Download OpenAPI specification:Download
Fireblocks connects businesses across the crypto world as the digital asset infrastructure for over 1,600 of the leading trading desks, hedge funds, brokerages, custodians, 3rd parties, and banks. To meet the demand of third-party services that want to access the liquidity of institutional investors and traders, Fireblocks is opening our platform for third-party solutions to quickly integrate into the Fireblocks platform. Reach out to us for a partnership agreement and add a Connector to have your product integrated.
Fireblocks customers use the Fireblocks web-based console to connect their third-party accounts such as crypto 3rd partyie. This requires generating an API Key and an API Secret from their 3rd party portals, logging into their Fireblocks Console, adding an 3rd party account, selecting the 3rd party by a name and a logo, and then entering their account API Key, API Secret, and login details.
Once the third-party account is connected, Fireblocks customers can use the Fireblocks Console and API to:
Contact your Fireblocks Sales Rep to list your 3rd party in the Fireblocks ecosystem. You will need to sign a licensing agreement for listing your 3rd party. Please note that an 3rd party listing license agreement is separate from a self-custody license agreement, and neither agreement is required to sign the other. Once signed, you will receive a test environment to connect and begin integrating your pending 3rd party integration.
Begin configuring inbound connections for the API endpoints described below. Fireblocks initiates calls to each of these endpoints under your base URL whenever a Fireblocks customer accesses your 3rd party using the Fireblocks integration. Once your contract is signed, the Fireblocks technical team will reach out to you to gather your 3rd party registration settings (see below).
Fireblocks starts each 3rd party integration with a short beta program. At a minimum, the beta participant will be yourself. Optionally, you may engage with your clients who already use Fireblocks for trading and self-custody to provide feedback on the beta program. Once the Fireblocks team determines the beta is successful, your 3rd party is made available to all Fireblocks customers, alongside mutual marketing activities to promote the launch.
Once your license agreement for listing your 3rd party with Fireblocks is signed, the Fireblocks technical team will request the following 3rd party registration settings:
All REST requests will contain the following headers:
*X-FBAPI-KEY* The API key as a string.
*X-FBAPI-SIGNATURE* The payload signature output.
*X-FBAPI-TIMESTAMP* A timestamp of the request (in milliseconds)
*X-FBAPI-NONCE* A unique reference to the request (Random)
The X-FBAPI-TIMESTAMP header is the number of milliseconds since Unix Epoch in UTC. e.g. 1547015186532
The difference between the timestamp and the 3rd party time must be less than X seconds.
The amount of seconds (=X) is up to the 3rd party to decide - recommended to be a reasonable amount.
It's expected that the request on the 3rd party's end will be considered expired and rejected otherwise.
[Authentication scheme is configurable: HMAC, RSA, ECDSA]
The API-KEY and SECRET are necessary, and are generated and provided by the 3rd party.
Signature procedure:
Create a prehash string {timestamp+nonce+method+endpoint+body}.
Apply an encoding onto the prehash string (Pre-encoding is configurable: PLAIN, BASE64, HEXSTR, BASE58, BASE32)
[The request body is a JSON string and need to be the same with the parameters passed by the API]
Use SECRET to sign the string with HMAC (Internal hash function is configurable: SHA512, SHA3_256, SHA256)
Apply an additional encoding onto the signature result (Post-encoding is configurable: PLAIN, BASE64, HEXSTR, BASE58, BASE32)
Supported RSA Parameters [PKCS1v15]
The API-KEY and SECRET are necessary, and are generated and provided by the 3rd party.
SECRET is defined to be the Private RSA PEM.
Signature procedure on Fireblocks's end:
Create a prehash string {timestamp+nonce+method+endpoint+body}.
Apply an encoding onto the prehash string (Pre-encoding is configurable: PLAIN, BASE64, HEXSTR, BASE58, BASE32)
[The request body is a JSON string and need to be the same with the parameters passed by the API]
Use SECRET to sign the string with RSA (Internal hash function is configurable: SHA512, SHA3_256, SHA256)
Apply an additional encoding onto the signature result (Post-encoding is configurable: PLAIN, BASE64, HEXSTR, BASE58, BASE32)
Supported ECDSA Parameters [prime256v1/secp256k1]
The API-KEY and SECRET are necessary, and are generated and provided by the 3rd party.
SECRET is defined to be the Private ECDSA PEM. ECDSA result signature has an ASN1.DER format.
Signature procedure on Fireblocks's end:
Create a prehash string {timestamp+nonce+method+endpoint+body}.
Apply an encoding onto the prehash string (Pre-encoding is configurable: PLAIN, BASE64, HEXSTR, BASE58, BASE32)
[The request body is a JSON string and need to be the same with the parameters passed by the API]
Use SECRET to sign the string with ECDSA (Internal hash function is not configurable and is set to: SHA256)
Apply an additional encoding onto the signature result (Post-encoding is configurable: PLAIN, BASE64, HEXSTR, BASE58, BASE32)
- The timestamp in the signature payload is consistent with the X-FBAPI-TIMESTAMP field in the request header.
- The body to be signed is consistent with the content of the request body.
- The method is always UPPER CASE.
- For GET requests, the endpoint in the signature payload contains the query string. e.g. /v1/depositAddress?coinSymbol=ETH&...
- The endpoint in the signature payload is always in a path-relative format.
- The endpoint in the signature payload could contain more paths, it's configurable. e.g. (DEFAULT) /v1/depositAddress, /fireblocks/v1/depositAddress...
- The body is "" if there is no request body (for GET requests).
Upon failures, the expected format of the error is as follows:
{"error": "Missing request header params", "errorCode": 400000}
"error" must be a string and is required.
"errorCode" must either be a number or null.
Missing request header params | 400000 |
Nonce sent was invalid | 400001 |
Timestamp sent was invalid | 400002 |
Signature sent was invalid | 400003 |
Insufficient permissions for this API key | 400004 |
Insufficient funds to carry out this operation | 400005 |
Insufficient fee to carry out this operation | 400006 |
Unsupported account type for this 3rd party | 400007 |
Unsupported operation for this 3rd party | 400008 |
Asset not supported on this 3rd party | 400009 |
One of the parameters sent in the body or query is invalid | 400010 |
Bad address format sent | 400011 |
Balance amount is too small | 400012 |
This 3rd party needs manual deposit address generation | 400013 |
The 3rd party rejected this operation | 400014 |
Withdraw was cancelled or failed on the 3rd party | 400015 |
Address wasn't whitelisted | 400016 |
IP wasn't whitelisted | 400017 |
Account not found | 400018 |
Withdrawals are limited by the 3rd party. Please try again in a bit. | 400019 |
3rd party has denied the request - a settlement is required! | 400020 |
Note that not all error codes need to be in use!
All notable changes to this project will be documented in this file. Dates are displayed in UTC.
31 October 2024
14 July 2024
30 May 2024
07 Dec 2023
02 Dec 2023
06 August 2023
17 July 2023
16 July 2023
10 May 2023
13 March 2023
26 Feb 2023
2 Feb 2023
29 Jan 2023
29 Dec 2022
18 Nov 2022
In case the 3rd party supports an account type but the account doesn't contain any balance, it is expected the "balances" field to be an empty array.
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
[- {
- "displayName": "Margin (Cross)",
- "type": "MARGIN",
- "balances": [
- {
- "coinSymbol": "USDT",
- "totalAmount": "195.172612",
- "pendingAmount": "188.2315812",
- "availableAmount": "10.333",
- "creditAmount": "3.1"
}
]
}
]
Fireblocks will first check if a deposit wallet address exists using this endpoint. If one does not exist, then a new address will be created using the POST /v1/depositAddress
endpoint.
accountType required | string (Account_Type) Enum: "EXCHANGE" "SPOT" "FUNDING" "MARGIN" "FUTURES" "OPTIONS" "MARGIN_CROSS" "USDT_FUTURES" "COIN_FUTURES" Example: accountType=MARGIN The account type to return the deposit address from. The API will fill the fundableAccountType here. |
coinSymbol required | string Example: coinSymbol=USDT |
required | Mainnet_Networks (string) or Testnet_Networks (string) |
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
{- "depositAddress": "0xb794f5ea0ba39494ce839613fffba74279579268",
- "depositAddressTag": "63163621"
}
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
accountType required | string (Account_Type) Enum: "EXCHANGE" "SPOT" "FUNDING" "MARGIN" "FUTURES" "OPTIONS" "MARGIN_CROSS" "USDT_FUTURES" "COIN_FUTURES" Enumeration on types of possible accounts |
coinSymbol required | string |
required | Mainnet_Networks (string) or Testnet_Networks (string) |
{- "accountType": "MARGIN",
- "coinSymbol": "USDT",
- "network": "Ethereum"
}
{- "depositAddress": "0xb794f5ea0ba39494ce839613fffba74279579268",
- "depositAddressTag": "63163621"
}
transferAmount required | string |
coinSymbol required | string |
required | Mainnet_Networks (string) or Testnet_Networks (string) |
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
{- "feeAmount": "0.23823"
}
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
accountType required | string (Account_Type) Enum: "EXCHANGE" "SPOT" "FUNDING" "MARGIN" "FUTURES" "OPTIONS" "MARGIN_CROSS" "USDT_FUTURES" "COIN_FUTURES" Enumeration on types of possible accounts |
toAddress required | string The destination address of the withdraw. The |
tag | string or null A 'tag' or 'memo', if required by the network. The |
coinSymbol required | string |
required | Mainnet_Networks (string) or Testnet_Networks (string) |
amount required | string |
isGross required | string Is the amount sent a gross amount? (Includes gas fees if necessary, and service fees)
Can be either |
maxFee | string or null The service fee charged for withdrawal |
isSettlementTx required | string If the third party service supports off-exchange, and this transaction was created in a settlement flow, this flag will be true.
Can be either |
{- "accountType": "MARGIN",
- "toAddress": "bc1qs95ej87htkfy5786anzwh8sz3gmzvqh2d2uey2",
- "tag": null,
- "coinSymbol": "ETH",
- "network": "Ethereum",
- "amount": "0.0010597",
- "isGross": "true",
- "maxFee": "0.00001616",
- "isSettlementTx": "false"
}
{- "transactionID": "3e8374383acce78d38be7fe9"
}
transactionID required | string |
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
{- "transactionID": "46bas218d9h21uhib4i1u2h",
- "status": "COMPLETED",
- "txHash": "44e25bc0ed840f9bf0e58d6227db15192d5b89e79ba4304da16b09703f68ceaf",
- "amount": "1.1",
- "serviceFee": "0.000000031",
- "coinSymbol": "ETH",
- "network": "Ethereum",
- "direction": "CRYPTO_WITHDRAWAL",
- "timestamp": 1546658861000
}
txHash required | string The requested TxHash to query. Could be intrinsic but could also not be. |
required | Mainnet_Networks (string) or Testnet_Networks (string) |
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
{- "transactionID": "46bas218d9h21uhib4i1u2h",
- "status": "COMPLETED",
- "txHash": "44e25bc0ed840f9bf0e58d6227db15192d5b89e79ba4304da16b09703f68ceaf",
- "amount": "1.1",
- "serviceFee": "0.000000031",
- "coinSymbol": "ETH",
- "network": "Ethereum",
- "direction": "CRYPTO_DEPOSIT",
- "timestamp": 1546658861000
}
fromDate required | string <UNIX-timestamp-epoch> Example: fromDate=1546658861000 Milliseconds |
toDate required | string <UNIX-timestamp-epoch> Example: toDate=1546658865000 Milliseconds |
pageSize required | number >= 1 Example: pageSize=500 Number of entries per page size in response |
pageCursor | string or null Example: If not specified, return the first page. Otherwise, return the page the cursor points to. |
isSubTransfer required | string Example: isSubTransfer=false If this is a sub-account tranfer, either subMainTransfer or subaccountTransfer. |
direction | string or null (NullableDirection) Enum: "CRYPTO_DEPOSIT" "CRYPTO_WITHDRAWAL" Example: direction=CRYPTO_WITHDRAWAL If this isn't a sub-transfer, will specify the direction of the transaction to query. |
coinSymbol required | string Example: coinSymbol=USDT |
required | (any or null) or Mainnet_Networks (string) or Testnet_Networks (string) If isSubTransfer is true, this value could be null. Otherwise, it will be specified. |
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
{- "nextPageCursor": null,
- "transactions": [
- {
- "transactionID": "46bas218d9h21uhib4i1u2h",
- "status": "COMPLETED",
- "txHash": "44e25bc0ed840f9bf0e58d6227db15192d5b89e79ba4304da16b09703f68ceaf",
- "amount": "1.1",
- "serviceFee": "0.000000031",
- "coinSymbol": "ETH",
- "network": "Ethereum",
- "direction": "CRYPTO_DEPOSIT",
- "timestamp": 1546658861000
}
]
}
NOTE: If the third party is a sandbox third party, only coinClass=BASE
assets will be supported.
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
[- {
- "coinSymbol": "USDT",
- "network": "Ethereum",
- "coinClass": "TOKEN",
- "identifiers": [
- "0xdAC17F958D2ee523a2206206994597C13D831ec7"
]
}
]
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
subAccountID required | string |
direction required | string (Direction_for_Sub_Main_transfer) Enum: "IN" "OUT" Direction of a sub transfer:
|
coinSymbol required | string |
amount required | string |
{- "subAccountID": "1164fbab-1968-441d-848c-4cbe5ced4328",
- "direction": "IN",
- "coinSymbol": "USDT",
- "amount": "7.3"
}
{- "completed": true,
- "transactionID": "3e8374383acce78d38be7fe9"
}
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
srcSubAccountID required | string |
dstSubAccountID required | string |
coinSymbol required | string |
amount required | string |
{- "srcSubAccountID": "81690809-5eb9-48be-8eb5-6af17131d7dc",
- "dstSubAccountID": "d6eba9e6-b867-4f9b-9353-ceb7a2db9311",
- "coinSymbol": "BTC",
- "amount": "0.03"
}
{- "completed": true,
- "transactionID": "3e8374383acce78d38be7fe9"
}
X-FBAPI-KEY required | string (X-FBAPI-KEY) All requests must include the X-FBAPI-KEY header containing your API key. |
X-FBAPI-TIMESTAMP required | number <UNIX-timestamp-epoch> (X-FBAPI-TIMESTAMP) Example: 1546658861000 All requests must include the X-FBAPI-TIMESTAMP header containing the timestamp (in milliseconds). |
X-FBAPI-SIGNATURE required | string (X-FBAPI-SIGNATURE) All requests must include the X-FBAPI-SIGNATURE header containing the signature of the request. |
X-FBAPI-NONCE required | string (X-FBAPI-NONCE) Example: 8853b277-d5f5-4363-bf5f-633b735e1413 All requests must include the X-FBAPI-NONCE header, a unique string to the request being a reference for that request. |
fromAccountType required | string (Account_Type) Enum: "EXCHANGE" "SPOT" "FUNDING" "MARGIN" "FUTURES" "OPTIONS" "MARGIN_CROSS" "USDT_FUTURES" "COIN_FUTURES" Enumeration on types of possible accounts |
toAccountType required | string (Account_Type_2) Enum: "EXCHANGE" "SPOT" "FUNDING" "MARGIN" "FUTURES" "OPTIONS" "MARGIN_CROSS" "USDT_FUTURES" "COIN_FUTURES" Enumeration on types of possible accounts |
coinSymbol required | string |
amount required | string |
{- "fromAccountType": "MARGIN",
- "toAccountType": "SPOT",
- "coinSymbol": "USDT",
- "amount": "1.4"
}
{- "completed": true,
- "transactionID": "3e8374383acce78d38be7fe9"
}