Changelog

2026-04-26

• Doc init — first public release.
• New — clientOrderId (UUID v4) idempotent retry support added on POST /v2/orders and POST /v2/orders/batch.
• New — forceWithOpenPosition flag on POST /v2/futures/leverage and POST /v2/futures/margin-type. Symbols with an open position now return 409 with a code field unless the flag is sent.
• New endpoint — GET /v2/platform/tokens — chain-specific decimals registry.
• Behavior — HMAC timestamp drift tightened from 30 s to 5 s; a 60-s replay cache was added.
• Behavior — when an API key is created, the Withdrawal permission scope is no longer carried by sub-account venue keys (UI may surface the toggle but the venue key won't carry it).
• Behavior — WS account channel periodic snapshots are now tagged event: "full_snapshot".
• Security — HMAC compare is timing-safe, JWT algorithm is pinned to HS256, JWT revocation now uses User.jwtRevision.