Noviqa SDK

Appearance

trader.auth ​

9 methods on trader.auth. Each returns the answer's data and throws NoviqaError on a failed answer.

changePassword ​

POST/trader/v1/auth/change-password

Change the own password (trader)

Needs the current password. The new one must be 8-16 characters with a lower case letter, an upper case letter, a digit and a symbol, and differ from the current one. Closes every session of the login: sign in again.

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Request body
current_passwordstring
new_passwordstring
Returns
Promise<null>
The answer's data.
Errors
400auth.password_same: new password must differ from the current one
400auth.password_weak: password must be 8-16 characters with a lower, upper, digit and symbol
400invalid_input: invalid input
401auth.invalid_credentials: wrong login or password
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_not_allowed: password change is not allowed for this account
403auth.password_change_required: you must change your password first
409auth.account_changed: the signed-in account changed; sign in again before continuing
429auth.too_many_attempts: too many attempts, try again later
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.changePassword({
  current_password: "string",
  new_password: "string"
})
bash
curl -X POST "$NOVIQA_API_URL/trader/v1/auth/change-password" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "current_password": "string",
  "new_password": "string"
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": null,
  "request_id": "5b7f2c1e"
}
ts
trader.auth.changePassword(body: http.changePasswordRequest, options?: RequestOptions): Promise<null>

login ​

POST/trader/v1/auth/login

Sign in (trader)

Checks login and password and opens a session. Browser terminals (web, admin, manager) get HttpOnly cookies and the csrf_token to echo in X-CSRF-Token; other terminals get access_token and refresh_token for the Authorization header. If the answer is auth.otp_required, send the same request again with otp. A session with must_change_password or must_enrol_otp may only do that (see the guide). Failed attempts are counted per login and address and end in auth.too_many_attempts for a while. Staff terminals: admin, manager (default manager); trader terminals: web (default), android, ios, desktop, api.

Request body
keep_signed_inboolean
logininteger
otpstring
passwordstring
terminalany
staff: admin | manager; trader: web | android | ios | desktop | api
Returns
Promise<tokensView>
The answer's data.
Errors
400invalid_input: invalid input
401auth.invalid_credentials: wrong login or password
401auth.otp_invalid: wrong one-time code
401auth.otp_not_set: set up one-time codes to continue
401auth.otp_required: enter the one-time code from your authenticator app
403auth.account_disabled: account is disabled
403auth.invalid_terminal: this terminal cannot be used here
403auth.ip_not_allowed: sign-in from this address is not allowed
403auth.not_staff: account is not set up for staff access
403auth.terminal_not_allowed: this terminal is not allowed for the account
403forbidden: you do not have access to this action
429auth.too_many_attempts: too many attempts, try again later
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.login({
  login: 1000,
  password: "Adm1n#Pass",
  terminal: "admin"
})
bash
curl -X POST "$NOVIQA_API_URL/trader/v1/auth/login" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "login": 1000,
  "password": "Adm1n#Pass",
  "terminal": "admin"
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "access_expires_at": "2026-09-25T10:15:00Z",
    "access_token": "string",
    "csrf_token": "string",
    "refresh_token": "string",
    "session": {
      "csrf_token": "string",
      "expires_at": "2026-09-25T10:15:00Z",
      "group": "real\\standard",
      "group_scope": [
        "string"
      ],
      "keep_signed_in": true,
      "login": 1001,
      "must_change_password": true,
      "must_enrol_otp": true,
      "read_only": true,
      "rights": [
        "string"
      ],
      "server_clock": {
        "daylight_saving": "none",
        "utc_offset_min": 1
      },
      "terminal": "web"
    },
    "session_expires_at": "2026-09-25T10:15:00Z"
  },
  "request_id": "5b7f2c1e"
}
ts
trader.auth.login(body: http.loginRequest, options?: RequestOptions): Promise<http.tokensView>

logout ​

POST/trader/v1/auth/logout

Sign out (trader)

Closes the session and then clears the cookies. If browser access has expired, the still-live refresh cookie can authenticate this revocation only, without rotating it; X-CSRF-Token remains required. Failed revocation does not clear cookies or claim sign-out success.

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Returns
Promise<null>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
409auth.account_changed: the signed-in account changed; sign in again before continuing
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.logout()
bash
curl -X POST "$NOVIQA_API_URL/trader/v1/auth/logout" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": null,
  "request_id": "5b7f2c1e"
}
ts
trader.auth.logout(options?: RequestOptions): Promise<null>

me ​

GET/trader/v1/auth/me

The signed-in session (trader)

Who is signed in, what they must do first (must_change_password, must_enrol_otp), staff rights and group scope, and the csrf token. expires_at is the session end; access_expires_at is the verified access token's expiry, so a reloaded page can schedule its refresh. Allowed to restricted sessions.

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Returns
Promise<currentSessionView>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
409auth.account_changed: the signed-in account changed; sign in again before continuing
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.me()
bash
curl -X GET "$NOVIQA_API_URL/trader/v1/auth/me" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "access_expires_at": "2026-09-25T10:15:00Z",
    "csrf_token": "string",
    "expires_at": "2026-09-25T10:15:00Z",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "keep_signed_in": true,
    "login": 1001,
    "must_change_password": true,
    "must_enrol_otp": true,
    "read_only": true,
    "rights": [
      "string"
    ],
    "server_clock": {
      "daylight_saving": "none",
      "utc_offset_min": 1
    }
  },
  "request_id": "5b7f2c1e"
}
ts
trader.auth.me(options?: RequestOptions): Promise<http.currentSessionView>

otp ​

GET/trader/v1/auth/otp

One-time code status (trader)

Whether one-time codes are on for the login and whether its group requires them.

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Returns
Promise<OTPStatus>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
409auth.account_changed: the signed-in account changed; sign in again before continuing
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.otp()
bash
curl -X GET "$NOVIQA_API_URL/trader/v1/auth/otp" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "enabled": true,
    "required": true
  },
  "request_id": "5b7f2c1e"
}
ts
trader.auth.otp(options?: RequestOptions): Promise<auth.OTPStatus>

otpConfirm ​

POST/trader/v1/auth/otp/confirm

Finish one-time code setup (trader)

Turns codes on with the first 6-digit code from the app. A session that had to enrol becomes a full session.

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Request body
codestring
Returns
Promise<sessionView>
The answer's data.
Errors
400invalid_input: invalid input
401auth.otp_invalid: wrong one-time code
401auth.otp_not_set: set up one-time codes to continue
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
409auth.account_changed: the signed-in account changed; sign in again before continuing
429auth.too_many_attempts: too many attempts, try again later
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.otpConfirm({
  code: "string"
})
bash
curl -X POST "$NOVIQA_API_URL/trader/v1/auth/otp/confirm" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "code": "string"
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "csrf_token": "string",
    "expires_at": "2026-09-25T10:15:00Z",
    "group": "real\\standard",
    "group_scope": [
      "string"
    ],
    "keep_signed_in": true,
    "login": 1001,
    "must_change_password": true,
    "must_enrol_otp": true,
    "read_only": true,
    "rights": [
      "string"
    ],
    "server_clock": {
      "daylight_saving": "none",
      "utc_offset_min": 1
    },
    "terminal": "web"
  },
  "request_id": "5b7f2c1e"
}
ts
trader.auth.otpConfirm(body: http.otpRequest, options?: RequestOptions): Promise<http.sessionView>

otpDisable ​

POST/trader/v1/auth/otp/disable

Turn one-time codes off (trader)

Needs a current code. Refused when the group requires codes.

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Request body
codestring
Returns
Promise<OTPStatus>
The answer's data.
Errors
400invalid_input: invalid input
401auth.otp_invalid: wrong one-time code
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
403forbidden: you do not have access to this action
409auth.account_changed: the signed-in account changed; sign in again before continuing
429auth.too_many_attempts: too many attempts, try again later
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.otpDisable({
  code: "string"
})
bash
curl -X POST "$NOVIQA_API_URL/trader/v1/auth/otp/disable" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "code": "string"
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "enabled": true,
    "required": true
  },
  "request_id": "5b7f2c1e"
}
ts
trader.auth.otpDisable(body: http.otpRequest, options?: RequestOptions): Promise<auth.OTPStatus>

otpEnrol ​

POST/trader/v1/auth/otp/enrol

Start one-time code setup (trader)

Makes a new secret: show uri as a QR code (or secret to type in) in an authenticator app, then confirm with its first code.

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Returns
Promise<OTPEnrolment>
The answer's data.
Errors
400invalid_input: invalid input
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
403auth.otp_enrol_required: your group requires one-time codes: set them up to continue
403auth.password_change_required: you must change your password first
409auth.account_changed: the signed-in account changed; sign in again before continuing
409conflict: already exists
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.otpEnrol()
bash
curl -X POST "$NOVIQA_API_URL/trader/v1/auth/otp/enrol" \
  -H "Authorization: Bearer $NOVIQA_TOKEN"
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "secret": "string",
    "uri": "string"
  },
  "request_id": "5b7f2c1e"
}
ts
trader.auth.otpEnrol(options?: RequestOptions): Promise<auth.OTPEnrolment>

refresh ​

POST/trader/v1/auth/refresh

Renew the session (trader)

Trades the refresh token for new tokens (the old refresh token stops working). Browsers send nothing in the body: the refresh cookie rides along and X-CSRF-Token is required; other terminals send refresh_token. Call it shortly before access_expires_at, or when a call answers auth.session_expired. Reusing an old refresh token closes the session (auth.refresh_reused).

Parameters
X-HST-Accountstring · header
Intended signed-in login captured by the browser tab before dispatch and retained across retries. A mismatch returns auth.account_changed (409) before mutation or refresh rotation. This never selects or authorizes an account; omission preserves existing API client compatibility.
Request body
refresh_tokenstring
Returns
Promise<tokensView>
The answer's data.
Errors
400invalid_input: invalid input
401auth.refresh_reused: session closed for safety, sign in again
401auth.session_expired: session expired, sign in again
403auth.csrf_invalid: request refused: reload the page and try again
403auth.invalid_terminal: this terminal cannot be used here
409auth.account_changed: the signed-in account changed; sign in again before continuing
500internal: something went wrong
ts
import { trader } from "@/lib/noviqa"

const data = await trader.auth.refresh({
  refresh_token: "string"
})
bash
curl -X POST "$NOVIQA_API_URL/trader/v1/auth/refresh" \
  -H "Authorization: Bearer $NOVIQA_TOKEN" \
  -H "Content-Type: application/json" \
  --data-raw '{
  "refresh_token": "string"
}'
json
{
  "success": true,
  "code": "ok",
  "message": "done",
  "data": {
    "access_expires_at": "2026-09-25T10:15:00Z",
    "access_token": "string",
    "csrf_token": "string",
    "refresh_token": "string",
    "session": {
      "csrf_token": "string",
      "expires_at": "2026-09-25T10:15:00Z",
      "group": "real\\standard",
      "group_scope": [
        "string"
      ],
      "keep_signed_in": true,
      "login": 1001,
      "must_change_password": true,
      "must_enrol_otp": true,
      "read_only": true,
      "rights": [
        "string"
      ],
      "server_clock": {
        "daylight_saving": "none",
        "utc_offset_min": 1
      },
      "terminal": "web"
    },
    "session_expires_at": "2026-09-25T10:15:00Z"
  },
  "request_id": "5b7f2c1e"
}
ts
trader.auth.refresh(body: http.refreshRequest, options?: RequestOptions): Promise<http.tokensView>