Sandbox API documentation

vpn_key Authentication

All requests (except /api/sandbox/status) require an active sandbox key. Two accepted modes: header Authorization: Bearer <key> or X-Orynela-Key: <key>.

# Mode 1 — Bearer
Authorization: Bearer olab_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Mode 2 — Custom header
X-Orynela-Key: olab_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

verified_user Scopes

• heartbeat:write — envoyer des heartbeats périodiques
• logs:write — pousser des logs
• signal:write — émettre des signaux observés
• order:simulate — demander la simulation d'un ordre
• portfolio:read — lire le portefeuille fictif
• market:read — lire les bougies simulées

api Endpoints

terminal Exemples curl

# Heartbeat
curl -X POST https://orynela.ai/api/sandbox/heartbeat \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"online","latency_ms":120,"version":"0.1.0"}'

# Signal
curl -X POST https://orynela.ai/api/sandbox/signals \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{"symbol":"BTCUSDT","timeframe":"1m","side":"buy","confidence":0.72,"signal_type":"trend_observation","reasoning":"EMA alignment in sandbox"}'

# Ordre simulé
curl -X POST https://orynela.ai/api/sandbox/orders/simulate \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{"signal_id":123,"symbol":"BTCUSDT","side":"buy","order_type":"market","quantity":0.01}'

# Lire le portefeuille fictif
curl https://orynela.ai/api/sandbox/portfolio \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY"

# Lire les bougies simulées
curl "https://orynela.ai/api/sandbox/market/candles?symbol=BTCUSDT&timeframe=5m&limit=100" \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY"

code Exemple Python (sans dépendance)

import json, urllib.request

BASE = "https://orynela.ai/api/sandbox"
KEY  = "YOUR_SANDBOX_KEY"

def post(path, body):
    req = urllib.request.Request(
        BASE + path,
        data=json.dumps(body).encode(),
        headers={"Authorization": "Bearer " + KEY, "Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req) as r:
        return json.loads(r.read())

# Send heartbeat
print(post("/heartbeat", {"status": "online", "latency_ms": 120, "version": "0.1.0"}))

# Send signal
print(post("/signals", {
    "symbol": "BTCUSDT", "timeframe": "1m", "side": "buy",
    "confidence": 0.72, "signal_type": "trend_observation",
    "reasoning": "EMA alignment",
}))

# Request simulated order
print(post("/orders/simulate", {
    "symbol": "BTCUSDT", "side": "buy", "order_type": "market", "quantity": 0.01,
}))

error Common errors

# 401 — clé manquante / invalide
{"error":"invalid_credentials","message":"API key is invalid or revoked."}

# 403 — scope manquant
{"error":"forbidden_scope","message":"API key is missing required scope: order:simulate"}

# 403 — bot pas en statut actif
{"error":"bot_not_active","bot_status":"pending_review"}

# 422 — validation / Risk Guard refus
{"ok":false,"status":"risk_rejected","reason":"min_confidence"}

# 429 — rate limit dépassé
{"error":"rate_limit_exceeded"}

# 503 — kill switch / Lab désactivé
{"error":"kill_switch_engaged","message":"Agent Lab kill switch is engaged."}

speed Rate limits

10 requests per IP per minute per endpoint. 11th and beyond receive a 429.

block What the API does NOT allow

• No real execution.
• No real broker connection.
• No fund withdrawal.
• No public copy trading.
• No investment advice.
• No signal published as exploitable by a third party.