Skip to main content
The Starbase REST API exposes a set of portfolio-scoped management operations. All endpoints require authentication; the authenticated session determines which portfolio is acted upon. Any Starbase API key belonging to a direct-access-enabled portfolio can call these endpoints. The REST gateway does not currently enforce API key scopes (see Creating a Starbase API Key).

​
Mass Cancel

Mass cancel removes every open order and quote belonging to the authenticated portfolio in a single call. Unlike the binary Mass Cancel message, which targets orders by instrument or side, the REST endpoint applies unconditionally. No filters are accepted. The typical use case is risk reduction: a single call clears the entire book across all instruments and both sides. The endpoint returns the total number of orders cancelled across all matching engine shards.
Mass cancel via REST is always available and cannot be disabled by admin configuration.
→ GET /api/v2/private/cancel_all

​
Portfolio Lock State

The portfolio lock controls whether DIRECT_ACCESS (SBE binary) order entry is accepted. The lock is a portfolio-level toggle, independent of individual sessions or gateway connections.

​
Locking

Locking a portfolio has two immediate effects:
  1. All open DIRECT_ACCESS orders and quotes for the portfolio are cancelled.
  2. Any subsequent DIRECT_ACCESS order or quote submission is rejected until the portfolio is unlocked.
REST-submitted orders are not subject to the lock. Only binary DIRECT_ACCESS order flow is gated. → GET /api/v2/private/lock_portfolio

​
Unlocking

Unlocking restores normal acceptance of DIRECT_ACCESS order entry. Orders cancelled by the preceding lock are not reinstated; clients must resubmit any desired positions. → GET /api/v2/private/unlock_portfolio
After a lock, cancelled orders are gone permanently. Unlocking the portfolio does not restore them.

​
Position Limits

GET /api/v2/private/get_starbase_risk_limits returns the effective position limits for the authenticated portfolio. The response has one entry per underlying (currency pair) that has a currency-pair default or an override for this portfolio. Each numeric field is resolved on its own: a portfolio override replaces the currency-pair default only for the fields that are set. A field unset at both levels is omitted. -1 means the limit is explicitly unlimited. The call does not change limits. An optional currency query parameter selects one underlying. Use the currency-pair name from the response (for example BTC_USDC). The match ignores case and separators (btc-usdc, BTCUSDC). An unknown name returns HTTP 400. A known pair with no configured limit returns an empty list. The endpoint is capped at 1 request per minute per portfolio on each REST gateway. See REST Gateway Limits. → GET /api/v2/private/get_starbase_risk_limits

​
Relationship to Other Risk Controls

Portfolio management complements but does not replace other Starbase risk features: