Changelog

2026-10-23Copy Anchor Link

• Support from the console. A new Support page in the console lets anyone signed in to a workspace open a ticket and follow the conversation. We answer there and by email. If a card payment fails at checkout or when updating a card, the message links to it. No API change.
• Fairer free trials on shared mobile networks. Many mobile carriers put lots of people behind one internet address. A trial is no longer refused just because others on the same address already took one. No API change.

2026-10-22Copy Anchor Link

• A server name MetaTrader cannot find is reported as such. The account goes to error with problem.code SERVER_NOT_FOUND, and the console's alert bell says "The broker server could not be found", naming the server. Check the exact server name in the broker's welcome email or MetaTrader's File → Login dialog, then update the account. We stop its terminal until you do, and an always-on account is not retried meanwhile. No API change.
• More broker servers in the server search. About 820 MT5 servers of widely used brokers and prop firms (IC Markets, Pepperstone, Exness, XM, HFM, Vantage, VT Markets, Bybit, FTMO, The5ers, Deriv and more) are now offered as you type, by their exact names.

2026-10-20Copy Anchor Link

• Always-on accounts come back by themselves. If an always-on account's terminal stops — after maintenance, a crash or a start that failed — it is brought back online within minutes, with no call from you. A refused login, a second factor, a certificate or trading disabled at the broker still waits for you: retrying those is how a broker locks an account.
• When the problem is ours, accounts say so. If accounts cannot come online because of a problem on our side, an account on its way online carries problem.code PLATFORM_ISSUE with no actions, and a failed POST /v1/accounts/{id}/warm says the same: your login is fine and retrying will not help. status.fxapis.com has updates.
• An account coming online says starting. A new account you bring online now shows starting instead of staying created, and if its terminal stops before it is ready it shows offline with the reason.
• The status page's Trading engine reflects whether accounts can come online, not only whether our servers are running.
• New billing:read scope. Reading the subscription, invoices, usage charges, agreement, standing and daily usage now needs billing:read. Keys made before 21 October 2026 that hold accounts:read keep reading them. See Authentication.
• Checkout and coupon limits. Starting a checkout is limited to 5 per workspace and 10 per owner's email a day (429 CHECKOUT_LIMIT), and a coupon is not redeemed while a card payment for a plan is being set up (409 CHECKOUT_PENDING). Coupon codes are now shown once, when they are made.
• Copy trading (starting after maintenance): resetting a subscription that was paused when it stopped returns it to paused, and the copy.subscription_stopped event lists every reason a subscription can stop.

2026-10-19Copy Anchor Link

• Accounts come online again. From 16 October until 19 October at 23:16 UTC, accounts could not come online: bringing one online answered 503 and new accounts stayed created. Fixed; accounts that were waiting connect normally. See the incident on status.fxapis.com.

2026-10-17Copy Anchor Link

• Card payments show up straight away, even if you close the checkout. Opening billing or a checkout page now checks your card payment with our payment provider, and we check by ourselves every few minutes while a new plan waits for its first payment. Every renewal that goes through appears in your invoices, with a receipt by email. Console only; no API change.
• Confirm a usage charge with your bank, in the console. If your bank asks you to confirm a month-end usage charge (3-D Secure), you get an email and a notice on every console page, and you confirm it on Billing — your bank's check opens over the page, and nothing is charged until you confirm. A charge your bank is still processing is no longer reported as declined.
• Pay with another card when a renewal fails. If your card is declined at renewal, your plan stays on while we retry it, and Billing now shows Update card and pay: enter another card on the page (your bank's check, if any, opens over it) and it pays for your plan from today and renews it from then on. We cancel the renewal that failed, and if the old card is still charged for it, that charge is refunded automatically. The email about the failed payment and a notice in the console point you there.
• Your trial, on every console page. While your trial runs, a banner shows the days left and when it ends, with Choose a plan (members who are not the owner are asked to ask the owner). You can hide it for the rest of the day, except in the last three days. We also email you a week, three days and a day before the trial ends, as well as when it has ended.
• What an ended trial or plan means, said plainly. Once a trial ends, every console page says so: opening new trades is paused until a plan is chosen, open positions can still be closed and orders cancelled, and your accounts, keys, history and settings are kept — with Start your membership. A paid plan that ended says the same with Choose a plan. These notices can be hidden for a day at a time.
• Always-on accounts follow the plan. When a trial ends, or a plan ends or changes to one without always-on accounts, those accounts are switched to warm_on_demand: they connect when an order needs them and go offline when idle. We tell you by email (the trial-ended email lists them) and in the console. A copy-trading strategy's master is switched too, and goes offline when idle like any account, so its strategy copies nothing until a plan with always-on accounts and copy trading is chosen and the account is switched back to always_on. Each switch shows in the audit log as account.mode.
• Card payments: Visa and Mastercard. The checkout no longer lists Amex, which our card provider does not take. Plans are paid by card for now.
• Starter and Scale are no longer sold. They were replaced by Production and Business, and checkout now refuses them by name too: POST /v1/billing/checkout answers PLAN_NOT_PURCHASABLE for them, as a new purchase, a change of plan or a payment for the plan you are on. A workspace already on Starter or Scale keeps it, and its card keeps renewing it, until it changes to a plan from GET /v1/plans.
• Unbilled usage grows with what you've paid. On a per-account plan, usage beyond the plan's price — extra accounts, always-on accounts and extra followers — is billed after the month. How much of it a workspace can run at once is the plan's price a month ($99 on Production), plus what it has paid in renewals and usage charges in the last 90 days, so it grows as payments go through. Connecting, reconnecting or switching an account to always_on, or subscribing, resuming or resetting a copy-trading follower, past it answers 402 CREDIT_LIMIT with the limit in plain words; nothing you already run is changed. Changing to a plan that would leave you above its limit answers 409 REDUCE_USAGE_FIRST, saying what to switch off or disconnect first; if you add usage between starting the change and paying for it, always-on accounts are switched to warm_on_demand until you are within the new limit, and we email you which. GET /v1/plans shows each plan's pricing.creditLimit.
• An unpaid usage charge pauses opening, never closing. If a month's usage charge still can't be collected after a week of daily retries (or isn't confirmed with your bank within a month), opening orders, multi-account orders, connecting new accounts and switching to always_on answer 402 PAYMENT_OVERDUE until it's paid. Closing positions, cancelling orders and moving stops always work, a disconnected account can still be reconnected to close what it holds, and your plan, accounts and history are kept. We email you, every console page says so, and Billing has Try the card again (up to 3 times an hour); opening resumes as soon as the charge is paid.

2026-10-16Copy Anchor Link

• Managed copy trading. Mark an always-on account as a strategy and subscribe followers in the same workspace: fxapis copies opens, closes, partial closes and stop moves, server-side, about every second. Five sizing modes, reversal, symbol filters and mapping, lateness and price limits, risk limits that stop a subscription (and can close its positions), a drift check, and a log of every copy with its reason. /v1/copy/strategies, /v1/copy/subscriptions, /v1/copy/executions; in both SDKs; and Copy trading in the console. Hedging accounts only.
  • Copying starts after the upcoming scheduled maintenance. Until then making a strategy, subscribing, resuming and reset answer 503 COPY_TRADING_PAUSED; reading, settings, pausing and deleting work, nothing is copied and no follower is billed. GET /v1/copy/status says whether copy trading is paused.
  • Webhooks: copy.executed, copy.skipped, copy.failed, copy.subscription_stopped, copy.drift_corrected, copy.master_disconnected.
  • Plans: on Trial (3 followers), Production ($8 a follower a month) and Business (25 included, then $6); Enterprise by agreement. Followers are billed by the day.
  • Multi-account orders made by copy trading appear in GET /v1/execution-waves, labelled Copy: <strategy>.
  • See Copy trading.
• TypeScript SDK 0.3.0 and Python SDK 0.2.0 add the copy trading client.
• Connect Claude and ChatGPT by signing in. The MCP server (https://api.fxapis.com/mcp) now takes sign-in (OAuth 2.1 with PKCE) as well as API keys.
  • Add it to claude.ai, Claude Desktop, Claude Code or ChatGPT developer mode, and choose read-only, or trading on the accounts you pick. Trading needs two-factor turned on — your session already proved it at sign-in, so there is no code to enter on the consent screen.
  • Everything a connected app changes — opening, closing, stops, cancelling, bringing online and taking offline — is limited to the accounts you pick; it can still read every account. A write on another account answers 403 KEY_LIMIT_EXCEEDED. API keys are unchanged: their accountIds limits only what they open.
  • Every connected app is listed on the API keys page, and revoked there at once.
  • tools/list now answers without a credential. A tool call without one gets 401 with a WWW-Authenticate challenge that points at /.well-known/oauth-protected-resource/mcp.
  • See MCP server.
• MCP tool results are smaller.
  • The data comes once, as compact JSON, beside a one-line summary.
  • Read tools take response_format (concise by default, or detailed).
  • list_accounts, list_positions, list_account_instruments (now with query) and list_multi_account_orders page with limit and cursor.
  • Every list now answers { items, next_cursor, total } in place of accounts, positions, orders and so on.
  • Two new tools answer a whole question at once: get_account_overview and get_symbol_snapshot.
• A read-only connector, https://api.fxapis.com/mcp/insights, for the Claude and ChatGPT directories. See Read-only connector.
• A Claude Code plugin and a skill. /plugin marketplace add FXapis/fxapis-claude-plugins. See Claude plugin and skill.
• Sign-in for MCP changed no /v1 endpoint: connected apps are a console-only surface, so it needs no SDK change.
• Account alerts in the console. A bell on every console page counts the accounts that need you (a refused login, two-factor, a certificate, trading disabled, or an error lasting over two minutes), and Notifications lists them with the fix. They close by themselves when the account recovers. In-app only; no API change.
• Live prices, fresh figures and the position ticket from the fill are now available for every online account (figures refresh every 15 s; credit and profit filled).
• Pending orders that trigger now leave working. A limit or stop order that fills at the broker moves to filled (or partially_filled) once its fill deal or its position is seen, with brokerPositionId, and sends one order.filled webhook with previousState: "working". Before, it stayed working. filledPrice and filledVolume are null when only a netting position is known, until the fill deal arrives.
• A member's step-up now lasts two hours, up from ten minutes (staff keep the ten-minute window in the staff console). Creating an API key asks you to confirm it's you only when the key can move money or accounts (trading:execute, trading:reduce or accounts:write) — a read-only key, or one that only manages webhooks, is created without one. Re-scoping or re-limiting an existing key asks only when it widens the key to one of those scopes or changes the limits on a key that already has them; narrowing scopes and renaming never ask.

2026-10-15Copy Anchor Link

• Balance, equity and margin. Every account response carries balance, equity, margin, freeMargin, marginLevel, credit, profit and figuresObservedAt, as decimal strings, read from the account's terminal while it is online — every 60 seconds at first, every 15 seconds once the account's terminal had its update (now every account — see 2026-10-16).

  • GET /v1/accounts/{id}/figures answers them alone; ?fresh=true asks the terminal now. At first, fresh=true answered 501 CAPABILITY_UNAVAILABLE until your account's terminal was updated (now live for every account), and 409 ACCOUNT_NOT_READY unless the account is ready.
  • credit and profit were null until the terminal was updated (now filled for every account).
  • marginLevel is null while no margin is used.
  • marginMode now reads netting or hedging, in the API and in webhooks (where it is usually null for now).
  • Webhooks do not carry figures.

• Live prices. GET /v1/accounts/{id}/quotes answers up to 20 broker symbols or instruments, from the account's own broker. At first it returned 501 CAPABILITY_UNAVAILABLE until your account's terminal was updated (now live for every account).

  • Each quote carries time, brokerTime, ageMs, marketOpen, stale (only while open and over 60 s old) and tradeMode. A closed market answers its last price.
  • Calls that reach an account's terminal (live quotes and fresh figures) are limited to 300 a minute + 50 per account, across every caller; shared and cached answers are free. Past that: 429 RATE_LIMITED with retry-after.

• Stop checks use live prices. When a quote was read for the account recently, an order's stops are checked against it: the ask for a buy, the bid for a sell. Otherwise an open position's price, as before. The order never waits for a price.

• The position an order opened. An opening order now carries brokerPositionId, the ticket to close it by — pending orders that fill later included. It is linked from the broker's positions and deals, usually within a few minutes; once your account's terminal is updated, it is set from the fill itself (now true for every account). Closes and stop changes are unchanged.

• SDKs. The TypeScript SDK has getAccountsByIdFigures and getAccountsByIdQuotes. The Python SDK has client.accounts.figures(…), client.quotes.get(…) and CapabilityUnavailableError.

• MCP. Two new tools: get_account_figures and get_quotes.

• Admin keys. The workspace owner can make an admin key (fx_admin_…) in the console. It manages the workspace's API keys and nothing else, so issuing and rotating keys can be automated.

  • An IP allowlist and an expiry are optional.
  • At most five can be active.
  • Every request one makes is recorded in fxapis's audit trail (visible to fxapis staff; there is no customer audit-log view yet). Repeated refusals are recorded at most once a minute per key and reason.
  • Other /v1 routes answer 403 ADMIN_KEY_NOT_ALLOWED; routes outside /v1, including /mcp, answer 401 UNAUTHENTICATED.
  • An owner's admin keys are revoked when the owner is suspended or moved to another role. The keys those admin keys made keep working.
  • The owner is emailed whenever one is made or revoked.

• Ordinary keys can no longer call /v1/api-keys (403 ADMIN_KEY_REQUIRED). This includes keys holding admin. Use an admin key instead, or the console, which is unchanged.

• Workspace management left the SDKs. The member and invitation endpoints are console-only. The API reference now says so, and they are no longer in the SDKs or the Postman collection.

• TypeScript SDK 0.2.0 removes those methods and moves key management to fx.admin.keys (list, create, get, update, revoke). It needs an admin key.

• Python SDK 0.1.6 adds client.admin.keys.

• Console sessions last seven days and end after a day unused, and are no longer extended by use. Anyone signed in for more than seven days when this shipped signs in again once.

• Confirm it's you before sensitive changes. Making a key or changing its scopes or limits, inviting, changing roles or removing people, and plan or payment changes ask for your authenticator code (or password, without two-factor) if you have not given it in the last ten minutes: 403 STEP_UP_REQUIRED. API keys are not affected.

• See and end your sessions, and change your password, under Security in the console. A changed password always signs every other session out.

• Removing or suspending a member revokes the API keys they made, and the owner is emailed the list. API keys now show who made them (createdBy).

• Demoting an admin to member revokes the API keys they made, audited and emailed to the owner the same way. PATCH /v1/members/{id} returns keysRevoked, and GET /v1/members shows each person's keysCreated.

• Two-factor belongs to the session. Turning it on or off, or new backup codes, sign out every other session; turning it off needs the current code. Lost your phone? A backup code stands in for the code wherever one is asked for — signing in, confirming it's you, turning two-factor off — once each.

• Repeated wrong passwords bring a quick human check, then a 15-minute pause for the account.

• The session cookie is moving to __Host-fxapis.session_token, which only fxapis.com itself can set or read. It is rolling out over the coming days; the current name keeps working during the change, and nobody is signed out by it.

2026-10-14Copy Anchor Link

• Catch up after downtime with the event list. GET /v1/events?after=<last listed id> returns every event after the last one you read from the list, oldest first, exactly as webhooks deliver them — so a client that was down catches up by itself. Filter by type, account_id, time, or delivery_status=failed. Events are kept 7 days on Production, 30 on Business, 90 on Enterprise; reading needs history:read. See Catch up after downtime.
• Replay what an endpoint missed. POST /v1/webhooks/{id}/replay (or Replay events in the console) sends only the events an endpoint did not receive — given up on, or recorded while it was off. include: "all" re-sends everything in the window. A paused or switched-off endpoint now keeps its waiting deliveries and resumes them when turned back on.
• Webhook delivery logs in full, kept 30 days on every plan: each attempt's request as sent and your endpoint's answer; GET /v1/webhooks/{id}/deliveries/{deliveryId}.
• Kinder retries. Retries are spread out, honour Retry-After, and 410 Gone switches an endpoint off at once. One slow endpoint no longer delays anyone else's deliveries.
• The Python SDK adds events.list/iter/get and webhooks.deliveries/delivery/replay.
• API key limits. A key can carry a maximum lot size per order, the symbols or instruments it may open, the accounts it may open on, and a number of opening orders per UTC day — enforced on every opening order the key places, including multi-account orders, TradingView hooks it created and MCP. A refusal is 403 KEY_LIMIT_EXCEEDED. Closing is never limited. See Limits.
• Key limits are stricter at the edges. The daily allowance is exact, even for orders sent at the same moment, and a multi-account order sent after midnight counts on the day it was made, once. A key kept off an account is told so (403 KEY_LIMIT_EXCEEDED) before an instrument is looked up for that account. Revoking a key stops what it set up: its multi-account orders not yet sent are abandoned, and TradingView hooks it created stop trading.
• Multi-account orders take an instrument. Send instrument (e.g. XAUUSD) instead of symbol and each account trades its own broker's symbol for it, shown on each leg as legs[].symbol. If any account cannot trade it, the order is refused whole with 422 INSTRUMENT_UNAVAILABLE. The MCP place_multi_account_order tool takes instrument too, and the Python SDK's waves.create(instrument=...). See multi-account orders.

2026-10-11Copy Anchor Link

• The SDKs check webhook signatures. fxapis 0.1.4 on npm adds verifyWebhook(), which checks a delivery's fxapis-signature header and returns the event, and a method for every /v1/webhooks endpoint. fxapis 0.1.3 on PyPI adds fxapis.webhooks.verify(). See SDKs and verifying the signature.
• Webhooks have their own section in the API reference and in the Postman collection.

2026-10-08Copy Anchor Link

• Webhooks. Register an HTTPS endpoint and get a signed POST when an order fills, is rejected, goes unresolved or is resolved, a pending order is cancelled, a position opens or closes, an account changes state, or a multi-account order finishes. Retried over about 44.6 hours (jittered), with a delivery log, redelivery and secret rotation. An endpoint is switched off only after 20 failures in a row spanning at least 15 minutes, and the workspace owner is emailed. See Webhooks.
• Multi-account orders take up to 1,000 accounts in one request, within your plan's limit (Business 1,000, Production 250). It was 500.
• Stops on new orders are checked for direction. A stop loss past its take profit, or a pending order's stops on the wrong side of its own price, is refused with 400 INVALID_REQUEST before anything is sent; a market order's stops are also checked against a recent market price when there is one.
• A partial close that would leave less than the symbol's minimum is refused before anything is sent, instead of leaving a remainder too small to trade.
• Idempotency keys are released after 24 hours. A key reused after its window starts a new order instead of replaying the old one.
• An order's deals are listed for every order, not only for one that was settled from unknown: GET /v1/orders/{id}/deals and each deal's orderId now cover normal fills too.
• A body that is not valid JSON answers 400 INVALID_REQUEST, like every other bad request, instead of a framework error code.

2026-10-07Copy Anchor Link

• Broker server search — GET /v1/brokers/servers?q= finds the exact MT5 server name for a broker as someone types, including brokers no account here has used yet. See Accounts.
• Accounts say what is wrong and how to fix it. An account's problem gives the cause, likely servers (otherServers) and the actions that fix it; GET /v1/accounts/{id}/events lists what happened to it; and POST /v1/accounts/{id}/server moves an account added under the wrong server name, trying the stored password there.

2026-10-06Copy Anchor Link

• New plans. New workspaces start a 14-day trial with demo accounts. The plans on sale are Production and Business, billed monthly or yearly, and Enterprise by agreement — see pricing. On a trial, 402 DEMO_ONLY and 402 TRIAL_ACCOUNT_USED can answer a connect.

2026-10-05Copy Anchor Link

• Two-factor sign-in for the console, with an authenticator app and backup codes. Passwords found in known data breaches are refused at sign-up (PASSWORD_BREACHED).

2026-10-02Copy Anchor Link

• Instruments — name a market once with instrument on an order, and each account trades its own broker's symbol for it. GET /v1/instruments lists them; GET /v1/accounts/{id}/instruments shows how each maps on an account. See Instruments.
• Market hours — GET /v1/accounts/{id}/sessions: whether a market is open now on an account's broker, and its weekly sessions.
• Failures of ours answer 503, not 502 — the codes (SEND_FAILED, ORDER_UNRESOLVED, …) are unchanged; retry by code, not status. A broker refusal carrying its return code (market closed, no money, a requote) is now ORDER_REJECTED, not ORDER_UNRESOLVED.
• Order comments are cut to what MT5 accepts.

2026-10-01Copy Anchor Link

• DELETE /v1/accounts/{id} — remove an account and its history. disconnect still erases the password and keeps the history.

2026-09-30Copy Anchor Link

• TradingView alerts — a hook URL per strategy turns alerts into MT5 orders. See TradingView.
• A hosted MCP server at https://api.fxapis.com/mcp, for AI agents on a scoped key. See MCP.
• /openapi.json — the API description, at api.fxapis.com/openapi.json.
• Plan codes — the workspace owner redeems a plan code under Billing in the console, which puts the workspace on that plan for good, without payment.

2026-09-29Copy Anchor Link

• POST /v1/accounts/prepare — bring up to 200 accounts online in one call, for signals and click-to-trade. See Signals and click-to-trade.
• Idle accounts go offline on their own. A warm_on_demand account now goes offline after a quiet period with no orders.
• First order after connecting. An order placed right after an account became ready could fail with "no tick data"; the symbol is now selected before its price is read.
• GET /v1/workspace — your workspace's plan, and whether trading is switched off.
• API keys are issued as fx_live_… / fx_test_…. Keys issued as ow_… keep working exactly as issued.
• The API is served at https://api.fxapis.com.