How Barfinex Works
Provider API boundary
Public-safe overview of Barfinex Provider: public market-intelligence projections and private authenticated runtime operations.
Overview
The Provider is the private runtime gateway for Barfinex trading systems. It exposes authenticated REST and WebSocket surfaces for Studio and operators. The public website uses only narrow, read-only market-intelligence projections that are sanitized by website API routes.
- REST base:
{baseUrl}/apiwherebaseUrlis your HTTPS Provider origin. - WebSocket:
{baseUrl}/ws(Socket.IO, path/ws) - Auth: Provider-issued credentials are required for private runtime use.
Interactive API docs: {baseUrl}/docs. OpenAPI JSON: {baseUrl}/docs-json.
Main capability areas
Provider publishes the current route contract through OpenAPI. Public content should describe capabilities, not maintain a second endpoint inventory.
| Area | Capability |
|---|---|
| Public website | Read-only market-intelligence projections such as public candles, indicator snapshots, indicator history, and screener summaries |
| Private market data | Authenticated assets, symbols, candles, trades, order book, connectors, and subscriptions for Studio/operator use |
| Options analytics | Public pages may show sanitized educational aggregates only; private candidates, paper orders, readiness, broker proof, and evidence stay in Provider/Studio |
| Market anomaly education | Public pages may explain delayed aggregate anomaly categories only; private candidates, focus plans, labels, source refs, and runtime review stay in Provider/Studio |
| Private trading runtime | Authenticated account state, order lifecycle, risk-governed controls, replay, and operator diagnostics |
| Private app surfaces | Provider-routed Detector, Advisor, Inspector, Auditor, EventSink, and real-time event catalog capabilities |
Published app capabilities
The Provider exposes selected Advisor, Inspector, Detector, and Auditor capabilities through Provider-owned private routes. Use the Provider OpenAPI document for exact current methods and paths in authenticated environments. Do not call downstream services directly and do not treat capability groups as wildcard contracts.
App Registry
Apps register with the Provider so Studio and operators can see runtime availability, app type, heartbeat state, and published capabilities. These are private runtime surfaces, not public website APIs. Exact registry methods and filters are defined by Provider OpenAPI.
WebSocket API
- URL:
{baseUrl}/ws, path/ws - Namespaces: default (main events),
/eventsink(audit/analytics stream)
Catalog of events: GET /api/ws/events/catalog returns all WS event names with short descriptions (EN/RU).
Default namespace: subscribe to event names returned by the event catalog. The catalog is the public contract; internal bus channel names and routing details belong to the trading runtime docs.
Client → server: health (get health:ok), message (example).
EventSink namespace: private audit/analytics stream for authenticated Studio and operator tooling. Public website routes do not expose EventSink records.
Common enums
- ConnectorType: e.g.
binance,alpaca,testnetBinanceFutures - MarketType:
spot,futures,margin,options - TimeFrame (candles):
min1,min5,min15,min30,h1,h2,h4,day,week,month - OrderSide:
BUY,SELL - OrderType:
MARKET,LIMIT,STOP_MARKET,TAKE_PROFIT_MARKET, …
Next steps
- Building with the API — Use public-safe projections on the website and authenticated Provider routes in private runtime environments
- Options analytics boundary — Public-safe options aggregates without trading authority
- Market anomaly education boundary — Delayed aggregate anomaly categories without runtime authority
- Detector API, Inspector API, Advisor API — Proxied endpoints