Assetera DocsMarketplace API
The live, tenant-scoped Marketplace REST API for catalog, markets, trading, activity, and primary-sale integrations.
The Marketplace API is Assetera's partner-facing REST API. It validates Assetera OIDC access tokens and uses the signed tenant context to scope customer-visible resources.
The machine-readable contract and interactive explorer are available in the OpenAPI and Swagger UI. Use that contract for exact paths, query parameters, request bodies, response bodies, and status codes.
Partner-facing resource groups
| Group | Examples | Notes |
|---|---|---|
| Catalog | /assets, /markets, /markets/:id | Returns only instruments visible to the caller's tenant. |
| Market data | /markets/:id/candles | Snapshot data for charts and market views. |
| Trading | /orders, /offers, /attestations/fee | Requires an authenticated user and the relevant eligibility and market state. |
| Primary sale | /offchain-instruments, /offchain-purchases | Available only for configured primary-sale instruments. |
| Customer activity | /me/activities | Caller-scoped history and export. |
| Caller context | /context | Useful for integration diagnostics without decoding authorization rules in the browser. |
Administrative and issuer routes exist in the same service but are not granted to a distribution partner unless the partnership explicitly includes those roles.
Authentication
Send the server-held access token as a bearer token:
GET /markets HTTP/1.1
Host: api.<base_domain>
Authorization: Bearer <access_token>
Accept: application/jsonThe API verifies the signature, issuer, audience, expiry, tenant context, and required role or customer state. Do not send a tenant ID in a custom header or query parameter. The signed token is the authority.
Error handling
| Status | Meaning for an integrator |
|---|---|
400 | The request does not match the published schema. Do not retry unchanged. |
401 | Token is missing, expired, or invalid. Refresh or re-authenticate. |
403 | The caller is not permitted for that tenant, role, or customer action. |
404 | The resource does not exist or is not visible in the caller's tenant context. |
409 | Current lifecycle or market state conflicts with the requested action. |
429 | Back off according to the response and apply jitter. |
5xx | Treat as transient unless the response contract says otherwise. |
Integration guidance
- Generate client types from OpenAPI or validate responses at your BFF boundary.
- Use decimal strings for quantities and money where specified. Do not convert them through binary floats.
- Supply an idempotency mechanism where the operation's contract provides one.
- Keep a correlation identifier with each write and log only redacted request metadata.
- Refresh REST state after an SSE reconnect instead of assuming every delta was delivered.