One trading API for every broker account you connect
Write your strategy once against Cirrus. Place orders in many accounts with one call, get signed webhooks when they fill, and let Cirrus deal with each broker’s API and static IP.
API keys with only the access you need
Create a key per script or server, each with its own scopes.
- Scopes
- Give a key read access, order access, trigger access, or a combination. A reporting script never needs to place orders.
- IP allowlist
- Lock a key to the servers you run it from. The secret is shown once, when you create it.
- One call, many accounts
- An order request takes a list of accounts, just like the ticket. Send an Idempotency-Key so a retry never doubles an order.
- Margin before you place
- Ask what an order would need in each account, with the same body as a real order and nothing placed.
Webhooks for orders, trades and positions
Stop polling. Cirrus tells your server when something changes in any account.
- Events
- order_update for every state change, trade for each fill, positions when an account’s positions change, and account_alert for things like an expired session, a rejected order or a failed protection.
- Signed the standard way
- Each delivery carries webhook-id, webhook-timestamp and an HMAC-SHA256 webhook-signature in the Standard Webhooks format, so existing libraries can verify it.
- Retries and a delivery log
- Failed deliveries are retried seven times over about four hours. Send a test event and see every delivery attempt in the app. Up to five endpoints per user.
OAuth apps for products built on Cirrus
Building a tool for other traders? Let them connect their Cirrus accounts without sharing keys.
- OAuth with PKCE
- Register an app with its redirect URIs. Traders approve it, and your app acts only within what they granted.
- Secret rotation without downtime
- Rotate an app secret and the old one keeps working for 24 hours while you deploy.
- Traders stay in control
- Every connected app is listed in the trader’s settings, where they can revoke it at any time.
Limits and documentation
Published, predictable limits, and docs written to be read by people and by AI coding tools.
- Per API key
- 20 requests a second.
- Per broker account
- 10 order actions a second (place, modify, cancel, GTT, convert), in line with SEBI’s threshold for retail API orders. Short bursts wait up to two seconds for a slot instead of failing.
- Per partner app
- The same 20 a second, for each trader connected to the app.
- Docs for people and for AI tools
- Public reference with examples, an OpenAPI file, llms.txt and llms-full.txt, and a Markdown copy of every section.
What the API covers
The same capabilities as the app, under /v1.
- Orders
- Place, modify and cancel, bracket orders, margin checks
- Protection
- Triggers and GTT orders
- Portfolio
- Positions, holdings, funds, refresh, position conversion
- Accounts and instruments
- Connected accounts, instrument search and a CSV master
- Activity
- Activity feed and a live stream
- Webhooks
- Signal webhook URLs and outbound webhook endpoints
Works with your brokers
Connect any of the 10 supported brokers. Each account trades from its own static IP, as SEBI's API rules require.
Pocketful
Zerodha
Upstox
5paisa
Motilal Oswal
Tradejini
Groww
Dhan
Fyers
Alice BlueWorks well with
- TradingView & Chartink signals Turn TradingView, Chartink or Kuberhunt alerts into live orders with your own sizing.
- Multi-account execution Place one order and send it to every account you choose, across brokers.
- Data sharing Give your research analyst read-only access to the accounts and data you choose.
Questions traders ask
Is there a trading API that works with many Indian brokers?
Yes. Cirrus gives you one REST API and one set of webhooks for every account you connect, across 10 brokers, so your code doesn’t change when an account moves to another broker.
How are Cirrus webhooks signed?
With HMAC-SHA256 in the Standard Webhooks format: webhook-id, webhook-timestamp and webhook-signature headers. During a secret rotation two signatures are sent and either one is valid.
What are the API rate limits?
20 requests a second per API key, and 10 order actions a second per broker account. Short bursts above the order limit wait up to two seconds for a slot rather than failing.
Do I need my own static IP to use the API?
No. Your requests go to Cirrus, and each account’s orders reach its broker from that account’s Cirrus static IP, which is what SEBI’s rules require.
Can I build an app that other traders connect to?
Yes. Register an OAuth app with PKCE. Traders approve it from Cirrus, can see it in their connections, and can revoke it at any time.
Is there an OpenAPI spec or llms.txt?
Yes. The docs publish an OpenAPI file, llms.txt and llms-full.txt, and every section is available as Markdown for AI coding tools.
Connect your first broker in about five minutes
Sign in, link an account, and place your first multi-account order. Pocketful users pay nothing.