Upstream risk infrastructure for private trading bots

Quickstart

1. Sign in and mint a key in the Developer portal.
2. Store it as USEBULLION_KEY in your bot's secret manager.
3. On every entry signal your bot generates, POST to /api/public/v1/risk/precheck.
4. If decision !== "approved", drop the trade — UseBullion has blocked it for a reason.

curl -X POST https://usebullion.com/api/public/v1/risk/precheck \
  -H "Authorization: Bearer ub_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "symbol": "XAUUSD", "side": "buy", "volume": 0.10, "requestId": "trade-abc-123" }'

Endpoints

Authentication

Send your key in the Authorization header:

Authorization: Bearer ub_live_XXXXXXXX…

Keys are hashed at rest (SHA-256). UseBullion only ever shows the plaintext at creation time. Revoke instantly from the developer portal. Default rate limit: 60 requests per minute per key.

Verifying signed responses

Every response includes X-UseBullion-Signature: sha256=… and X-UseBullion-Timestamp. Verify with the shared signing secret UseBullion issues on request (contact support to enable outbound verification).

import crypto from "node:crypto";

function verify(body: string, signatureHeader: string, timestampHeader: string, secret: string) {
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(`${timestampHeader}.${body}`)
    .digest("hex");
  // constant-time compare
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}

Error codes