- Path style is PascalCase resources nested under `/accounts/{account}/...`