Basic Information

This page collects the operational facts that apply to every Rocky Perpetual Contracts endpoint.

Base URLs

Environment	Base URL
Devnet	https://api.rocky.exchange
Mainnet	https://api.rocky.exchange

Content type

• Web v1 request bodies: application/json
• FAPI (/fapi/*): parameters are sent URL-encoded in the query string. A URL-encoded request body, if sent, is appended to the signed payload but handlers read parameters from the query string only. There is no JSON request body on FAPI.
• Query strings: standard URL-encoded form
• Responses: application/json (except /healthz / /readyz which return text/plain)
• Prices, quantities and other decimal values are returned as strings; timestamps are int64 Unix milliseconds

Versioning

Path-versioned. Breaking changes ship under a new version (/v1 → /v2); old versions stay until the next major release.

Rate limits

Enforced on every /fapi/* route (the limiter is shared with the Spot /api/v3/* surface), using fixed windows aligned to the wall clock:

Bucket	Scope	Window	Ceiling	Header
Request weight	public endpoints, per client IP	1 min	6000	X-MBX-USED-WEIGHT-1M
Request weight	signed endpoints, per API key	1 min	standard 1200 / ext-mm 2400 / house 6000	X-MBX-USED-WEIGHT-1M
Order count	POST /fapi/v1/order, per API key	10 s	standard 50 / ext-mm 100 / house 200	X-MBX-ORDER-COUNT-10S
Order count	POST /fapi/v1/order, per API key	1 min	standard 200 / ext-mm 600 / house 1200	X-MBX-ORDER-COUNT-1M

• The tier is the key's rate_tier (standard unless an admin changed it).
• Request weights: exchangeInfo 10; depth, klines, trades, ticker/24hr 5; every other route 1. Each page lists its weight.
• Signed endpoints additionally pass a pre-authentication per-IP weight gate of 24000/min (it only stamps headers on its own 429).
• Over the limit → HTTP 429 with {"code":-1003,"msg":"Too many requests."} and the counters in the headers above. Rocky does not escalate to 418, keeps no IP-ban state, and sends no Retry-After header. Windows are fixed rather than sliding, so a client may burst up to 2× the ceiling across a window boundary.

Authentication

Surface	Scheme
/v1/*	Authorization: Bearer <session_token> from POST /v1/wallet/verify; no user_id query param
/fapi/v1/*, /fapi/v2/*	X-MBX-APIKEY header + signature parameter (HMAC-SHA256, or Ed25519 for ED25519 keys)

• X-MBX-APIKEY must be 1–256 characters of [A-Za-z0-9_-], otherwise -2014 (HTTP 400). An unknown or revoked key → -2015 (HTTP 401).
• The signed payload is the URL-encoded query string, followed by & plus the URL-encoded request body if one is sent, with the trailing &signature=<sig> removed (the last signature= occurrence is taken). Sign the parameters exactly as sent, in the same order.
• HMAC keys: signature is the lowercase hex HMAC-SHA256 of the payload with the API secret. ED25519 keys: signature is the base64 (standard or URL-safe; percent-encoding is accepted) Ed25519 signature over the same payload. A mismatch → -1022 (HTTP 401).
• A missing signature or timestamp → -1102 (HTTP 400).

See the FAPI signing walkthrough for full details.

Time synchronization

• All timestamp parameters are Unix milliseconds.
• Signed requests must satisfy |now − timestamp| ≤ recvWindow; default recvWindow = 5000, max 60000.
• recvWindow must be an integer in 0..=60000; any other value → -1100 (HTTP 400). A timestamp outside the window → -1021 (HTTP 401).

Symbols

FAPI endpoints take and return the standard form (BTCUSDT, ETHUSDT, CCUSDT); Web v1 endpoints use Rocky's internal form (BTC-PERP, ETH-PERP, CC-PERP). Any other symbol on a FAPI endpoint → -1100 (HTTP 400). See Common Enums.