Making requests

The anatomy of an authenticated REST request, and what every call needs.

Every authenticated REST request is the same four parts: a method, a full URL, the headers below, and a JSON body.

POST /api/3/account HTTP/1.1
Host: trade-uk.sandbox.zodiamarkets.com
Rest-Key: <your API key>
Rest-Sign: <generated signature>
Content-Type: application/json

{ "tonce": 1737552000000000 }

Headers

All three are required on every call.

Header	Value
`Rest-Key`	Your API key
`Rest-Sign`	The signature generated for this request
`Content-Type`	`application/json`

The body

Every request body carries a tonce — the current Unix time in microseconds, not milliseconds.

{
  "tonce": 1737552000000000
}

The signature is computed over the body, so tonce has to be set before signing rather than added afterwards. The helpers on the authentication page do this for you.

Common calls

The panel alongside shows the three calls most integrations start with — account balances, a WebSocket token, and a filtered transaction list — in Python, JavaScript, Java and Go.

Each assumes the signing helper from Authentication; substitute your own HTTP client if you have one.