Provider Documentation

Register a new provider account. Returns a JWT and the new provider row.

Body

{ "name": "My Service", "email": "[email protected]",
  "password": "StrongPass2026" }
// Password: ≥10 chars, must contain uppercase, lowercase, and a digit

Example

curl -X POST https://api.copybridge.io/api/v1/providers/register \
  -H "Content-Type: application/json" \
  -d '{"name":"My Service","email":"[email protected]","password":"StrongPass2026"}'

Responses

• 201 { "token": "<JWT>", "provider": { "id", "name", "email", "plan", "max_followers", "active", "created_at" } }
• 400 name/email/password validation · 409 email already registered · 500

Authenticate with email and password. Returns a JWT valid for 7 days.

Body

{ "email": "[email protected]", "password": "StrongPass2026" }

Example

curl -X POST https://api.copybridge.io/api/v1/providers/login \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"StrongPass2026"}'

Responses

• 200 { "token": "<JWT>", "provider": { "id", "name", "email", "plan", "max_followers", "active" } }
• 400 "Email and password are required" · 401 invalid credentials or no password login · 403 account inactive · 500

Get the authenticated provider's profile, plan, and settings.

Example

curl https://api.copybridge.io/api/v1/providers/me \
  -H "Authorization: Bearer <JWT>"

Responses

• 200 { "id", "name", "email", "plan", "max_followers", "active", "billing_status", "allowed_symbols", "copy_fee_pct", "email_verified", "created_at", "updated_at" }
• 401 bad/missing token · 404 provider not found · 500

Update provider settings (name, allowed_symbols, copy_fee_pct).

Aggregated trading performance: win rate, profit points, open positions, active followers.

Example

curl https://api.copybridge.io/api/v1/providers/me/stats \
  -H "Authorization: Bearer <JWT>"

Responses

• 200 { "total_trade_events", "open_positions", "closed_trades", "winning_trades", "losing_trades", "win_rate", "total_profit_points", "symbols_traded", "active_followers" }
• 401 bad/missing token · 500

Retrieve the current master API key (used to authenticate trade ingest).

Example

curl https://api.copybridge.io/api/v1/providers/me/master-key \
  -H "Authorization: Bearer <JWT>"

Responses

• 200 { "master_key": "<uuid>" }
• 401 bad/missing token · 404 provider not found · 500

Generate a new master key (invalidates the old one).

Ingest a trade event from your master account. Idempotent per (provider, ticket, action) for OPEN/CLOSE.

Body

{ "action": "OPEN" | "CLOSE" | "MODIFY",
  "symbol": "EURUSD", "type": "BUY" | "SELL",
  "lots": 0.1, "price": 1.1, "ticket": 123456,
  "sl": 0, "tp": 0, "magic": 0, "timestamp": "ISO-8601 (optional)" }

Example

curl -X POST https://api.copybridge.io/api/v1/trades \
  -H "X-API-Key: <master_key>" -H "Content-Type: application/json" \
  -d '{"action":"OPEN","symbol":"EURUSD","type":"BUY","lots":0.1,"price":1.1,"ticket":123456}'

Responses

• 201 trade created (returns the trade row: id, seq, action, symbol, type, lots, price, sl, tp, magic, ticket, timestamp, created_at)
• 200 { "status": "duplicate" } — idempotent re-send
• 400 validation · 401 bad/missing key · 403 symbol/position cap · 429 OPEN-rate cap

Poll for new trade events. Use ?since_seq= (preferred) or ?since= (ISO timestamp) for cursor polling. /api/v1/trades/open and /api/v1/trades/snapshot share the same auth and trade-row shape.

Example

curl "https://api.copybridge.io/api/v1/trades?since_seq=0" \
  -H "X-Subscriber-Key: <subscriber_key>"

Responses

• 200 { "trades": [ { "id", "seq", "action", "symbol", "type", "lots", "price", "sl", "tp", "magic", "ticket", "timestamp", "created_at" }, ... ], "count": N } — up to 100 rows ordered by seq
• 401 bad/missing key · 500

List currently open master tickets (for ghost trade reconciliation).

Full state snapshot with all open positions and max_seq (for initial sync on EA startup).

List all followers with their status and subscriber keys.

Example

curl https://api.copybridge.io/api/v1/providers/me/followers \
  -H "Authorization: Bearer <JWT>"

Responses

• 200 { "followers": [ { "id", "subscriber_key", "name", "email", "active", "created_at" }, ... ], "count": N }
• 401 bad/missing token · 500

Create a new follower manually. Returns the follower row including the unique subscriber_key for the Copier EA.

Body

{ "name": "Alice Trader", "email": "[email protected]" }
// email is optional

Example

curl -X POST https://api.copybridge.io/api/v1/providers/me/followers \
  -H "Authorization: Bearer <JWT>" -H "Content-Type: application/json" \
  -d '{"name":"Alice Trader","email":"[email protected]"}'

Responses

• 201 { "id", "subscriber_key", "name", "email", "active", "created_at" }
• 400 name required · 403 follower limit reached · 409 email already exists for this provider · 500

Update a follower's name or active status.

Body

{ "name": "New Name", "active": false }
// Both fields optional; at least one required

Example

curl -X PUT https://api.copybridge.io/api/v1/providers/me/followers/42 \
  -H "Authorization: Bearer <JWT>" -H "Content-Type: application/json" \
  -d '{"active":false}'

Responses

• 200 updated follower row: { "id", "subscriber_key", "name", "email", "active", "created_at" }
• 400 no valid fields · 404 follower not found · 500

Permanently remove a follower. Their subscriber key is invalidated immediately.

Example

curl -X DELETE https://api.copybridge.io/api/v1/providers/me/followers/42 \
  -H "Authorization: Bearer <JWT>"

Responses

• 204 deleted (no body)
• 404 follower not found · 500

Health check scoped to your provider: trade count, active followers, master balance, and last trade time.

Example

curl https://api.copybridge.io/api/v1/status \
  -H "X-API-Key: <master_key>"

Responses

• 200 { "status": "ok", "uptime": 3600, "trades": 42, "active_subscribers": 5, "master_balance": 10500.00, "last_trade": "2026-05-17T..." }
• 401 bad/missing key · 500

Master EA sends balance heartbeat.

Get provider's last reported balance (used by Copier EA for lot scaling).

Server liveness probe. Returns {ok: true} when the API process is up. Not scoped to a provider.

Returns the Master EA's connection state, derived from its most recent heartbeat. Response: {connected: boolean, last_seen: ISO-8601 | null}. connected is true if the last heartbeat is within the past 2 minutes.

Master EA heartbeat. Body: {balance, account_login?}. Updates the master_state heartbeat timestamp (which drives GET /me/master-status) and stores the latest balance. Enforces single-Master-EA per provider: returns 409 if a different account_login heartbeated within the last 2 minutes.

View webhook URL and setup instructions.

Set the Whop webhook signing secret for signature verification.

Check if webhook is properly configured.

Whop sends membership events here. Auto-creates/deactivates followers.