Crypto trading glossary: API and trading software terms
A trading API glossary for people who build, buy or review trading software. It has 262 terms in 10 topics, from API keys and rate limits to order types, reconciliation, testing and regulation, each with a short definition and, where it matters, how platforms differ.
Official documents read on November 5, 2026
Where the definitions come from
Definitions are in plain words, and terms run alphabetically inside each topic. Where a definition states a specific rule, it comes from an official document listed under Sources, read on November 5, 2026. Platform documents change, so check the current version before you rely on a value.
Platform names show how official documents differ. They are not recommendations or a ranking, and they do not mean that Fincode has integrated or will integrate that platform. Which platforms you may use depends on your country's law and the platform's terms.
For readers in Turkey: Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized. See the entry on that article for what counts.
What this page is not
- A recommendation of any coin, platform, strategy or setting
- Investment, legal or tax advice
- A statement that a named platform is authorized in your country
- A promise that any software or set of rules will make money
Authentication and keys
How software proves who it is to a platform, and how those credentials are limited and stored.
API key
A credential a platform issues so software can call private endpoints on your account. It identifies the caller, and a secret or private key usually proves the request is genuine. Guide: Create an exchange API key
API key permissions
The actions a key may perform, and the labels do not mean the same thing everywhere. OKX's Trade permission also covers funding transfers, for example, while Kraken lists finer rights such as Query Funds and Cancel/Close Orders. Guide: API key security for trading bots
API secret (secret key)
The private part of an HMAC key, used to sign requests and not sent with them. Many platforms show it only once, so losing it means creating a new key. Guide: API key security for trading bots
API wallet (agent wallet)
On Hyperliquid, a separate key that a main account approves to sign on its behalf, so the main wallet key can stay off the server. The official SDK example says an agent cannot transfer or withdraw funds, though the exchange endpoint page lists agent-signed moves that stay within the same address. Guide: Hyperliquid API in Python
ECDSA
The Elliptic Curve Digital Signature Algorithm, specified in FIPS 186-5. Coinbase App API keys use ES256, the RFC 7518 name for ECDSA with the P-256 curve and SHA-256. Guide: Coinbase Advanced Trade API in Python
Ed25519
An elliptic-curve signature scheme (EdDSA on edwards25519) defined in RFC 8032 and included in FIPS 186-5. Binance recommends it and requires it for FIX sessions, while Coinbase says its App APIs do not support it. Guide: Ed25519 API keys
Environment separation
Using different keys, hosts and settings for development, testing and production, so a test build cannot touch a live account. Guide: API key security for trading bots
HMAC
A keyed-hash message authentication code, computed with a secret both sides hold and defined in RFC 2104 and FIPS 198-1. OKX and KuCoin use it with SHA-256 and Kraken Spot REST with SHA-512, while Binance now calls its HMAC keys deprecated. Guide: API signature generation
HSM (hardware security module)
A tamper-resistant device that generates and uses keys without exposing them to the host computer. FIPS 140-3 sets the US federal security requirements for cryptographic modules, including such devices. Guide: API key security for trading bots
IP allowlist (IP whitelist)
A list of source addresses from which a key may be used, with requests from anywhere else refused. Support differs: OKX binds up to 20 addresses per key and expires unbound keys with trade or withdraw rights after 14 days of inactivity. Guide: API key security for trading bots
JWT (JSON Web Token)
A compact token carrying claims, usually signed, defined in RFC 7519. Coinbase expects a new JWT for each API request and states that each one expires after 2 minutes. Guide: Coinbase Advanced Trade API in Python
Key revocation
Disabling a key so that it can no longer be used, usually from the platform's API management page. It is the first step after a suspected leak. Guide: API key security for trading bots
Key rotation
Replacing a key on a schedule or after a suspected leak: create the new key, deploy it, then revoke the old one. NIST SP 800-57 calls the time a key is authorized for use its cryptoperiod. Guide: API key security for trading bots
Nonce
A number used once, which stops a captured request from being accepted again. Kraken requires an always-increasing integer per API key, while Hyperliquid keeps the 100 highest nonces per signer. Guide: Kraken API invalid nonce
OAuth 2.0
A framework (RFC 6749) that lets a third-party application get limited access through tokens instead of the user's password. Some platforms, such as the Coinbase App, offer it alongside API keys. Guide: Schwab API in Python
Passphrase
A third credential you choose when creating a key, required alongside the key and secret on platforms such as OKX and KuCoin. OKX stores only a salted hash of it and cannot recover a lost one. Guide: OKX API in Python
Read-only key
A key limited to viewing data such as balances, orders and trade history. It cannot place orders, which suits reporting and portfolio tracking. Guide: Crypto portfolio tracker API
Replay attack
Sending a captured, validly signed request again to make it run a second time. Nonces and short timestamp windows limit it. Guide: API signature generation
Request signature
A value computed from the request and a secret or private key, which lets the server check who sent the request and that nobody altered it. What gets signed differs by platform: OKX signs the timestamp, method, path and body, while Kraken signs the path and a hash of the nonce and data. Guide: API signature generation
RSA key
An asymmetric key pair: you register the public key with the platform and sign with the private key, which stays with you. FIPS 186-5 specifies RSA signatures, and Binance and Bybit accept RSA keys. Guide: API signature generation
Secrets manager
A service that stores credentials encrypted and gives them to software at run time, with access control and audit logs. It keeps keys out of code, repositories and configuration files. Guide: API key security for trading bots
SHA-256
A hash function from FIPS 180-4 that turns its input into a fixed 256-bit digest. In API signing it usually runs inside HMAC. Guide: API signature generation
Sub-account
A separate account under a main account, usually with its own balances and keys, which keeps one program's activity apart from another's. Whether rate limits count per sub-account or per main account differs by platform. Guide: API key security for trading bots
Timestamp window (recvWindow)
The period in which a server accepts a signed request, measured against its own clock. Binance's
recvWindowdefaults to 5,000 ms and allows up to 60,000 ms, Bybit's default is also 5,000 ms, and OKX rejects requests more than 30 seconds from server time. Guide: Binance API error codesTLS
Transport Layer Security, the encryption under HTTPS and secure WebSocket (
wss) connections. RFC 8446 specifies version 1.3, which is designed to prevent eavesdropping, tampering and message forgery.Two-factor authentication (2FA)
A second proof of identity beyond a password, often a time-based one-time code (TOTP) from RFC 6238, whose default time step is 30 seconds. On Kraken's Spot REST API, a key with 2FA set must also send an
otpparameter. Guide: Create an exchange API keyWallet private key
The key that controls a blockchain address, so whoever holds it can move the funds. Unlike an exchange API key, no platform can revoke it. Guide: Hyperliquid API in Python
Withdrawal permission
The right for a key to move funds off the platform. Placing orders does not require it, and Fincode does not ask for it. Guide: API key security for trading bots
REST, WebSocket and FIX
The main ways software talks to a platform, and the parts of each that tend to cause trouble.
API
An application programming interface: the documented requests a system accepts from other software. A crypto trading API usually covers market data, account data and orders. Guide: What is a crypto API
API deprecation
A platform's notice that an endpoint, field or host will be retired. OKX's order book checksum and Binance Spot's
listenKeyuser data stream are recent examples, so someone has to watch each changelog. Guide: Trading bot not workingCCXT
An open-source library that gives many exchanges one programming interface, with unified symbols and error types. Each exchange's own limits and terms still apply. Guide: CCXT Python trading bot
Connector (adapter)
The module that translates between your software's internal format and one platform's API, including signing, limits and error codes. A multi-platform system has one per platform. Guide: Crypto order management system
Endpoint
One address and method for one operation, such as
GET /api/v3/depthfor an order book on Binance Spot. Guide: What is a crypto APIFIX protocol
Financial Information eXchange, a standard message format for orders and executions, built from numbered tag and value pairs such as
35=D. Binance Spot and Kraken document FIX 4.4 connections, with different access conditions. Guide: Broker API integrationFIX session
A long-lived conversation between an initiator and an acceptor, in which every message is numbered and both sides repair gaps. Its rules sit in a session layer standard, separate from the business messages. Guide: Broker API integration
Heartbeat (35=0)
A FIX message sent during quiet periods to show the session is alive. HeartBtInt(108) is the maximum time allowed between messages from the peer. Guide: Broker API integration
HTTP status code
A three-digit result code on every HTTP response, where 2xx means success, 4xx a client error and 5xx a server error (RFC 9110). Platforms also put their own codes in the response body, such as Bybit's
retCode, so software has to check the body as well as the status. Guide: Binance API error codesLogon (35=A)
The message that opens a FIX session. It must carry HeartBtInt(108), the heartbeat interval both sides then use. Guide: QuickFIX Python
MsgSeqNum (34)
The sequence number on every message in a FIX session. A jump shows that messages were lost, and the session layer sets out how to recover them. Guide: Broker API integration
NewOrderSingle (35=D)
The FIX application message that submits one new order for execution, identified by the sender's ClOrdID(11). Guide: QuickFIX Python
Pagination
Returning a long result set in pages, through a cursor, an ID or a time range. History downloads have to follow it within the rate limit, and the method differs by platform. Guide: Crypto portfolio tracker API
Ping and pong
Control frames in RFC 6455 that check a connection is alive; whoever receives a ping must answer with a pong carrying the same data. Platforms add their own rules: Binance Spot's server pings every 20 seconds, while OKX and Bybit expect the client to send its own ping message. Guide: WebSocket heartbeat and reconnect
Polling
Asking a REST endpoint for changes again and again. It is simple, but it adds delay and spends rate-limit budget that a stream would save. Guide: Binance API rate limit
Public and private endpoints
Public endpoints serve market data and need no key. Private endpoints serve account data and orders, and need a key and usually a signature. Guide: What is a crypto API
Reconnect and resubscribe
Opening a dropped connection again, waiting longer after each failure, then subscribing again and rebuilding state, since most streams do not replay what you missed. Binance Spot closes stream connections at 24 hours, so reconnecting is normal operation. Guide: WebSocket heartbeat and reconnect
ResendRequest (35=2)
A FIX message asking the peer to send a range of messages again after a gap. Retransmitted messages keep their original MsgSeqNum(34) and carry PossDupFlag(43)=Y. Guide: QuickFIX Python
REST API
An interface over HTTP in which each request stands alone and gets one response. Trading software uses it for orders, account queries and history. Guide: Crypto exchange API integration
Rules of engagement
A counterparty's document describing how it uses FIX, such as versions, required fields and timing thresholds. Read it before connecting, because the standard leaves these details to each service. Guide: Broker API integration
SBE (Simple Binary Encoding)
A FIX Trading Community standard for compact binary messages, designed for low latency. Binance Spot can return responses in SBE instead of JSON.
SDK
A library that wraps an API in a programming language and handles details such as signing. Some platforms publish official ones, such as pybit for Bybit and coinbase-advanced-py for Coinbase, and coverage varies. Guide: Bybit API in Python
SequenceReset (35=4)
With GapFillFlag(123)=Y, a FIX message that skips over messages the sender chooses not to retransmit, such as orders that have gone stale. Guide: QuickFIX Python
Subscription (channel, topic)
A request on a WebSocket for a named feed, such as one symbol's order book. The name varies: streams on Binance, channels on OKX, Kraken and Coinbase, topics on Bybit. Guide: Crypto exchange API integration
TestRequest (35=1)
A FIX message that asks the peer to reply with a heartbeat echoing its TestReqID(112). No valid reply counts as an error, and the connection should be ended. Guide: Broker API integration
TradingView webhook
An HTTP POST that TradingView sends to a URL when an alert fires. TradingView's Terms of Use (opens in a new tab), read November 5, 2026, license alerts and webhooks for display use only and prohibit using them for automated trading, including through third-party products.
User data stream
A private feed of your own order, fill and balance events. Binance Spot now delivers it through a subscription on its WebSocket API, and its older
listenKeymethod was retired on February 20, 2026. Guide: Binance user data streamWebhook
An HTTP request a system sends to a URL you run when an event occurs, such as a payment update. The receiver should verify the sender and handle repeats, because providers such as Stripe retry deliveries. Guide: iyzico API integration
WebSocket
A long-lived, two-way connection over TCP, opened with an HTTP handshake and defined in RFC 6455. Platforms use it to push market data and account events, and some accept orders over it. Guide: Binance WebSocket API and streams
WebSocket stream and WebSocket API
A stream pushes data you subscribe to, while a WebSocket API takes requests and returns responses, including order placement. Binance Spot runs the two as separate services on different hosts. Guide: Binance WebSocket API and streams
Rate limits
How platforms cap traffic, and what each kind of refusal means.
API call counter
Kraken's Spot REST limit: most calls raise a per-key counter, which falls over time at a rate set by verification tier, while calls that add or cancel orders use a separate limiter. Passing the tier's maximum returns
EAPI:Rate limit exceeded. Guide: Kraken API in PythonExponential backoff
Waiting longer after each failed attempt, often doubling the delay up to a cap, so that retries do not add to the overload. Guide: Crypto exchange API integration
Fixed and sliding windows
A fixed window resets its count at set times, while a sliding window always counts the most recent period. Binance's WebSocket API documents fixed intervals that reset on the minute, Bybit describes its per-user limit as a rolling window, and not every platform says which kind it uses. Guide: Binance API rate limit
HTTP 403
The Forbidden status, whose cause varies by platform. Binance returns it when a web application firewall rule is violated, and Bybit for excess request frequency and for restricted locations. Guide: Binance API error codes
HTTP 418
A code RFC 9110 lists as unused and reserved. Binance uses it to report that an IP address has been banned automatically for continuing to send requests after 429 responses. Guide: Binance API rate limit
HTTP 429
The Too Many Requests status from RFC 6585, which may come with a Retry-After header. A client that receives it should stop and wait. Guide: Binance API rate limit
HTTP 451
Unavailable For Legal Reasons, defined in RFC 7725: access is denied because of a legal demand. It is not a code problem to fix or to route around. Guide: Binance API error codes
IP ban
A temporary block on an address after repeated breaches. Binance's bans grow from 2 minutes to 3 days for repeat offenders and Bybit says to wait at least 10 minutes; the remedy is to slow down, not to switch addresses. Guide: Binance API rate limit
Jitter
A random amount added to a retry delay, so that many clients that failed together do not all retry at the same moment. Guide: WebSocket heartbeat and reconnect
Order rate limit
A separate cap on how many orders you may place per period. Binance Spot counts new orders that remain unfilled, per account and across all of its API keys. Guide: Binance API rate limit
Rate limit
A cap on how many requests a client may make in a period, counted per IP address, key, account or endpoint depending on the platform. Breaches look different too: HTTP 429 on Binance, error 50011 on OKX,
retCode10006 on Bybit andEAPI:Rate limit exceededon Kraken. Guide: API rate limit exceededRate-limit budget
A plan that splits a limit among tasks such as trading, market data and reconciliation, so a background job cannot use up the allowance that orders need. Guide: Binance API rate limit
Rate-limit headers
Response headers that report how much of a limit is used or left, such as
X-MBX-USED-WEIGHT-1Mon Binance andX-Bapi-Limit-Statuson Bybit. Reading them lets software slow down before it is refused. Guide: Binance API rate limitRequest weight
A cost assigned to each endpoint, so heavy calls use more of a shared budget per time window. Binance counts it per IP address rather than per key, so programs on one server share the budget. Guide: Binance API rate limit
Retry-After
An HTTP response header (RFC 9110) giving a number of seconds or a date to wait before trying again. Binance sends it with 429 and 418 responses. Guide: Binance API rate limit
Throttling
Slowing requests to stay inside a limit, done by your own software or by the server. Kraken returns
EService: Throttledwhen there are too many concurrent requests. Guide: Kraken API in PythonToken bucket
A limiter in which tokens refill at a steady rate and each request spends some, which allows short bursts up to the bucket's size. Client software often uses this or a similar limiter to stay under a platform's limit, and CCXT defaults to a leaky bucket. Guide: CCXT rate limit and error handling
WebSocket limits
Caps on connection attempts, messages and subscriptions. Binance Spot's stream host allows 5 incoming messages per second, 1,024 streams per connection and 300 connection attempts per 5 minutes per IP address. Guide: Binance WebSocket API and streams
Orders and time in force
Order types and lifetimes. The general meaning is shared, while names and flags differ by platform.
Amend and cancel-replace
Changing a working order, by editing it in place or by canceling it and placing a new one, with an effect on queue position that depends on the platform. Binance Spot's cancel-replace can partly succeed, in which case it returns HTTP 409.
Bracket order
An entry order linked to exit orders on both sides of the price. Support and structure vary; Coinbase, for example, has a trigger bracket configuration that can attach to a parent order. Guide: OCO order
Client order ID
An ID your software assigns before sending an order, so it can find the order even if the response is lost. FIX's ClOrdID(11) must be unique within a trading day, Binance's
newClientOrderIdamong open orders, and Coinbase returns the existing order when aclient_order_idrepeats. Guide: Client order IDDay order
An order that expires at the end of the trading day if not filled, and the FIX default when no time in force is sent. Markets that trade around the clock, such as most crypto spot markets, often have no equivalent. Guide: Time in force
EMS (execution management system)
Software that works out how and where a live order gets filled, through market views, venue connections, slicing and routing. These are market terms rather than legal categories, and products often merge EMS and OMS functions. Guide: Crypto order management system
FOK (fill or kill)
An order that must fill completely right away or not at all. Binance Spot reports one that could not fill as
EXPIRED, not as rejected. Guide: Time in forceGTC (good till canceled)
An order that stays active until it is filled or canceled. Platforms can add limits: Binance USD-M futures states that GTC validity is 1 year from placement. Guide: Time in force
GTD (good till date)
An order that stays active until a set expiry, given in FIX by ExpireDate(432) or ExpireTime(126). Kraken takes the time in
expiretm, and Binance USD-M futures ingoodTillDate. Guide: Time in forceGTX (good till crossing)
In FIX, an order canceled before the market enters an auction or crossing phase. Binance USD-M futures uses the same letters for its post-only option, so read the platform's own definition. Guide: Time in force
Iceberg order
A limit order that shows only part of its size on the book and keeps the rest hidden. Binance Spot sets the visible part with
icebergQtyand Kraken withdisplayvol. Guide: Execution algorithmsIdempotency
The property that repeating an operation has the same effect as doing it once. RFC 9110 gives it to PUT, DELETE and safe methods but not to POST, so order retries rely on a client order ID and a status query. Guide: Client order ID
IOC (immediate or cancel)
An order that fills as much as it can right away and cancels the rest. It never rests on the book. Guide: Time in force
Limit order
An order to trade only at a set price or better. Any part that cannot trade at once may rest on the book, depending on its time in force. Guide: Time in force
Maker and taker
The maker is the order that was resting on the book when a trade happened, and the taker is the order that matched it on arrival. Fee schedules often differ between the two. Guide: Time in force
Market order
An order to trade right away at the prices available on the book, with no limit price of your own. The average price can differ from the last price, and the gap tends to grow with the size of the order. Guide: Slippage in crypto
OCO (one cancels the other)
A pair of linked orders in which the execution of one cancels the other. Binance Spot places it as an order list, and not every platform offers it. Guide: OCO order
OMS (order management system)
Software that records each intended order, checks it against limits, sends it through a connector and follows it to a final state. For your own account it is software; handling other people's orders is a regulated service in many jurisdictions. Guide: Crypto order management system
Order state machine
A model that allows an order only defined status changes, driven by platform events rather than by your own requests. A final state such as filled stays final. Guide: Crypto order management system
Order status
The state a platform reports for an order. Common values are new, partially filled, filled, canceled, rejected and expired, as in Binance's
statusand FIX's OrdStatus(39), with platform-specific extras. Guide: Crypto order management systemOTO (one triggers the other)
A linked pair in which a working order must fill before the second, pending order goes active. Binance Spot documents it as an order list. Guide: OCO order
Position mode (one-way or hedge)
On derivatives, one-way mode keeps a single net position per contract, while hedge mode holds long and short positions separately. In hedge mode an order has to name the side, through
positionSideon Binance USD-M futures andpositionIdxon Bybit. Guide: Reduce only orderPost-only order (maker-only)
A limit order that is rejected or canceled instead of matching on arrival, so it can only add liquidity. It appears as
LIMIT_MAKERon Binance Spot,post_onlyon OKX,PostOnlyon Bybit andAloon Hyperliquid. Guide: Time in forceReduce-only order
An order on a leveraged position that can only shrink it, never open or enlarge it. Bybit, OKX, Kraken, Hyperliquid and Binance USD-M futures each offer it as a flag, and Binance does not accept the flag in hedge mode. Guide: Reduce only order
Smart order routing (SOR)
Logic that decides where to send an order, or how to split it, based on price, fees and available size. Binance's SOR works inside one exchange, across books with the same base asset and interchangeable quote assets. Guide: Smart order routing in crypto
Stop-limit order
A dormant order that becomes a limit order when a trigger price is reached. If the market moves past the limit price, it may not fill. Guide: OCO order
Stop-market order (stop loss)
A dormant order that becomes a market order when a trigger price is reached. Names vary:
STOP_LOSSon Binance Spot andSTOP_MARKETon Binance USD-M futures. Guide: OCO orderTake-profit order
A dormant order that triggers when the price reaches a set level on the favorable side of a position. Depending on the platform, it becomes a market or a limit order. Guide: OCO order
Time in force
The rule for how long an order stays active. FIX defines it in TimeInForce(59), where a missing value means Day, and crypto platforms support subsets of the values, usually including GTC, IOC and FOK. Guide: Time in force
Trailing stop
A stop whose trigger follows the price at a set distance when the price moves favorably and holds still when it reverses. Binance Spot sets the distance with
trailingDelta.TWAP (time-weighted average price)
An execution method that splits an order into smaller ones spaced over a period. Coinbase's Advanced Trade API has a TWAP order configuration. Guide: TWAP order
VWAP (volume-weighted average price)
The total value traded divided by the total volume over a period. It serves as a benchmark for fills and as the target of some execution methods. Guide: Execution algorithms
Fills and reconciliation
How to know what actually happened to an order, and how to check that your records agree with the platform's.
Audit trail
A time-stamped, append-only record of what was sent, who or what approved it and what the platform answered. It lets you explain any order later. Guide: Crypto order management system
Average cost
The total paid for a holding, with fees where the method includes them, divided by the quantity held. Which cost method applies for tax depends on your jurisdiction. Guide: Crypto portfolio tracker API
Average fill price
The total value of an order's fills divided by the total quantity filled. It is the number to compare with the price you expected. Guide: Transaction cost analysis
Backfill
Loading past records to complete history or close a gap after an outage, paced to stay inside the rate limit. Guide: Crypto portfolio tracker API
Blockchain confirmations
A count of the block that holds a transaction plus the blocks added after it. Each platform sets how many it waits for before crediting a deposit, and the number varies by network.
Cumulative filled quantity
The total executed on an order so far: CumQty(14) in FIX, with LeavesQty(151) as the part still open, and
zin Binance's execution report. Guide: Broker API integrationDrop copy
A separate read-only feed that repeats your order and trade messages, useful as an independent record. Binance Spot's FIX drop copy data is delayed by 1 second, so it suits checking rather than trading decisions. Guide: Crypto order management system
Duplicate order
The same order sent twice, usually by a retry after a timeout or a message delivered again. Client order IDs and a pre-trade check stop it, and US Rule 15c3-5 names duplicative orders among those broker-dealers must block. Guide: Client order ID
Execution report
The message that tells you what happened to an order: accepted, filled, canceled or rejected. In FIX it is ExecutionReport(35=8), and Binance's user data stream has an event of the same name. Guide: Broker API integration
Expired order
An order ended by the rules of its type or by the platform, not by you, such as the unfilled part of an IOC. Binance Spot reports it as
EXPIRED. Guide: Time in forceFill (execution)
A trade that completes all or part of an order, with its own price, quantity, fee and ID. One order can produce many fills. Guide: Crypto order management system
Ledger
An append-only record of every balance change: trades, fees, funding, deposits and withdrawals. Balances can then be recomputed and checked. Guide: Crypto portfolio tracker API
Partial fill
A fill for only part of an order's quantity, with the rest still working or canceled. Position logic must use the cumulative filled quantity, never the requested one. Guide: Crypto order management system
Realized and unrealized P&L
Realized profit or loss comes from closed trades, and unrealized from open positions valued at a current price. Derivatives platforms such as Binance use the mark price for the unrealized part. Guide: Crypto portfolio tracker API
Reconciliation
Comparing your records of orders, fills and balances with the platform's at start-up, after reconnects and on a schedule. An unexplained difference should block new orders until it is resolved. Guide: Position reconciliation
Rejected order
An order the platform refused and did not process, reported as
REJECTEDon Binance Spot. A request that breaks a filter can instead come back as an error, with no order created. Guide: Crypto order management systemSettlement
The step that completes a trade by moving the asset and the money. On a centralized crypto platform it is usually an internal balance update, while equities settle later through clearing and custody systems. Guide: Borsa Istanbul T+1 settlement
Slippage
The difference between the price you expected and the average price you got. Order size, thin books and delay all increase it. Guide: Slippage in crypto
State drift (position drift)
When the software's view of orders or positions no longer matches the platform's, often after a missed event or a restart. Reconciliation finds it. Guide: Position reconciliation
Trade ID (execution ID)
An identifier for one fill or report, such as ExecID(17) in FIX and
tandIin Binance's execution report. Storing it makes it harmless when the same event arrives twice. Guide: Crypto order management systemTrading fee (commission)
A charge on each fill, usually a percentage set by maker or taker role and fee tier. It can be taken in a different asset from the one traded, so balance logic reads the asset each fill reports, such as
commissionAsseton Binance. Guide: Crypto portfolio tracker APIUnknown order status
The state after a timeout or server error, when an order may or may not exist. Binance says a 5XX response must not be treated as a failure, so software queries the client order ID before doing anything else. Guide: Trading bot development
Market data
Prices, order books, candles and the rules attached to each market.
Aggregator API
A service that collects data from many exchanges behind one API. An aggregated price is a calculation, not a price you can trade at. Guide: Crypto price API
Base and quote asset
In the pair BTC/USDT, BTC is the base asset, the thing being bought or sold, and USDT is the quote asset, the currency of the price. Quantity and price rules are set in these units. Guide: Crypto exchange API integration
Bid and ask
The bid is the highest price a buyer is offering and the ask is the lowest price a seller is offering. Together they form the top of the book. Guide: Local order book from WebSocket
Candle (OHLCV, kline)
The open, high, low, close and volume for a fixed time interval, which Binance calls a kline. Platforms differ on day boundaries and on whether a timestamp marks the open or the close, so two correct feeds can disagree. Guide: Crypto price API
Consolidated and direct feeds
A consolidated feed combines quotes and trades from the venues that trade a security, while a direct feed comes from one exchange with its own depth and timing. Guide: Stock market data API
Data gap
A missing interval in candles or a missing run of messages, caused by outages, thin trading or dropped connections. Software has to detect it, because a backtest or a local book built over a gap is wrong. Guide: Crypto price API
Delta update (diff)
A message that lists only the price levels that changed since the last one. A quantity of zero removes the level. Guide: Local order book from WebSocket
Funding rate
A periodic payment between long and short holders of a perpetual future, where a positive rate usually means longs pay shorts. Intervals and formulas differ by platform: Hyperliquid pays hourly, while OKX and Binance USD-M default to 8 hours with exceptions. Guide: Perpetual futures and funding rate
Index price
A weighted average of an asset's spot prices across several exchanges, used as the reference for a derivative. Each platform picks its own sources and weights. Guide: Perpetual futures and funding rate
Last price
The price of the most recent trade on that market. On a thin book it can print far from fair value for a moment, which is why derivatives platforms keep a separate mark price. Guide: Perpetual futures and funding rate
Level 1, level 2 and level 3 data
Level 1 shows the best bid and ask, level 2 the total size at each price, and level 3 each individual order. Not every platform publishes level 3, though Kraken, for one, documents a level 3 channel. Guide: Local order book from WebSocket
Liquidity
How much can trade near the current price without moving it. With thin liquidity, larger orders pay more slippage. Guide: Local order book from WebSocket
Local order book
Your own copy of the book, built from a snapshot plus delta updates. If an update is missed the copy is wrong and has to be rebuilt. Guide: Local order book from WebSocket
Lot size (step size)
The allowed range and smallest step for an order's quantity. Binance Spot publishes it in the
LOT_SIZEfilter asminQty,maxQtyandstepSize. Guide: Binance API trading bot in PythonMark price
A reference price derivatives platforms use to value open positions and trigger liquidation, instead of the last trade price. The formula varies: Binance USD-M uses a median of index-based prices and the contract price. Guide: Perpetual futures and funding rate
Market data license
The terms that govern what you may do with data, including showing it to others. Being able to fetch data gives no right to redistribute it: OKX's API Agreement limits market data to personal, non-commercial use and requires written consent to share it. Guide: Crypto price API
Market depth
The quantity available at prices away from the best bid and ask. The number of levels you can request or subscribe to differs by platform. Guide: Local order book from WebSocket
Mid price
The average of the best bid and best ask. It is a reference value, not a price you can always trade at. Guide: Slippage in crypto
Minimum notional
The smallest order value, price times quantity, that a market accepts. Binance Spot sets it in the
NOTIONALfilter, which can also set a maximum. Guide: Binance API trading bot in PythonNon-display use
Using market data in software with no person viewing it, such as for automated decisions. Exchanges such as Nasdaq and Borsa Istanbul define it and treat it separately from display use. Guide: Stock market data API
Normalization
Mapping each platform's symbols, fields, units and error codes to one internal format, so the rest of the software does not depend on a single API. Guide: Crypto exchange API integration
Open interest
The number or value of derivative contracts still open at a moment. It measures outstanding positions, not trading volume. Guide: Funding rate history API
Order book
The list of open limit orders for a market, arranged by price. Platforms share it through REST snapshots and WebSocket updates. Guide: Local order book from WebSocket
Order book checksum
A value sent with book updates so you can verify your copy, such as the CRC32 on Kraken's book channel. OKX has deprecated its checksum field in favor of sequence IDs. Guide: Local order book from WebSocket
Order book snapshot
A complete copy of the book at one moment, from a REST call or the first message on a stream. On Bybit, a new snapshot message means you must reset your local book. Guide: Local order book from WebSocket
Perpetual future
A derivative with no expiry date, designed to track an asset's spot price through funding payments. Access depends on your jurisdiction, and SPK Communiqué III-35/B.2 bars leverage, derivatives and short sales on assets listed on platforms in Turkey. Guide: Perpetual futures and funding rate
Sequence number (update ID)
A counter on market data messages that shows whether any were missed. Binance uses update IDs, OKX
seqIdandprevSeqId, and Coinbase sequence numbers, each with its own rule for a gap. Guide: Local order book from WebSocketSpread
The best ask minus the best bid. A wider spread makes trading in and straight back out more expensive. Guide: Local order book from WebSocket
Symbol (instrument ID)
A platform's name for a market, written differently by each:
BTCUSDTon Binance,BTC-USDTon OKX andBTC-USDon Coinbase. A multi-platform system maps them to one internal form. Guide: CCXT Python trading botSymbol filter
A rule a platform applies to every order for a market, covering price, quantity or value. Software should read the current rules at run time, such as from Binance's
exchangeInfo, since they can change. Guide: Binance API trading bot in PythonTick data
A record of each trade or quote change rather than a summary per interval. It takes far more storage than candles and is needed when rules depend on individual trades or the book. Guide: Crypto tick data
Tick size
The smallest allowed price step for a market. Binance Spot publishes it as
tickSizein thePRICE_FILTER, and a price that does not fit is refused. Guide: Binance API trading bot in PythonTicker
A short summary for one market, such as last price, best bid and ask, and 24-hour volume. The fields vary by platform. Guide: CCXT Python trading bot
Risk controls
Limits that sit outside the trading rules, and the margin terms they guard against. Controls limit damage; they do not make trading profitable.
Alerting
Messages that reach a person when a limit trips, a connection stays down or a reconciliation fails. Delivery needs its own test, because an alert nobody sees protects nothing. Guide: Trading bot risk management
Cancel all
A request that cancels every open order in a scope, such as one symbol on Binance Spot through
DELETE /api/v3/openOrders. A kill switch often starts with it. Guide: Trading bot risk managementCancel on disconnect
A service that cancels or suspends your orders when your session drops. Borsa Istanbul offers it to trading members on request for FIX and OUCH users, and suspended orders can be reactivated. Guide: Broker API integration
Circuit breaker
A term with two meanings: a market halt when prices move past a set limit, and a software pattern that stops calling a failing service until it recovers. Check which one a document means.
Daily loss limit
A limit that stops new orders once the day's losses reach a set amount. It belongs outside the trading rules, so that a change in the rules cannot loosen it. Guide: Trading bot risk management
Dead man's switch
A platform timer that cancels your open orders unless the client keeps renewing it. Kraken's
CancelAllOrdersAfter, Binance USD-M's auto-cancel and Hyperliquid'sscheduleCancelare examples, and they cancel orders, not positions. Guide: Trading bot risk managementExposure limit
A cap on total market exposure across instruments, usually measured in one currency. It catches risk that per-instrument limits miss. Guide: Trading bot risk management
Fat-finger check
A check for input errors such as an extra zero, through maximum order size and value limits. RTS 6 Article 15 requires limits on uncommonly large orders. Guide: Trading bot risk management
Kill switch (emergency stop)
A control that blocks new orders and cancels working ones at once, and that must work even if the trading process has failed. RTS 6 Article 12 requires investment firms to be able to cancel any or all unexecuted orders immediately. Guide: Trading bot risk management
Leverage
Holding a position larger than the margin posted, which magnifies gains and losses. A small adverse move can trigger liquidation and lose the whole margin. Guide: Perpetual futures and funding rate
Liquidation
The forced closing of a position when collateral falls below maintenance margin. Binance USD-M ties the trigger to the mark price, and execution can be worse than the calculated level. Guide: Perpetual futures and funding rate
Margin
The collateral that backs a leveraged position: initial margin to open it and maintenance margin to keep it open. Rates vary by platform and position size. Guide: Perpetual futures and funding rate
Maximum drawdown
The largest fall in account value from a peak. As a control, the software stops when the fall passes a set percentage. Guide: Trading bot risk management
Order throttle
Your own limit on orders or messages per period, which stops a runaway loop before the platform's limit does. RTS 6 Article 15 also requires throttles on repeated executions, after which the trading system stays disabled until a designated staff member re-enables it. Guide: Trading bot risk management
Position limit
A cap on the total position in one instrument or account. A cautious check counts open orders as if they will fill. Guide: Trading bot risk management
Pre-trade risk check
A test every order must pass before it is sent, covering size, value, price and position. EU Regulation 2017/589 (RTS 6) and US Rule 15c3-5 require such checks of regulated firms, and they are a useful reference for any trading software. Guide: Trading bot risk management
Price collar
A limit that blocks or cancels orders priced too far from a reference. RTS 6 Article 15 lists it among required controls, and platform filters such as Binance's
PERCENT_PRICE_BY_SIDEalso exist, but the platform sets their bands, which can be wide. Guide: Trading bot risk managementRisk layer
A separate module with its own tests that every order passes through, independent of the trading rules. A change to the rules then cannot silently loosen a limit. Guide: Trading bot risk management
Self-trade prevention (STP)
A platform rule that stops your own orders from matching each other. Binance Spot's modes include expiring the taker, the maker or both.
Stale data check
A rule that refuses to act on market data older than a set age. A stopped feed can otherwise look like a quiet market. Guide: Trading bot risk management
Withdrawal allowlist
A list of approved destination addresses for withdrawals, set on the account. Support and names differ by platform, and it complements keeping withdrawal rights off API keys. Guide: API key security for trading bots
Testing
Ways to test software before and after go-live. Tests show how the software behaves, not future results.
Acceptance test
An agreed check of how software behaves in a stated case, such as a duplicate message or a dropped connection. A return, a win rate or a backtest result is not an acceptance criterion. Guide: Crypto trading bot developer
Backtest
Running written rules over historical data to see how they would have behaved under stated assumptions about fills and costs. It shows past behavior, not future results. Guide: Backtesting pitfalls
Certification test (conformance)
A test a venue or broker requires before your software may connect. Borsa Istanbul requires members to get a FIX or OUCH certificate for their software or to use a certified application. Guide: Broker API integration
Demo trading
Simulated trading that a platform runs apart from real balances. OKX selects it with the
x-simulated-trading: 1header and Bybit with a separate host and keys, and neither supports every endpoint. Guide: Paper trading APIDry run
Running the whole program with order sending switched off and logging what it would have sent. It tests the logic, not the platform's response. Guide: Paper trading API
Failure injection
Causing failures on purpose during a test, such as timeouts, rate-limit errors, dropped connections and partial fills, to see how the software reacts. Guide: How to test trading bots
Integration test
A test of the software against a real interface, usually a testnet, covering signing, order placement and event handling. It catches gaps between the documents and actual behavior. Guide: How to test trading bots
Look-ahead bias
Using information in a test that was not available at the simulated moment, such as a bar's close before that bar has ended. It makes a backtest look better than a live run could be. Guide: Backtesting pitfalls
Monte Carlo resampling
Resampling a list of test trades to see the range of paths the same trades could have produced. It describes variation in past results and predicts nothing. Guide: Backtesting Python libraries
Out-of-sample test
A test on data that was not used to build or tune the rules. A good result is still not a forecast. Guide: Backtesting pitfalls
Overfitting
Tuning rules until they fit the noise in past data, so they look strong in the test and fail on new data. The more variations tried, the greater the risk. Guide: Backtesting pitfalls
Paper trading
Simulating orders against live market data with no real money. Simulated fills leave out effects such as market impact and queue position, as Alpaca's documentation notes, so live results can differ. Guide: Paper trading API
Repainting
Script behavior in which historical and real-time calculations differ, so a chart's history can show results the script would not have shown live. TradingView's Pine Script documents describe it. Guide: Pine Script developer
Replay test
Feeding recorded market data or order events back through the software, to reproduce a problem or compare two versions. Guide: How to test trading bots
Sandbox
A test environment, though the word covers very different things. Coinbase's Advanced Trade sandbox, for example, returns static, pre-defined responses without authentication. Guide: Coinbase sandbox environments
Staged rollout
Going live gradually, starting with small limits and widening them only after each step checks out. It limits the cost of a fault that testing missed. Guide: How to test trading bots
Survivorship bias
Testing only on assets that still exist today, which leaves out delisted ones. Building a test list from a platform's currently trading symbols causes it. Guide: Backtesting pitfalls
Synthetic data
Generated data used in place of real records. It lets a test produce rare cases on demand, but it cannot show how a real market behaves. Guide: Backtesting Python libraries
Testnet
A separate environment with its own addresses, keys and valueless balances, for testing API calls. Not every platform offers one, prices and liquidity differ from production, and Binance Spot's testnet resets about once a month. Guide: Paper trading API
Unit test
An automated test of one function in isolation, such as rounding a price to the tick size or applying a fill to a position. It needs no network. Guide: How to test trading bots
Vectorized and event-driven backtests
A vectorized backtest computes results for the whole history with array operations, while an event-driven one feeds data to the code step by step, as a live system would. The first is faster, and the second handles order logic more naturally. Guide: Backtesting Python libraries
Walk-forward analysis
Repeatedly tuning on one period and testing on the next, unseen one, then moving both windows forward. Guide: Backtesting Python libraries
Infrastructure
Where the software runs and what keeps it running.
Append-only event log
Storing every event in order and deriving current state from it. History can be replayed, which makes faults easier to trace. Guide: Trading bot architecture
At-least-once delivery
A delivery promise under which a message arrives one or more times, as with webhooks that retry. Consumers store event IDs, so a repeat does nothing. Guide: Crypto order management system
Backpressure
The buildup when messages arrive faster than a consumer can process them, and how a system handles it by buffering, dropping or slowing the source. A consumer that falls behind can lose messages, which on a local order book means rebuilding it. Guide: Trading bot architecture
Clock skew
The difference between your clock and the server's. Too much of it gets signed requests refused, as with Binance's
-1021timestamp error. Guide: Binance API error codesClock synchronization
Keeping a server's clock close to a reference time, usually with NTP (RFC 5905), because signed timestamps and logs depend on it. In the EU, MiFIR Article 22c requires trading venues and their members to synchronize the business clocks they use to record reportable events. Guide: Trading bot hosting
Colocation
Placing your servers in the same facility or cloud region as a venue's systems to shorten the network path. It reduces network delay only, not processing delay in your own code. Guide: Trading bot hosting
Container
A packaged copy of a program and its dependencies that runs the same way across hosts, such as a Docker image. Secrets should be supplied at run time, not built into the image. Guide: Trading bot hosting
Decimal arithmetic
Working with exact base-10 numbers for prices and quantities. Binary floating point can introduce rounding errors that break tick size and step size rules. Guide: Binance API trading bot in Python
Failover
Switching to a standby system when the main one fails. In trading software it needs a guard, so that two instances never send orders at the same time.
Graceful shutdown
Stopping in a planned order: refuse new orders, decide what happens to working orders, save state and close connections. Guide: Trading bot hosting
Health check
A small test that reports whether a service works. A process can be running and still receive no data, so the check should look at data age as well. Guide: Trading bot hosting
Latency
The time a message takes to travel and be processed, often measured as the round trip from sending an order to its acknowledgment. Averages hide spikes, so percentiles are usually reported as well. Guide: Trading bot hosting
MCP server
A program that exposes tools and data to AI applications through the Model Context Protocol, an open-source standard. On an exchange, those tools can include placing orders, so the agent's permissions need hard limits. Guide: Crypto trading MCP servers
Message queue
A buffer between components, such as a receiver and an order sender, that absorbs bursts of messages. Many queues deliver at least once, so consumers have to handle repeats. Guide: Trading bot architecture
Monitoring
Watching measures of software health, such as connection state, order latency, error rates and data age. It covers technical operation and is separate from watching positions. Guide: Trading bot hosting
Process supervisor
A tool that starts a program and restarts it after a crash, such as systemd on Linux. After a restart, trading software should reconcile before it sends new orders. Guide: Trading bot architecture
Self-hosted deployment
Running the software on your own server or cloud account, so keys and logs stay with you. A vendor-hosted service trades that control for convenience and can change the legal position. Guide: Trading bot hosting
State store
Durable storage for orders, positions and processed event IDs, so a restart resumes from a known state instead of starting blind. Guide: Trading bot architecture
Structured logging
Writing logs as named fields, such as JSON with a timestamp, order ID and event type, so that they can be searched. Keys, secrets and signatures stay out of them. Guide: API key security for trading bots
Time-series database
A database built for timestamped records such as candles and trades, with fast queries over time ranges. Guide: ClickHouse for market data
UTC
Coordinated Universal Time, the usual reference for signed timestamps and logs. Bybit's timestamp header takes UTC in milliseconds, and OKX's takes UTC in ISO 8601 form. Guide: OKX API in Python
VPS (virtual private server)
A rented virtual machine in a provider's data center, a common place to run trading software. It does not change which platforms or services you may legally use. Guide: Trading bot hosting
Regulation terms
Short, general definitions, not legal advice. Which rules apply depends on your jurisdiction, what the software does and the platform's terms.
Algorithmic trading (MiFID II)
Under MiFID II, trading in financial instruments in which an algorithm sets order parameters such as timing, price or quantity with limited or no human intervention. Systems that only route orders or process them after the trade are excluded. Guide: Are trading bots legal?
AML and CFT
Anti-money laundering and countering the financing of terrorism: rules that require regulated firms to identify customers, monitor activity and report suspicious transactions. Exact duties depend on the jurisdiction and the firm's activity. Guide: Turkey country risk
API terms
The contract that governs your use of a platform's API, which can be narrower than what the API technically allows. OKX's API Agreement, for one, requires written approval to offer its API as part of a commercial product or to run orders for third parties. Guide: Crypto bot development company
Article 99/A
The provision of Law No. 6362 on measures for crypto-asset service providers, including unauthorized activity. A Turkish office, a Turkish-language website, or promotion directly or through people or firms in Turkey makes a foreign platform's activity count as directed at Turkish residents. Guide: Is crypto legal in Turkey
Capital Markets Law No. 6362
Turkey's capital markets statute, into which Law No. 7518 inserted the crypto provisions in 2024. Article 35/B requires SPK permission for crypto-asset service providers, and Article 109/A sets criminal penalties for operating without it. Guide: Turkish Capital Markets Board (SPK)
CASP
Crypto-asset service provider, the MiCA term for a legal person or other undertaking whose business is providing crypto-asset services. Those services include custody, operating a trading platform, exchange, order execution, advice and portfolio management. Guide: Crypto bot development company
Communiqués III-35/B.1 and III-35/B.2
SPK's two communiqués of March 13, 2025 on how crypto-asset service providers are set up and how they operate. Article 14 of B.2, for one, bars leverage, derivatives, margin purchases and short sales on assets listed on platforms. Guide: Is crypto legal in Turkey
Crypto asset service provider (Turkey)
In Turkish, kripto varlık hizmet sağlayıcı: under Article 3 of Law No. 6362, platforms, custody firms and other entities designated by regulation. A platform here is a firm where crypto assets are traded, settled or transferred, or where related custody takes place. Guide: Is crypto legal in Turkey
Crypto payment ban (Turkey)
A regulation of the Central Bank of the Republic of Türkiye that has barred the direct or indirect use of crypto assets in payments since April 30, 2021. It also stops payment and e-money institutions from intermediating transfers to or from crypto platforms. Guide: Is crypto legal in Turkey
Custody
Keeping crypto-assets, or the means of access to them such as private keys, on behalf of clients. MiCA and Turkish rules both treat it as a service that needs authorization. Guide: Is crypto legal in Turkey
DORA
Regulation (EU) 2022/2554, the Digital Operational Resilience Act on ICT security in the financial sector, which applies from January 17, 2025. MiCA points crypto-asset service providers to it for their ICT systems.
ESMA
The European Securities and Markets Authority, the EU body that publishes rulebooks, guidelines and Q&As on MiCA and MiFID II. National authorities supervise most firms directly.
FATF
The Financial Action Task Force, the intergovernmental body whose Recommendations set global AML and CFT standards. Its Recommendation 16 is the international standard behind the Travel Rule, and it has extended that Recommendation to virtual asset service providers. Guide: Turkey country risk
FinCEN
The US Treasury bureau that administers anti-money-laundering rules. Its guidance FIN-2019-G001 explains how money transmitter rules, including the Travel Rule, apply to convertible virtual currency businesses.
Investment advice
Personal recommendations on what to do with an asset, a licensed activity in many jurisdictions. MiCA defines it as personalized recommendations to a client, and Turkish Communiqué III-35/B.2 as directive comments to a person or a similar group. Guide: Are trading bots legal?
KYC (know your customer)
Verifying a customer's identity, at the start of a business relationship and during it, which regulators often call customer due diligence. An API key does not replace it, and platforms can tie API features to the account's verification level. Guide: Create an exchange API key
KYT (know your transaction)
Assessing the risk of a crypto transfer, usually with blockchain analytics. It is a market term rather than a legal one, and it does not replace KYC.
Market manipulation
Orders or other conduct that give false or misleading impressions of supply, demand or price, or that hold a price at an artificial level. MiCA Article 91 prohibits it for crypto-assets. Guide: Are trading bots legal?
MASAK
Turkey's Financial Crimes Investigation Board. Its General Communiqué No. 29 sets waiting periods and stablecoin withdrawal limits for platforms. Guide: Is crypto legal in Turkey
MiCA
Regulation (EU) 2023/1114 on markets in crypto-assets, which applies from December 30, 2024, and from June 30, 2024 for its asset-referenced and e-money token titles. Crypto-asset services in the EU need authorization, and the transitional period for existing firms ran to July 1, 2026 at the latest. Guide: Crypto bot development company
MiFID II
Directive 2014/65/EU, the EU's rules on investment services in financial instruments. Its Article 17 requires firms that trade algorithmically to have effective systems and risk controls. Guide: Are trading bots legal?
Portfolio management
Managing client portfolios under a mandate, a licensed activity in many jurisdictions. MiCA covers discretionary client-by-client mandates, and Article 15(3) of Turkish Communiqué III-35/B.2 prohibits managing each customer's portfolio on the customer's behalf, as an agent, for a direct or indirect benefit. Guide: Crypto portfolio tracker API
Reception and transmission of orders
Taking a person's order and passing it to a third party for execution, listed as a crypto-asset service under MiCA. In Turkey, taking and executing orders needs SPK permission. Guide: Crypto order management system
Reverse solicitation
A service that a client starts at its own exclusive initiative. MiCA Article 61 exempts a non-EU firm only in that case, and soliciting clients in the EU by any means removes the exemption. Guide: Crypto bot development company
RTS 6
Commission Delegated Regulation (EU) 2017/589, the EU's detailed rules for investment firms that trade algorithmically, covering matters such as testing, kill functionality and pre-trade controls. It binds those firms, and its list also serves as a reference for other trading software. Guide: Trading bot risk management
Sanctions screening
Checking customers, wallet addresses and locations against sanctions lists. OFAC's 2021 guidance for the virtual currency industry says compliance programs generally should include list and geographic screening.
SEC Market Access Rule
US Rule 15c3-5 (17 CFR 240.15c3-5), which requires broker-dealers with market access to apply pre-trade controls, including credit and capital thresholds and blocks on erroneous or duplicative orders. Guide: Trading bot risk management
Self-hosted wallet
A wallet whose keys the user controls, with no provider holding them. Under the EU rules, a provider still collects and holds the transfer information for transfers to or from one and, above EUR 1,000, must assess whether its customer owns or controls the address.
SPK (Capital Markets Board of Türkiye)
Sermaye Piyasası Kurulu, also written CMB: Turkey's capital markets regulator, which also licenses and supervises crypto-asset service providers under Law No. 6362. Its bulletins record permits, fines and access blocks. Guide: Turkish Capital Markets Board (SPK)
SPK operating list
The provisional list (Faaliyette Bulunanlar Listesi) of firms that declared they would operate under Temporary Article 11 of Law No. 6362. SPK states that being on it does not mean a firm has been authorized. Guide: Turkish crypto exchange APIs
Spoofing
Bidding or offering with the intent to cancel before execution, in the words of 7 USC 6c(a)(5)(C), which bars it on US registered entities. The term appears here only as a warning. Guide: Are trading bots legal?
Transfer of Funds Regulation (TFR)
Regulation (EU) 2023/1113, which recast the EU's Travel Rule and extended it to crypto-asset transfers. EBA guidelines on it apply from December 30, 2024. Guide: Travel rule API
Travel Rule
The duty of providers to send originator and beneficiary details with a transfer, which the FATF has extended to virtual asset service providers. Amounts differ: the EU applies it to crypto transfers of any amount, the US from USD 3,000 (31 CFR 1010.410(f)), and Turkey requires fuller, verified sender data from TRY 30,000. Guide: Travel rule API
VASP
Virtual asset service provider, the FATF's term for businesses that offer services such as exchange, transfer or safekeeping of virtual assets. National laws use their own names, such as CASP in the EU.
Wash trading
Trades that change nothing except the appearance of activity, such as buying from yourself. US commodities law prohibits wash sales, and such trades can fall under market manipulation rules elsewhere; the term appears here only as a warning. Guide: Are trading bots legal?
Questions about this glossary
What is a trading API?
A trading API is a documented interface that lets software read market data, check an account and place orders on an exchange or broker, usually through REST and WebSocket and sometimes FIX. Each platform has its own rules for keys, limits and order types.
What is the difference between a testnet, demo trading and paper trading?
A testnet is a separate environment with its own keys and prices. Demo trading is a simulated mode that a platform runs apart from real balances. Paper trading simulates fills against live market data. None of them shows that a set of rules will make money.
Do these definitions apply to every exchange?
The general meaning does, but names, values and limits differ. Where a definition gives a platform's rule, it comes from that platform's official documents as read on November 5, 2026. Documents change, so check the current version.
Does naming a platform here mean Fincode works with it?
No. Platform names only show how official documents differ. They are not recommendations or a ranking, and they do not say that Fincode has built or will build on that platform.
Does this glossary recommend a strategy or a setting?
No. It explains terms. Fincode does not recommend strategies; strategy and investment decisions are yours. Fincode turns rules you have written into software, and trades can lose money.
Is this legal advice?
No. Regulation entries are short, general definitions. Which rules apply depends on your jurisdiction, what your software does and the platform's terms, so ask a lawyer about your own case.
Sources
These are the official documents, or labeled copies of them, behind definitions that state a specific rule, each read on November 5, 2026. Definitions without a stated rule are general software and market terms, written for this page.
Standards and specifications
- FIX Trading Community: FIX Session Layer Technical Specification, June 2020 (opens in a new tab), Simple Binary Encoding factsheet (opens in a new tab)
- FIX Latest on Orchimate, where FIX Trading's FIXimate address now points: TimeInForce(59) code set (opens in a new tab), OrdStatus(39) code set (opens in a new tab), ClOrdID(11) (opens in a new tab), CumQty(14) (opens in a new tab), LeavesQty(151) (opens in a new tab), ExecID(17) (opens in a new tab), NewOrderSingle(35=D) (opens in a new tab), ExecutionReport(35=8) (opens in a new tab)
- IETF RFCs: RFC 2104, HMAC (opens in a new tab), RFC 5905, NTP version 4 (opens in a new tab), RFC 6238, TOTP (opens in a new tab), RFC 6455, WebSocket (opens in a new tab), RFC 6585, HTTP 429 (opens in a new tab), RFC 6749, OAuth 2.0 (opens in a new tab), RFC 7518, JSON Web Algorithms (opens in a new tab), RFC 7519, JSON Web Token (opens in a new tab), RFC 7725, HTTP 451 (opens in a new tab), RFC 8032, EdDSA (opens in a new tab), RFC 8446, TLS 1.3 (opens in a new tab), RFC 9110, HTTP Semantics (opens in a new tab)
- NIST: FIPS 140-3, cryptographic modules (opens in a new tab), FIPS 180-4, Secure Hash Standard (opens in a new tab), FIPS 186-5, Digital Signature Standard (opens in a new tab), FIPS 198-1, HMAC (opens in a new tab), SP 800-57 Part 1 Rev. 5, key management (opens in a new tab)
- Model Context Protocol: What is MCP (opens in a new tab)
Regulators and law
- FATF: Updated Guidance on virtual assets and VASPs, October 2021, copy on the site of Romania's financial intelligence unit (opens in a new tab)
- EU, MiCA on ESMA's rulebook: Article 3 (opens in a new tab), Article 59 (opens in a new tab), Article 61 (opens in a new tab), Article 68 (opens in a new tab), Article 91 (opens in a new tab), Article 143 (opens in a new tab), Article 149 (opens in a new tab)
- EU, MiFID II on ESMA's rulebook: Article 4 (opens in a new tab), Article 17 (opens in a new tab)
- EU, MiFIR on ESMA's rulebook: Article 22c (opens in a new tab)
- EU, Official Journal text on the EU Publications Office: Delegated Regulation (EU) 2017/589 (RTS 6), Articles 5, 12 and 15 (opens in a new tab), Regulation (EU) 2023/1113, Recital 30 and Articles 14 and 16 (opens in a new tab)
- EU, other: EBA Travel Rule Guidelines (opens in a new tab), EBA Final Report on the guidelines (PDF) (opens in a new tab), ESMA on DORA (opens in a new tab)
- US, on Cornell's Legal Information Institute: 17 CFR 240.15c3-5 (opens in a new tab), 31 CFR 1010.410 (opens in a new tab), 7 USC 6c (opens in a new tab)
- US, agencies: CFTC guide to crypto asset perpetual contracts, 2026 (opens in a new tab), FinCEN guidance FIN-2019-G001 (opens in a new tab), OFAC guidance for the virtual currency industry, 2021 (opens in a new tab)
- Turkey (Turkish text): Capital Markets Law No. 6362, consolidated (opens in a new tab), SPK operating list (opens in a new tab), SPK bulletins (opens in a new tab), Communiqué III-35/B.1 (opens in a new tab), Communiqué III-35/B.2 (opens in a new tab), Measures Regulation, Article 24/A, consolidated (opens in a new tab), MASAK General Communiqué No. 29 (opens in a new tab), Central Bank regulation on crypto assets in payments (opens in a new tab)
Platform and vendor documents
- Alpaca: Paper trading (opens in a new tab)
- Binance Spot: REST API (opens in a new tab), Enums (opens in a new tab), Filters (opens in a new tab), Error codes (opens in a new tab), WebSocket streams (opens in a new tab), WebSocket API (opens in a new tab), User data stream (opens in a new tab), API key types (opens in a new tab), FIX API (opens in a new tab), Self-trade prevention (opens in a new tab), Smart order routing (opens in a new tab), Unfilled order count (opens in a new tab), Testnet (opens in a new tab), Changelog (opens in a new tab)
- Binance USD-M futures: Common definitions (opens in a new tab), New order (opens in a new tab), Auto-cancel all open orders (opens in a new tab), Funding rates (opens in a new tab), Mark price and price index (opens in a new tab), Liquidation protocols (opens in a new tab)
- Borsa Istanbul: Cancel on disconnect (opens in a new tab), BISTECH protocols (opens in a new tab), Data distribution FAQ (Turkish) (opens in a new tab)
- Bybit V5: Integration guidance (opens in a new tab), Rate limits (opens in a new tab), Error codes (opens in a new tab), Enums (opens in a new tab), Place order (opens in a new tab), Demo trading (opens in a new tab), WebSocket connect (opens in a new tab), Order book topic (opens in a new tab)
- CCXT and SDKs: CCXT (opens in a new tab), CCXT Manual (opens in a new tab), pybit (opens in a new tab), coinbase-advanced-py (opens in a new tab)
- Coinbase: API key authentication (opens in a new tab), Create order (opens in a new tab), Sandbox (opens in a new tab), WebSocket overview (opens in a new tab)
- CoinGecko: Coin OHLC chart (opens in a new tab)
- Hyperliquid: Nonces and API wallets (opens in a new tab), Exchange endpoint (opens in a new tab), SDK agent example (opens in a new tab), Funding (opens in a new tab)
- Kraken: Spot REST authentication (opens in a new tab), Spot REST rate limits (opens in a new tab), API key permissions (opens in a new tab), Add order (opens in a new tab), Cancel all orders after (opens in a new tab), Book checksum (opens in a new tab), Level 3 channel (opens in a new tab), FIX introduction (opens in a new tab)
- KuCoin: Authentication (opens in a new tab)
- Nasdaq: US equities and options data policies (opens in a new tab)
- OKX: API v5 documentation (opens in a new tab), API Agreement (opens in a new tab), Perpetual funding fee mechanism (opens in a new tab)
- OWASP: Secrets Management Cheat Sheet (opens in a new tab)
- Python: decimal module (opens in a new tab)
- Stripe: Manage webhook endpoints (opens in a new tab)
- TradingView: Policies and Terms of Use (opens in a new tab), Pine Script: repainting (opens in a new tab)
Read next
Have written rules you want turned into software?
Tell us the platform you use, what the software should do and your timeline. Fincode is a software company and does not provide investment advice, portfolio management or crypto asset services. Trades can lose money.