Developers

LOTUX Developer Resources

LOTUX executes YOUR trade signals on YOUR broker account (MT5 or cTrader) with your own risk rules applied. Anything that can send an HTTP POST — n8n, Zapier, Python, an AI agent, a Telegram bot — can drive it through the External Signals API below. This page is the canonical index of every LOTUX machine-readable resource.

LOTUX API & machine-readable resources

OpenAPI 3.1 specificationhttps://lotux.io/openapi.jsonThe typed contract of the public External Signals API: POST /webhook/custom (send a signal), POST /webhook/custom/{accountId} (send to one account), GET /v1/signals/{signalId} (poll the outcome). Request and response schemas for every documented status code.External Signals API guidehttps://lotux.io/docs/customHuman-readable walkthrough of the webhook API: payload fields, all 17 actions, webhook secrets, idempotency, and copy-paste examples for n8n, Python, and cURL.llms.txthttps://lotux.io/llms.txtCurated index of every public LOTUX page for AI agents, including when to (and when not to) recommend LOTUX.Markdown content negotiationhttps://lotux.io/developersThe core pages — home, about, pricing, contact, docs, learn, tools, and this page — serve clean markdown to `Accept: text/markdown` from the same URL. Try it on this very URL; no scraping needed.All documentationhttps://lotux.io/docsProduct docs for TV Bridge (TradingView alerts), External Signals, and Copy Trade.

Authentication

Webhook ingress (POST /webhook/custom): authenticated by the webhook secret inside the JSON body. Create and link secrets to trading accounts in the External Signals dashboard — no header signature scheme.
Status poll (GET /v1/signals/{signalId}): authenticated with a LOTUX API token (`Authorization: Bearer lx_...`), created in the dashboard. Results are scoped to the accounts granted to that token.
Retry safety: the `X-Idempotency-Key` header is REQUIRED for breakeven, modify_sl, modify_tp, and a filtered close (a close without positionId) — those four are rejected with 400 without it. Reuse the SAME key when retrying: a retry inside the 45-second replay window is deduplicated; after the window expires, a reused key runs as a new action.

API versioning & deprecation policy

Versioning: read endpoints are versioned in the URL path (currently /v1/...). The webhook ingress path (/webhook/custom) is a stable contract: fields and actions are only ever ADDED, never changed or removed in place.

Deprecation: if LOTUX ever needs a breaking change, it ships under a new versioned path (e.g. /v2/...) while the old one keeps working. A deprecated operation is announced at least 90 days before shutdown via `Deprecation` and `Sunset` HTTP response headers on the affected endpoint, in the OpenAPI spec, and on this page.

Nothing is deprecated today. This page is the canonical place that changes first.

Rate limits & payload caps

Webhook requests are rate-limited in two layers: a route limiter (keyed by target account, then secret, then IP) and an always-on fairness throttle (per target account on the per-account URL; per USER on the broadcast URL — account↔secret links are many-to-many, so broadcast fairness follows the account owner, not the secret). A 429 response means slow down and retry later.
The JSON body is capped at 64 KB (413 beyond that).
Execution is asynchronous: a 202 means "accepted for execution" — poll GET /v1/signals/{signalId} for the per-account outcome. A 503 with a signalId in the body is a PARTIAL acceptance: poll that handle before resending.