Skip to main content

Delegated management

Use the member access token obtained through Partner authentication directly on the Management API. Supported resources are Tradovate Account Manager monitors, Tradovate trade copiers, Tradovate ATM templates, capability discovery (GET /v1/api/manage) and the audit log filtered to your app's writes. NinjaTrader resources, global controls, the kill switch, news lockout, connection settings and account groups are not delegated and return 403 operation_not_delegated to a member token. A partner token is not valid on this API.

First read: monitors​

Use the access_token stored for the member whose automation you want to read:

curl -sS "https://app.crosstrade.io/v1/api/manage/tradovate/monitors" \
  -H "Authorization: Bearer $MEMBER_TOKEN"

This requires manage:read, also implied by manage:write. Results use the Management API's success, data and meta envelope.

GET /v1/api/manage returns delegated: true, the delegated operation catalog and family availability. The catalog includes write operations even for a read-only token: it is not a per-token permission list. Check the token's returned scope, the family flags and the rules below before calling an operation.

Scopes​

Reads need manage:read; writes need manage:write. Starting execution-capable automation (turning a monitor or copier on, restarting a monitor) additionally requires tv:trade on a token issued for both the Management and Trading audiences; a token narrowed to one resource cannot start automation even if the member's grant would allow it.

Creating and changing resources​

  • Monitors and copiers you create start inactive, even if the create body asks for active: true. Enabling is a separate operation. Copiers use PATCH; an inactive or stopped monitor can require its POST .../restart endpoint. Follow the resource's state and response guidance. ATM templates are configuration and do not execute by themselves. Creation and enabling record the token's authority and the identities it covers.
  • You may change or delete only resources your app created. A resource the member created themselves, or that another app created, answers 409 resource_not_delegated instead of being taken over.
  • Every account a monitor or copier references must belong to a consented identity in an allowed environment. Failures return 403 identity_not_consented or 403 environment_not_allowed.
  • Monitor and copier reads are filtered by consented accounts, not ownership. A visible resource can still be read-only to your app because you did not create it. ATM templates have no account filter; writes still enforce ownership.

The PATCH body for enabling a copier is:

{
  "active": true
}

Use the normal Management API concurrency rules: send the current strong resource ETag in If-Match to reject stale updates, deletes or restarts. This header is optional on Management endpoints; without it, changes apply to the current saved state. Trading API command idempotency and Management API resource concurrency are separate contracts.

When automation pauses​

Copiers your app created run only while their recorded authority is current. They stop executing when the grant is revoked or replaced, after an emergency client-secret rotation, or when your service is suspended or disabled. Explicitly re-enable a paused copier under current authority after resolving the cause; payment alone does not re-enable it.

Monitors are protective automation and keep enforcing their limits after authority ends. Managed members cannot access the ordinary dashboard while their seat is open; after release, they can manage retained resources from their own account.

Enabling or changing an active monitor or copier requires the trading authority described above. Turning one off does not require tv:trade, but still requires a valid member token, manage:write, ownership and the other request checks. Deleting a monitor returns 409 resource_in_use while a copier your app did not create depends on that account.