Developer documentation
Conventions
Idempotency is required, not optional
Every mutating request takes an Idempotency-Key. A repeated key returns the original response rather than performing the action twice — because in a financial integration a retry is a duplicate posting.
Versioned by date, in the path
A version is pinned per licensee. Breaking changes ship as a new version; the previous one is supported for a stated period rather than an implied one.
Webhooks are signed and replayable
Every event carries a signature and a monotonic sequence. Missed events are retrievable by range, so a consumer that was down does not silently lose a day.
Errors name the field
A 4xx response identifies which input failed and why. An error body that says "invalid request" costs a support ticket every time it is returned.
Quickstart
Sandbox credentials are issued at the start of a technical evaluation. The sandbox runs the same build as production with test data and no rate ceiling, because an evaluation against a crippled environment tells neither side anything.
POST https://sandbox.api.mlgblockchain.com/v1/orders
Authorization: Bearer <sandbox key>
Idempotency-Key: 9f21-c4
{ "account": "acct_1042", "side": "buy" }
→ 201 Created
→ replaying the same key returns this response, not a second orderX-MLG-Signature: t=1755446400,v1=<hex>
X-MLG-Sequence: 148213
# Recompute HMAC over "{t}.{raw body}" and compare in constant time.
# Reject a timestamp outside your tolerance window.
# Track the sequence: a gap means fetch the range, not carry on.What is not published yet
- Per-product API referencependingPublished product by product as each is verified against the running software (D-A).
- SDKspendingScoped, not released. We would rather publish none than publish one that lags the API.
- Public sandbox self-servicependingCredentials are issued through an evaluation today. Self-service arrives with the first named product.