API Reference

Overview & Authentication

The NeuroTrader gateway exposes a REST API over HTTPS with JSON bodies. Everything the app shows — your account, positions, trades, AI status, decisions, and market data — is available programmatically.

Base URL

base url

https://api.neurotraderai.com

All endpoints below are relative to this base. Authentication endpoints live under /api/auth; most resource endpoints live under /api/v1; AI session control lives under /api/ai-trading.

Authentication flow

The API uses bearer tokens (JWT). Sign in to receive an access token, send it on every request, and refresh it when it expires.

POST/api/auth/register

Create an account. Triggers a verification email; trading remains locked until the email is verified.

Parameter	Type	Required	Description
`email`	string	required	Your email address
`password`	string	required	Password (strength requirements enforced)

POST/api/auth/login

Exchange credentials for tokens.

Parameter	Type	Required	Description
`email`	string	required	Account email
`password`	string	required	Account password

response · 200

{
  "access_token": "<your-access-token>",
  "token_type": "bearer",
  "expires_in": 3600,
  "user": {
    "id": "8f14e45f-...",
    "email": "you@example.com",
    "is_verified": true
  }
}

POST/api/auth/refresh

Exchange a refresh token for a fresh access token. Use when the access token expires (401 with an expiry detail).

GET/api/auth/me

Returns the authenticated user's profile. The simplest way to validate a token.

POST/api/auth/logout

Invalidates the current session.

Using the token

Send the access token in the Authorization header on every authenticated request:

curl

curl https://api.neurotraderai.com/api/v1/trading/account \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Verification & recovery

Endpoint	Purpose
`POST /api/auth/verify-email`	Confirm the address with the emailed token; returns fresh tokens
`POST /api/auth/resend-verification`	Resend the verification email
`GET /api/auth/verification-status`	Check whether the account is verified
`POST /api/auth/forgot-password`	Send a time-limited reset link
`POST /api/auth/reset-password`	Set a new password with the reset token; returns fresh tokens
`POST /api/auth/change-password`	Change password while signed in

Conventions

JSON everywhere — request and response bodies are JSON; send Content-Type: application/json.
UTC timestamps — ISO-8601 strings, always UTC.
Decimal strings — monetary and quantity fields may serialize as strings to preserve precision; parse accordingly.
Pagination — list endpoints paginate; conventions are documented in Errors & Limits.

Keep tokens secret

Your access token is full account access. Never embed it in client-side code you distribute, commit it to a repository, or share it in support requests.