Skip to main content

Connectivity & Endpoints

Senticore exposes one public HTTP/WebSocket surface and three dedicated institutional lanes (FIX 4.4, BSL Direct TCP, and binary-FIX/FIXP). This page is the single source of truth for where you connect, on which port, and how TLS is terminated. Everything here is verified against the running gateway configuration. If a number differs from an older page, this page wins.

Machine-readable source of truth

The exact, live values (hosts, ports, SNIs, credential field names, frame sizes) are also served by the connectivity bundle: GET /api/v1/bsl/connectivity (aliases GET /api/v1/fix/connectivity and GET /api/v1/fixp/connectivity). Build your deployment config from that endpoint rather than hard-coding values. In particular, only enable FIXP clients when the returned fixp.enabled is true.

Endpoint matrix​

LaneHost (TLS SNI)PortProtocolTLS terminatesFor
Public REST + WebSocketapi.sentico-labs.xyz443HTTPS / WSSnginx (edge)Everyone: market data, account, retail order entry
FIX 4.4 (tag=value)fix.sentico-labs.xyz9878FIX 4.4 over TLSIn-process (rustls)Institutions with an existing FIX engine
BSL Direct TCP (binary)bsl.sentico-labs.xyz9001Senticore BSL v2 over TLSIn-process (rustls)Latency-sensitive MMs, per-order signed
Binary-FIX / FIXP (SBE)fixp.sentico-labs.xyz9879 when fixp.enabled=trueSBE + SOFH + FIXP over TLSIn-process (rustls)CME-iLink-3-class shops (SBE/FIXP stack)

All three binary lanes resolve directly to the Senticore host:

fix.sentico-labs.xyz    A   46.225.50.61
bsl.sentico-labs.xyz    A   46.225.50.61
fixp.sentico-labs.xyz   A   46.225.50.61

They are raw TCP ports with in-process TLS. They do not pass through a CDN or an HTTP reverse proxy. Only api.sentico-labs.xyz is behind the HTTP edge.

Keep the binary lanes DNS-only

FIX, BSL, and FIXP are TLS-over-TCP, not HTTP. A CDN/HTTP proxy such as Cloudflare orange-cloud will break the handshake. Keep these three records DNS-only. The connectivity bundle advertises cloudflareHttpsProxySupported: false for exactly this reason.

TLS, SNI, mTLS, and IP posture​

  • Present the correct SNI per lane. Each lane validates against its own subdomain (fix., bsl., fixp.), not api..
  • TLS is mandatory on every public lane. Production deployments fail closed if a binary lane would bind plaintext on a public interface.
  • mTLS is optional and recommended for dedicated institutional routes. When a client CA is configured the gateway requires a client certificate; otherwise it accepts any valid TLS client and relies on application-layer credentials.
  • Source-IP allowlisting is optional for desks with static egress IPs. The public FIX, BSL, and FIXP lanes do not require IP onboarding by default, but order entry still requires valid session or per-order credentials.

Which lane should I use?​

You are...UseWhy
A retail / programmatic traderREST + WebSocket (api.)Simplest: one HTTPS host, JSON, signed actions, /feed/public for market data
An MM that already runs a FIX engineFIX 4.4 (fix.)Drop-in tag=value; session auth, order status, drop-copy, cancel-on-disconnect
A latency-sensitive MM wanting a lean binary wireBSL Direct TCP (bsl.)192-byte fixed-layout order frames, recoverable session, per-order ECDSA
A CME/B3-ecosystem shop with an SBE/FIXP stackBinary-FIX / FIXP (fixp.)Standards-interoperable SBE+FIXP; session auth; cancel-on-disconnect + mass-cancel
Same engine, every lane

All lanes feed the same deterministic matching engine with identical semantics: price-time priority, the same self-trade-prevention modes, the same nonce model, and the same fee schedule. The lane is a transport choice, not a different market.

Public REST + WebSocket base URLs​

SurfaceURL
RESThttps://api.sentico-labs.xyz/api/v1/...
Multiplexed WebSocketwss://api.sentico-labs.xyz/api/v1/ws/public and .../api/v1/ws/private/{account}
Snapshot+delta market feedwss://api.sentico-labs.xyz/api/v1/feed/public plus /feed/public/a and /feed/public/b
Server-Sent Eventshttps://api.sentico-labs.xyz/api/stream/market and .../api/stream/account/{account}

For market data, MMs and HFT should use /api/v1/feed/public/a + /b: two redundant lines carrying a sequenced snapshot+delta stream with per-frame integrity checksums and gap recovery. The multiplexed /api/v1/ws/public is best for charts and lightweight clients. See WebSocket Overview.

Per-lane summary​

FIX 4.4 - fix.sentico-labs.xyz:9878​

Standard FIX.4.4 tag=value over TLS. Logon (35=A) carries your API key in Username(553), secret:passphrase in Password(554), and the engine account in Account(1). Supports NewOrderSingle, Cancel, atomic CancelReplace, MassCancel, OrderStatus, drop-copy (TargetSubID(57)=drop_copy), and cancel-on-disconnect. No per-order signing: the session is the authenticated identity. See FIX API.

BSL Direct TCP - bsl.sentico-labs.xyz:9001​

Senticore's lean binary lane: a 48-byte handshake, an 8-byte [kind][len] message header, and a 192-byte fixed-layout CompactActionFrame decoded zero-copy. The v2 session is recoverable: sequenced acknowledgements, heartbeats, retransmit, token-based resume, and bounded backpressure.

BSL does not authenticate once and then trust the socket. For each single order, send:

AuthSidecar(kind=4, cold AuthSidecar payload)
CompactActionFrame(kind=1, 192-byte frame)

For atomic groups, use CompactFrameGroup(kind=10) where every item embeds its own sidecar. The AuthSidecar carries auth_binding, secp256k1 signature, 20-byte signer_id, and mandatory cold-encoded SignedAction payload_bytes. The sequencer verifies the v2 chain-bound action hash, signer authorization, account mapping, compact frame fields, replay/nonce state, and rate limits. See BSL Direct TCP for the full wire order and failure modes.

Binary-FIX / FIXP - fixp.sentico-labs.xyz:9879​

The CME-iLink-3-class stack: SBE message encoding + SOFH framing + FIXP Recoverable session. Authenticate once at Negotiate with apiKeyId:apiSecret:apiPassphrase:accountHex; thereafter the session is the identity (no per-order signing). Cancel-on-disconnect, mass-cancel, ClOrdID dedup, OrderStatusRequest replies, account-bound cross-connection resume, and a published SBE schema + golden vectors are used for codec certification. The public lane is reachable without IP onboarding, like FIX 4.4; invalid credentials are rejected during FIXP negotiation. Check GET /api/v1/fixp/connectivity before startup and fail closed if fixp.enabled is false. See Binary-FIX Conformance.

Last updated on