DXtrade API: Connect a Trading Bot to Velotrade

The DXtrade API is how you connect your own bot, algo, or AI model to a Velotrade funded account and trade it programmatically. Velotrade gives every account full REST and Push (WebSocket) API access with no extra fee and no approval step, which is rare among prop firms. This guide is the practical, Velotrade-specific path from no integration to a working, read-only connection, and then to safe order placement once you have reviewed the live rules.

It is a technical setup guide, not trading or financial advice. Start read-only, verify everything against your own account, and review the current Velotrade rules before you place a single live order.

What You Can Build

The API is the same programmatic interface used by professional trading desks, available on every Velotrade evaluation and funded account. Common builds include:

• Algorithmic trading engines: bots, services, or strategy engines written in any language that can call the DXtrade REST and Push APIs. Existing MT4/MT5 EAs are not directly compatible unless they are ported or connected through a suitable adapter.
• Signal automation: an external signal feed routed into live order execution.
• Real-time risk dashboards: reading equity, drawdown, and margin over WebSocket to monitor account state live.
• Quantitative strategies: full systematic strategies with defined entry, exit, and position sizing. For the wider methodology, see quant trading and how to build a trading bot.

Automated trading is permitted on Velotrade evaluation and funded accounts, but automation stays subject to the current Terms, Trading Rules, account and plan conditions, instrument restrictions, and technical rate limits. Automating an action does not exempt it from any applicable rule. The live Terms and API access page remain controlling.

Before You Start

You will need:

• A Velotrade challenge-account username and password.
• Node.js 20 or later, or Python 3.10 or later.
• Access to the current official Velotrade website for the pre-order rules check.

Your trading-account username and password are also your DXtrade API credentials. Do not paste them into source code, a public repository, or an AI conversation. Store them in a local environment file that is excluded from version control, and never print or log the session token.

Velotrade Connection Values

These are the live-verified Velotrade endpoints. The full reference lives on the Velotrade developer portal.

Two details catch people out. The business Push URI's trailing slash is required, the version without it returns a 404. And the website login's vendor=velotrade parameter is not the REST login domain: the REST domain is default.

Velotrade client integrations use REST and Push (WebSocket) only. FIX Trading and FIX Market Data are not currently supported or provisioned, and the existence of generic DXtrade FIX specifications does not imply a usable Velotrade FIX gateway or account entitlement.

Step 1: Authenticate

Authentication uses your trading-account credentials to obtain a session token.

POST https://dx.velotrade.com/dxsca-web/login
Content-Type: application/json

{
  "username": "<USERNAME>",
  "domain": "default",
  "password": "<PASSWORD>"
}

A successful login returns a sessionToken and a timeout (the tested inactivity timeout was 30 minutes). Send the token in the Authorization: DXAPI <sessionToken> header on REST calls, and in the session field of Push messages.

Keep the session alive with POST /ping, which renews the REST inactivity timeout. On a planned shutdown, call POST /logout. Note that the logout endpoint can return a 200 with an empty body, so read the body as text and only parse JSON when it is not empty.

If login returns HTTP 500 with error code 110, stop retrying. DXtrade has confirmed that this is a generic mapping used when authentication returns neither a clean SESSION nor REJECT result. Known triggers include an expired password and pending MFA enrolment or challenge, but error 110 does not identify the exact pending step and does not by itself prove a server outage. Complete any required web-side password or MFA flow through the Velotrade web interface, then retry the documented REST login once.

Step 2: Discover Your Account

Never use the account number shown in the trading interface on its own. Call:

GET /users

Select the intended account after checking its accountStatus (for example FULL_TRADING, not an old NO_TRADING account), currency, and position mode. Use its full account value, which looks like default:<ACCOUNT_NUMBER>. When you put it in a path, URL-encode the colon as %3A:

default%3A<ACCOUNT_NUMBER>

Using only the visible number causes 404 errors on account-specific paths and a Push subscription reject.

Step 3: Discover Instruments

Do not assume symbols or order sizes. Query the account's own instrument catalogue:

GET /accounts/{encodedAccountCode}/instruments/query

Read each instrument's symbol, tradingStatus, minOrderSize, maxOrderSize, minOrderSizeIncrement, marginRate, and assetClass. Velotrade is multi-asset: tested fresh accounts exposed instruments across crypto, forex, equities, indices/ETFs, and commodities. Availability remains account-specific, so always use account-specific instrument discovery before assuming that an asset class or symbol is available.

Quantity units are asset-specific. On the tested deployment, forex instrument discovery expressed sizes in lots, but the order endpoint required base-currency units, so the working mapping was lots multiplied by 100,000 (EURUSD minimum 0.01 lots became 1,000 units). Do not generalise that mapping to other asset classes or accounts. Confirm the current instrument response for your own account before sizing an order.

Step 4: Read Account Data (Read-Only)

Start with read-only calls. These never change account state:

GET /accounts/{account}/metrics
GET /accounts/{account}/portfolio
GET /accounts/{account}/positions
GET /accounts/{account}/orders
GET /accounts/{account}/orders/history
GET /accounts/{account}/instruments/query
POST /marketdata

REST and Push do different jobs. Use whichever fits, and use both for a durable system.

A robust long-running algorithm takes a REST snapshot, listens on Push for updates, and takes a fresh REST snapshot again after any reconnection before trusting its local state.

Step 5: Stream Live Data With the Push API

Business events and market data use two separate sockets. Subscribe with your session token. For example, a market quote subscription on the market-data socket:

{
  "type": "MarketDataSubscriptionRequest",
  "requestId": "<UNIQUE_ID>",
  "timestamp": "<CURRENT_UTC_TIMESTAMP>",
  "session": "<REST_SESSION_TOKEN>",
  "payload": {
    "account": "default:<ACCOUNT_NUMBER>",
    "symbols": ["<DISCOVERED_SYMBOL>"],
    "eventTypes": [{ "type": "Quote", "format": "COMPACT" }]
  }
}

Account portfolio, metrics, events, instrument details, quotes, and 5-minute candles are all verified on the sockets. Correlate replies using inReplyTo, handle Reject messages, reply to a PingRequest with a Push Ping, and reconnect with exponential back-off and jitter. On WebSocket close code 1013 (backpressure), consume faster or reduce load before retrying. Close each subscription explicitly on shutdown with its matching close request.

Placing Orders Safely

Only place orders after your read-only workflow is solid and you have completed the live rules check below. The new-order endpoint is:

POST /accounts/{encodedAccountCode}/orders

Technical invariants that prevent the most common failures:

• orderCode must be client-generated and unique on the account.
• Include an explicit, compatible tif. The controlled tests used GTC for market opens, closes, and protective stops.
• Take symbols and quantities from your own instrument discovery, not from assumptions or public examples.
• A 200 response with orderId and updateOrderId is an acknowledgement, not proof of execution. Orders can still be rejected (for example a forex size below the minimum). Always confirm the outcome:

GET /accounts/{encodedAccountCode}/orders/history?with-order-id={orderId}

Record the final status, reject reason, and any executions. A timeout is not proof of rejection: reconcile through order history before you retry anything. Never blindly retry a trade.

Ready to run your strategy on funded capital? Start a challenge →

The live rules check before any order

Technical API success is not proof of rule compliance. Before enabling any live order, review the current official Velotrade pages: terms, rules, risk disclosures, the API access page, the FAQ, and instruments. The evaluation rules, including the daily loss limit and the static maximum drawdown, apply to API activity exactly as they apply to manual trades. This guide deliberately does not restate the rules, because the live website is the source of truth and rules can change.

Closing Positions and Shutting Down

Closing your software or a WebSocket does not close positions or cancel orders. To close a position, submit a closing order with positionEffect: "CLOSE", the retrieved positionCode, the opposite side, a matching instrument, a new unique orderCode, and tif: "GTC". For a full close, omit the quantity so the current position size is used, then verify that the target position has disappeared and that no associated closing or protective order remains working. In an isolated connectivity smoke test whose authorised final state is flat, also verify that total positions and working orders are zero.

On a planned shutdown: stop new actions, reconcile in-flight requests, confirm positions and working orders, send explicit close requests for active Push subscriptions, close the sockets, then log out the REST token.

Common Errors

DXtrade documents configurable defaults of one login request per second per IP, ten read requests per second per session, ten trading requests per second per session, and one large-data or historical request per second per session. These are standard DXtrade defaults, not guaranteed Velotrade limits. Honour any 429 and keep conservative client-side limits.

Build Faster With the AI Knowledge Base

We package everything above as a downloadable AI Knowledge Base you can upload into a ChatGPT or Claude project so an assistant can help you build against the Velotrade DXtrade API. It includes the connection reference, REST and Push guides, worked examples, a safety and mutation-gate workflow, and validation questions. The latest version also instructs the assistant to confirm your account type, challenge plan, and current phase before touching credentials, and documents that Velotrade is REST and Push only, with no FIX connectivity.

Download the Velotrade DXtrade AI Knowledge Base (.zip)

It is architecture-neutral and read-only by default: mutation support stays disabled unless you provide explicit bounded authorisation and complete the documented safety gate. It never contains credentials, and it directs any assistant to the live Velotrade website for current rules before any order. It is a technical aid only, not trading advice.

Next Steps

You now have the full connection path: authenticate, discover, read-only data, stream, and place orders under the live rules check. For the strategy side, read how to build a trading bot and backtesting trading strategies. For which prop firms genuinely allow automation, see best crypto prop firms for algo traders. When your system is tested and ready, view the challenge options to run it on funded capital.

---

This guide is provided to facilitate technical implementation only. It is general informational material and is not legal, regulatory, compliance, tax, financial, investment, risk-management, or trading advice. Velotrade provides education and simulated trading only and is not a broker, bank, or regulated financial institution. DXtrade is a third-party platform whose interfaces and behaviour can change. The trader and implementer are responsible for design, testing, supervision, credential security, risk controls, and compliance with the current official Velotrade website and applicable law. If this guide conflicts with a current official Velotrade page, the official page controls.