Update kickback rate

curl --request POST \
  --url https://api.arcus.xyz/v1/affiliate/kickback \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "address": "<string>",
  "kickbackBps": 2500
}
'

import requests

url = "https://api.arcus.xyz/v1/affiliate/kickback"

payload = {
    "address": "<string>",
    "kickbackBps": 2500
}
headers = {
    "X-API-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "X-Signature": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-API-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'X-Signature': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({address: '<string>', kickbackBps: 2500})
};

fetch('https://api.arcus.xyz/v1/affiliate/kickback', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.arcus.xyz/v1/affiliate/kickback",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'address' => '<string>',
    'kickbackBps' => 2500
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.arcus.xyz/v1/affiliate/kickback"

	payload := strings.NewReader("{\n  \"address\": \"<string>\",\n  \"kickbackBps\": 2500\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.arcus.xyz/v1/affiliate/kickback")
  .header("X-API-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("X-Signature", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"address\": \"<string>\",\n  \"kickbackBps\": 2500\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.arcus.xyz/v1/affiliate/kickback")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["X-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"address\": \"<string>\",\n  \"kickbackBps\": 2500\n}"

response = http.request(request)
puts response.read_body

{
  "status": "submitted"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "rate limited",
  "reason": "account_empty",
  "retryAfterMs": 850,
  "clientId": "my-order-42"
}

POST

affiliate

kickback

Update kickback rate

curl --request POST \
  --url https://api.arcus.xyz/v1/affiliate/kickback \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "address": "<string>",
  "kickbackBps": 2500
}
'

import requests

url = "https://api.arcus.xyz/v1/affiliate/kickback"

payload = {
    "address": "<string>",
    "kickbackBps": 2500
}
headers = {
    "X-API-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "X-Signature": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-API-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'X-Signature': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({address: '<string>', kickbackBps: 2500})
};

fetch('https://api.arcus.xyz/v1/affiliate/kickback', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.arcus.xyz/v1/affiliate/kickback",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'address' => '<string>',
    'kickbackBps' => 2500
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.arcus.xyz/v1/affiliate/kickback"

	payload := strings.NewReader("{\n  \"address\": \"<string>\",\n  \"kickbackBps\": 2500\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.arcus.xyz/v1/affiliate/kickback")
  .header("X-API-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("X-Signature", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"address\": \"<string>\",\n  \"kickbackBps\": 2500\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.arcus.xyz/v1/affiliate/kickback")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["X-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"address\": \"<string>\",\n  \"kickbackBps\": 2500\n}"

response = http.request(request)
puts response.read_body

{
  "status": "submitted"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "rate limited",
  "reason": "account_empty",
  "retryAfterMs": 850,
  "clientId": "my-order-42"
}

The response body shown here is a static example, not live data. After you click Send, your live result appears in a separate panel headed 200 OK. The panel under the status-code tabs is a fixed sample from the spec — its field values (fees, prices, sizes, IDs, timestamps) are placeholders. Use Send, or call the endpoint, for current values.

Updates the kickback rate (BPS) for the authenticated affiliate’s referral code.

Authorizations

X-API-Key

string

header

required

Hex-encoded Ed25519 public key (64 chars). The public key IS the API key — register it via POST /createApiKey. Required on every authenticated request, both read-only and signed.

X-Timestamp

string

header

required

Unix time in nanoseconds as a decimal string (e.g. "1713825891591000000"). Millisecond or second epochs are rejected with 401 Unauthorized. Must be within ±30,000 ms (MaxTimestampDriftMs, the drift window stays configured in milliseconds) of server wall-clock, or the request is rejected with 401 Unauthorized. Required on all mutating / credential-creating endpoints. This same value must appear as the ct field in the ordersign typed canonical payload (single-order endpoints) or in each element's ct field (batch endpoints).

X-Signature

string

header

required

Lowercase hex-encoded Ed25519 signature (128 chars).

Single-order endpoints (placeOrder, cancelOrder, modifyOrder, and other non-batch mutating routes) sign over the ordersign typed canonical payload — a compact, key-sorted JSON object built from parsed request fields using engine-native integer values:

placeOrder:   {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,"g":N,"m":N,"op":1,"p":N,"q":N,"r":0|1,"s":N,"t":N,"v":1}
cancelOrder:  {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,[,"id":"…"],"m":N,"op":2,"v":1}
modifyOrder:  {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,"g":N,"id":"…","m":N,"op":3,"p":N,"q":N,"r":0|1,"s":N,"t":N,"v":1}

ct must equal the X-Timestamp header value. Keys in brackets are conditional (omitted when empty). op values: 1=place, 2=cancel, 3=modify. See the ordersign package for field definitions and reference signing code.

Other signed routes (e.g. createApiKey, tokens, userPreferences) still use the legacy scheme: signing_message = X-Timestamp + ACTION + canonicalJSON(body), where ACTION is the camelCase final path segment.

Batch endpoints (batchPlaceOrders, batchCancelOrders) do NOT use this header. They authenticate with per-element typed ordersign signatures embedded in the request body (see the global auth description and the per-field signature descriptions on OrderRequest / CancelOrderRequest).

Read endpoints are authenticated by ?address= (and optionally X-API-Key) only — no signature is required. The one exception is GET /v1/affiliate/inviteCodes, which returns bearer secrets and therefore requires the full header triple; with no body its signing message is X-Timestamp + ACTION. canonicalJSON(body) is the JSON body with object keys sorted lexicographically at every level and no whitespace; the server canonicalizes the received body before verifying, so only the bytes signed over must be canonical. Required on all mutating / credential-creating endpoints.

Body

application/json

address

string

required

Ethereum address of the affiliate (must match signer).

kickbackBps

integer

required

New kickback rate in basis points. 0 means no kickback.

Required range: 0 <= x <= 5000

Response

Request submitted.

status

enum<string>

required

Available options:

submitted

API documentation

Endpoints

WebSocket

Changelog

Update kickback rate

Authorizations

Body

Response