TraderMemos
API Reference

Auth

Setup / registration status

GET/api/v1/setup/status

Response Body

application/json

curl -X GET "https://example.com/api/v1/setup/status"
{  "needs_setup": true,  "registration_open": true,  "user_count": 0,  "min_password_length": 0}

Complete first-user setup

POST/api/v1/setup

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/setup" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com",    "password": "stringstri"  }'
{  "access_token": "string",  "refresh_token": "string",  "is_admin": true}

Login

POST/api/v1/auth/login

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/auth/login" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com",    "password": "stringstri"  }'
{  "access_token": "string",  "refresh_token": "string",  "is_admin": true}

Refresh access token

POST/api/v1/auth/refresh

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/auth/refresh" \  -H "Content-Type: application/json" \  -d '{    "refresh_token": "string"  }'
{  "access_token": "string",  "refresh_token": "string",  "is_admin": true}

Register (when registration is open)

POST/api/v1/auth/register

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/auth/register" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com",    "password": "stringstri"  }'
{  "access_token": "string",  "refresh_token": "string",  "is_admin": true}

The signed-in user

GET/api/v1/me

Authorization

bearerAuth
AuthorizationBearer <token>

Session JWT access token or personal access token (tm_pat_…).

In: header

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/me"
{  "id": "string",  "email": "user@example.com",  "is_admin": true,  "created_at": "2019-08-24T14:15:22Z",  "totp_enabled": true}

Change your own password

PUT/api/v1/me/password

Re-hashes after verifying the current password. Every refresh token minted against the old password stops working, so other devices are signed out at their next refresh; a fresh pair is returned so the caller is not. Access tokens already issued remain valid until they expire (15 minutes).

Authorization

bearerAuth
AuthorizationBearer <token>

Session JWT access token or personal access token (tm_pat_…).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X PUT "https://example.com/api/v1/me/password" \  -H "Content-Type: application/json" \  -d '{    "current_password": "string",    "new_password": "string"  }'
{  "access_token": "string",  "refresh_token": "string",  "is_admin": true}

Begin authenticator setup

POST/api/v1/me/totp/start

Mints a candidate secret and its otpauth:// URL. Nothing is stored until /me/totp/confirm proves a code can be read from it, so the client holds the candidate between the two calls.

Authorization

bearerAuth
AuthorizationBearer <token>

Session JWT access token or personal access token (tm_pat_…).

In: header

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/me/totp/start"
{  "secret": "string",  "otpauth_url": "string"}

Finish authenticator setup

POST/api/v1/me/totp/confirm

Authorization

bearerAuth
AuthorizationBearer <token>

Session JWT access token or personal access token (tm_pat_…).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/me/totp/confirm" \  -H "Content-Type: application/json" \  -d '{    "secret": "string",    "code": "string"  }'
Empty

Turn off two-factor

POST/api/v1/me/totp/disable

Requires the password as well as a current code, so a borrowed unlocked session cannot strip the factor. POST rather than DELETE because it carries a body.

If the authenticator is lost, the recovery path is shell access to the server: tradermemos disable-totp --email you@example.com. There are deliberately no recovery codes to store or lose.

Authorization

bearerAuth
AuthorizationBearer <token>

Session JWT access token or personal access token (tm_pat_…).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/v1/me/totp/disable" \  -H "Content-Type: application/json" \  -d '{    "password": "string",    "code": "string"  }'
Empty

Account-level client preferences

GET/api/v1/me/preferences

An opaque JSON object owned by the clients — timezones, clock format, display currency, trade date basis, screenshots cap. The server never reads inside it. Empty until something is stored.

Authorization

bearerAuth
AuthorizationBearer <token>

Session JWT access token or personal access token (tm_pat_…).

In: header

Response Body

application/json

curl -X GET "https://example.com/api/v1/me/preferences"
{  "prefs": {},  "updated_at": "2019-08-24T14:15:22Z"}

Merge preferences

PATCH/api/v1/me/preferences

Merges per key: keys not sent are left alone, so two devices editing different preferences do not clobber each other. An explicit null is stored as null (displayCurrency: null means "follow the account").

Authorization

bearerAuth
AuthorizationBearer <token>

Session JWT access token or personal access token (tm_pat_…).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

curl -X PATCH "https://example.com/api/v1/me/preferences" \  -H "Content-Type: application/json" \  -d '{}'
Empty

Health

Previous Page

Access tokens

Next Page