General Overview

The Backpack Fintech Platform API is the programming interface to the Fintech platform. The API can be used to integrate your app or website with Backpack Fintech platform. This enables partners to maximize the features within your application.

The API follows a REST API design, meaning that you use standard HTTP methods to retrieve and manipulate resources

Guidelines and Conventions

The API endpoint is at https://platform-api.backpack.io, and requires login using basic HTTP auth.

Actions described in this document are grouped into logical modules, which are also reflected by their webservice URLs. The URLs are of the form /module/action, module and action are always lowercase, with words separated by the dash (-) character. For example,

Instrument::fetchAll is accessible at https://platform-api.backpack.io/instrument/fetch-all.

Parameters are accepted over POST or GET and their names are case-sensitive.

All actions return their results in JSON, structured as described in this document, with the following rules:

Array and dictionaries are represented as bullet lists, with nested arrays represented as a further indented list. Each item is described as follows <key>(<type>): <description>.  Keys may either named explicitly, or written as empty square brackets ([]) for regular, indexed arrays. Key names may appear italicized if the names themselves are variable.  

Types are either int, string, bool, a specific enum, an abstract type or an array. Enums are declared enum, capitalized and camelCased and their values are listed under the guidelines and conventions section of the relevant module. Abstract types are capitalized, and help describe nested arrays into logical groups. Arrays types are the type name succeeded by empty square brackets (eg. int[] for an array of ints).

Error codes 

In case of errors, the response header will be 500,  and the response body will be formatted as follows: 

● success(bool): false ● error(Error): 

○ code(int): The error code 

○ message(string): The error message 

Index Module 

Module Guidelines and  Constants 

The index module contains system actions - that is  -
actions that don’t directly correspond to requests made explicitly by a  specific logged in user. 

Index::countries 

Gets a list of supported countries. 

Parameters: 

None 

Returns: 

● [](Country): 

○ id(string): The two-character ISO code  representing the country 

○ name(string): The full country name 

○ dialCode(int): The country’s  international dial code ● ... 

Index::states 

Gets a list of supported states. 

Parameters: 

None 

Returns: 

● countryCode(State[]):

○ [](State): 

■name(string): Full state name. 

■id(string): Two-character state  code. ○ ...

Index::login 

Logs a user in and provides a session token for  authenticated actions. This can be done either by email/password, or using the  previous session token. 

See samples (login.php, loginRedirectToPlatform.php) 

Parameters: 

Returns: 

● session(string): The user’s  session token. This will be used when performing authenticated actions. 

● user(User): Information about the  logged-in user. 

○ userID(int): The relevant user’s ID. 

○ email(string): The user’s email address. 

○ firstName(string): The user’s first name. 

○ lastName(string): The user’s last name. 

○ dob(string): The user’s date of birth. 

○ mobile(string): The user’s telephone number. 

○ nationalID(string):The user’s national ID number. 

○ confirmed(bool): Whether or  not the user was confirmed (using User::hash and Index::confirm). 

○ validated(bool): Whether or not  the user’s personal information was verified (using User::verify) 

○ frozen(bool): Whether or not  the user is temporarily frozen (for example, pending validation). 

○ blocked(bool): Whether or not the user is  permanently blocked. 

○  loginConfirmed:null - User provided a password, 0 – Temp password sent by  email,
          user will be confirmed on first login, 1 - User has been confirmed on  first login. 

Index::register 

Registers a new user.Please review also More Registration Options public API calls for Ajax  or simply posting your form data to a URL (see More Registration Methods in this document). See  sample (register.php) . Parameters: 

 Returns: (string): The newly created userID. 

User Module 

Module Guidelines and  Constants 

The user module contains action that correspond  either to requests made directly by a logged-in user, or actions that deliver  user data that directly aid dispatching or performing such requests. As a rule,  these actions are all authenticated using a session token, as provided by  Index::login. 

• Currencies 

 ○ currencies.usd = 1 

○ currencies.eur = 2 

○ currencies.aud = 3 

○ currencies.cny = 4 

○ currencies.gbp = 5 

○ currencies.jpy =  6 

○ currencies.rub = 7 

User::set-user-currency 

Sets the preferred currency for display purposes. 

Parameters: 

Returns: NA 

User::address 

Gets a user’s address. 

Parameters: 

Returns: 

● address1(string): The user’s  street address. 

● city(string): The user’s city. 

● state(string): The user’s  two-character state code, as it appears in the list returned by Index::states. 

● zip(string): The user’s zip code. 

● country(string): The user’s  two-character country code, as it appears in the list returned by  Index::countries. 

User::changePassword 

Changes a user’s password. This has two modes of  operation. The first is a password reset, activated by the reset parameter - in  which case the password is changed with no regard to the previous one. The  second is a password change (activated by default, lacking the reset parameter)  - in which case the current password is compared against the oldPassword  parameter prior to being changed. See sample (changePassword.php) 

Parameters: 

Returns: 

(bool): Returns true for success. 

User::get-wallet (Old -retired , Replaced by )

Gets info about a user’s funds and bonuses. 

See sample (getWallet.php) 

Parameters: 

Returns: 

● credit(int): The user’s currently  available funds. 

● reserved(int): Funds the user  currently has placed on open trades. 

● bonus(Bonus): Information about  pending bonuses. 

○ amount(int): The bonus amount to be given. 

○ required(int): The total stakes  that need to be traded by the user before the bonus is given. 

○ traded(int): The total stakes traded by the user so  far. 

○  promotional(Risk free trade): Information about pending bonus for risk free  trade. 

● userCurrency 

Example: 

{ 

 "credit": 399, 

 "reserved": 0, 

 "bonus": { 

 "amount": 0, 

 "required": 0, 

 "traded": 0, 

 "promotional": 0 

 }, 

 "userCurrency": 1 

} 

[NEW] mp-account::transfer

Transfer funds from wallet to wallet for the same user 

 Parameters: 

Returns: 

{"success":true,"message":""}

Or

{"success":false,"message":"380"} - insufficient funds in the original wallet

Note  : in case of transfer funds from different currency, the system will automatically convert to the destination wallet.

[NEW]  User::get-wallet-details 

Gets info about a user’s funds and bonuses (includes  old and new bonus types). See sample (getWalletDetails.php) 

Parameters: 

Returns: 

● credit(int): The user’s currently  available funds. 

● reserved(int): Funds the user  currently has placed on open trades. 

● Available(int): Available  cash

● bonus(Bonus): Information about  tradeable, pending and promotional (risk free) bonuses. 

○ tradeable(int): The total amount for tradeable  bonuses. 

○ pending(int): The total amount for pending bonus. 

○  promotional(Risk free trade): The total amount for risk free trade. 

● pendingBonusDetails – Details  about pending bonus (if releasable and expiry date) 

● userCurrency 

Example: 

{ 

 "credit": 2412.39, 

 "reserved": 0, 

 "available": 2412.39, 

 "bonus": { 

 "tradeable": 0, 

 "pending": 50, 

 "promotional": 0 

 }, 

 "pendingBonusDetails": { 

 "releasable": false, 

 "expiryDate": "2015-12-23 00:00:00" 

 }, 

 "userCurrency": 3 

}

User::transactions 

Gets a user’s paginated transaction history,  optionally formatted. 

Parameters: 

Returns: 

● summary: 

○ deposits(string): Optionally  display-formatted total of funds deposited. 

○ profits(string): Optionally display-formatted total  profits made. 

○ bonuses(string): Optionally display-formatted total  bonuses given. 

○ withdrawals(string): Optionally display-formatted  total of funds withdrawn. 

● rows(Transaction[]): 

○ [](Transaction): 

■ recordID(string): The transaction record ID. 

■ date(string): Optionally display-formatted date of  the transaction. 

■ description(string): Description of the transaction  type 

(deposit/withdrawal/etc.) 

■ tradeID(string): Trade ID, if the transaction is  related to a particular trade. 

■ credit(string): Optionally  display-formatted money added towards the user’s credit by this transaction. 

■ debit(string): Optionally  display-formatted money removed from the user’s credit by this transaction. 

■ balance(string): Optionally  display-formatted credit balance following this transaction. 

○ … 

● pages(int): The total number of available pages. 

User::hash 

Generates and stores or retrieves a previously stored a unique hash token for the current user (eg. can be used to verify email address). 

See sample (emailConfirm.php) 

Parameters: 

Returns: 

(string): The generated/retrieved hash token. 

User::set-user-account-level  

Updating existing user account level 

Parameters: 

Returns: 

(string): True Or False **

User::info 

Gets a user’s personal information. 

See sample (info.php) 

Parameters: 

Returns: 

● userID(int): The relevant user’s  ID. 

● email(string): The user’s email  address. 

● firstName(string): The user’s  first name. ● lastName(string): The user’s last name. 

● dob(string): The user’s date of  birth. 

● mobile(string): The user’s  telephone number. 

● nationalID(string):The user’s  national ID number. 

● confirmed(bool): Whether or not the  user was confirmed (using User::hash and Index::confirm). 

● validated(bool): Whether or not  the user’s personal information was verified (using User::verify) 

● frozen(bool): Whether or not the  user is temporarily frozen (for example, pending validation). 

● blocked(bool): Whether or not the  user is permanently blocked. 

● affiliateID(string): affiliate  token 

● facebookID(Int): Facebook User ID 

● social(Int):0 – social feature disabled, 1 – social  feature enabled 

● nickname(string): User's public  name 

● loginConfirmed: null - User  provided a password, 0 – 

Temp password sent by email, user will be confirmed on  first login, 1 - User has been confirmed on first login. 

● address1(string): The user’s  street address. 

● city(string): The user’s city. 

● state(string): The user’s  two-character state code, as it appears in the list returned by Index::states. 

● zip(string): The user’s zip code. 

● country(string): The user’s  two-character country code, as it appears in the list returned by  Index::countries. 

User::update 

Updates a user’s personal information. 

See sample (update.php) 

Parameters: 

Returns: 

(bool): True for success. 

Wallet Module

Module Guidelines and  Constants 

The wallet module is used to manipulate available  funds. 

Wallet::deposit (Old-Retired )

Deposits funds into a user’s wallet. 

See sample (deposit.php) 

This call is being replaced by Advanced Deposit Procedure - below

Parameters: 

Returns: recordID(string): The transaction record ID 

[NEW] Advanced Deposit Procedure - 4 Steps

    Deposits funds into a user’s wallet. 

    See sample (depositLogAPI.php) 

Deposit Step 1 - Payment::create-charge

        Deposit initiation 

    Parameters: 

Returns: recordID(string): The transaction record ID 

Deposit Step 2 - Payment::get-charge

   Checking user wallet response for pending payment  :

   Parameters: 

Returns: (Deposit Status):

 {"status":true,"data":    {"recordID":"508171","userID":"2130004","amountToCredit":"10.00","amount":"10.00",

 "currency":"1","rate":"1","status":"0","transactionID":""  ,"gateway":"dummy","message":"","timestamp":"2017-12-03  15:03:28","details":"","complianceCheck":"0","complianceID":"0","followUpBy":"0","adminID":"0",

 "source":null,"wallet_type":"1","walletID":"0  "}}

Deposit Step 3 -Payment::update-charge

Updating deposit status

  Parameters: 

  Response :

 {"status":true}

Deposit Step 4 -Payment::finalize-charge

Update User balance 

should be use only on Approved deposits!

 Parameters: 

 Response :

 {"status":true}

Bonus Module 

Module Guidelines and  Constants 

The bonus module is used to create, cancel and  retrieve information about user bonuses. 

Constants: Type: 

• 1 – SmartBonus 

• 2 – ProfitBonus 

• 3 – BalanceBonus 

• 4 – StickyBonus 

• 5 - NoDepositBonus

Bonus Factors (defaults, can be configured per site) 

{ 

"1": [{"from": 0,"to":  10,"factor": 15},{"from": 11,"to":  25,"factor": 20},{"from": 25,"to":  35,"factor": 

25},{"from": 36,"to":  50,"factor": 30}], 

"2": [{"from": 0,"to":  25,"factor": 15},{"from": 26,"to":  50,"factor": 20},{"from": 51,"to":  100,"factor": 

30},{"from": 101,"to":  150,"factor": 35}], 

"3": [{"from": 0,"to":  25,"factor": 15},{"from": 26,"to":  50,"factor": 20},{"from": 51,"to":  100,"factor": 

30},{"from": 101,"to":  200,"factor": 35},{"from": 201,"to":  300,"factor": 40}], 

"4": [{"from": 0,"to":  100,"factor": 10}], 

"5": [{"max":  100,"factor": 10}] 

} 

Bonus::get-User-Bonuses 

Retrieves tradeable user bonuses. 

Parameters: 

Returns: 

 Array of bonuses: 

[{"bonusID":"3553","typeID":"1","name":"Smart  

Bonus","originalAmount":500,"activeAmount":500,"releasedAmount":0,"volumeTraded":0  ,"volumeRequired":45000,"deposit":0,"pnl":0,"active":true,"dateCreated":1441789224}]  

Bonus::create 

Create new bonus. 

Parameters: 

Returns: 

• Success:  {"success":true}

• Failure:  {"success":false,"errorCode":"342","details":7200}  

Bonus::cancel 

Cancel a bonus. 

Parameters: 

Returns: 

• Success: true

• Failure:  {"success":false,"error":{"code":0,"message":"Bonus  not found"}} 

Example (registration) 

PHP 

<?php 

// Init cURL 

$ch = curl_init(); 

curl_setopt($ch, CURLOPT_HEADER,  0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch,  CURLOPT_HTTPAUTH, CURLAUTH_BASIC); 

curl_setopt($ch, CURLOPT_POST, 1); 

curl_setopt($ch,  CURLOPT_SSL_VERIFYPEER, 0); 

// Set HTTP Auth credentials 

curl_setopt($ch, CURLOPT_USERPWD,  user:pass); 

// Register user 

$user_data = array ( 

 'firstName' => 'Demo001', // Mandatory 

 'lastName' => 'User001', // Mandatory 

 'email' => 'demo001@mailinator.com', // Mandatory 

 'confirmed' => '0', // 0 - email is not confirmed (In the platform,  user will be asked to resend confirmation email and confirm), 1 - email is  confirmed 

 'password' => md5('123456'), 

 'phone' => '+123456789', 

 'country' => 'fr', // should be 2 characters lower case 

 'locale' => 'en_FR', // en is the user language. It is used for  sending emails in user's language 

 'landing' => json_encode(array('a_aid'=>'650b2354',  'serial'=>'campaign01')), // affiliate token (landing parameter), can add  more tracking parameters to the array. 

'lead' => 0 // 0 - Real user, 1 - Lead. (Use it only if the  registered user will be considered as potential user. Meaning, a sales person  should contact the user him and convert him to a real user).

); 

curl_setopt($ch, CURLOPT_URL,  'https://platform-api.backpack.io/index/register'); curl_setopt($ch,  CURLOPT_POST, 1); 

curl_setopt($ch,  CURLOPT_POSTFIELDS, $user_data); 

$result = curl_exec($ch); echo  "Register result: " . $result . "<br />"; // On  Success - Returns userid, On failure returns json with error code (e.g.  {"success":false,"error":{"code":10,"message":""}})  

?> 

C# 

using System; using System.Text;  using System.Net; using System.IO; 

using System.Security.Cryptography;  

namespace Registration 

{ 

class  MainClass 

{  

public  static void Main (string[] args) 

{  

String  url = "https://platform-api.backpack.io/index/register"; 

String  authorizationUser = "user"; 

String  authorizationPassword = "pass"; 

StringBuilder  postData = new StringBuilder();postData.Append  ("firstName=MyFirstName");postData.Append  ("&lastName=MyLastName");postData.Append  ("&email=myEmail@address.com");postData.Append  ("&password=" + CalculateMD5Hash("123456")); 

postData.Append  ("&country=us"); 

postData.Append  ("&landing={\"a_aid\":\"123456789\"}"); 

ASCIIEncoding ascii = new ASCIIEncoding();byte[] postBytes =  ascii.GetBytes(postData.ToString()); 

//  set up request objectHttpWebRequest  request; 

try  

{  

request  = (HttpWebRequest)HttpWebRequest.Create(url); 

}  

catch  (UriFormatException) 

{  

request  = null; 

}  

if  (request == null) 

{  

throw  new ApplicationException("Invalid URL: " + url); 

}  

request.Method  = "POST"; 

request.ContentType  = "application/x-www-form-urlencoded"; 

request.ContentLength  = postBytes.Length; 

//  Authorization: 

String  encoded =  System.Convert.ToBase64String(System.Text.Encoding.GetEncoding("UTF-

8").GetBytes(authorizationUser  + ":" + authorizationPassword)); 

request.Headers.Add("Authorization",  "Basic " + encoded); 

//  add post data to request 

Stream  postStream = request.GetRequestStream(); 

postStream.Write(postBytes,  0, postBytes.Length); 

postStream.Flush();postStream.Close();  

try  { 

HttpWebResponse  response = (HttpWebResponse)request.GetResponse(); 

if  (response != null) 

{  

StreamReader  reader = new StreamReader(response.GetResponseStream()); 

Console.WriteLine("Response:  " + reader.ReadToEnd()); 

}  

}  

catch  (WebException) 

{  

Console.WriteLine  ("Error: email already exists"); 

}  

}  

private  static string CalculateMD5Hash(string input) 

{  

//  step 1, calculate MD5 hash from inputMD5  md5 = System.Security.Cryptography.MD5.Create();byte[]  inputBytes = System.Text.Encoding.ASCII.GetBytes(input);byte[]  hash = md5.ComputeHash(inputBytes); 

//  step 2, convert byte array to hex stringStringBuilder  stringBuilder = new StringBuilder(); 

for  (int i = 0; i < hash.Length; i++) 

{  

stringBuilder.Append(hash[i].ToString("X2"));  

}  

return  stringBuilder.ToString(); 

}  

}  

} 

Node.js 

var https = require('https'); var  querystring = require('querystring'); 

// make sure you have md5 installed  (npm install MD5) var md5 = require('MD5'); 

var data =  querystring.stringify({firstName:  req.param('firstname'),lastName:  req.param('surname'),email:  req.param('email'),password:  md5(req.param('password')),phone:  req.param('phoneNo'),country:  req.param('country'), 

 landing:  JSON.stringify({a_aid: "123456789", serial:  "my-campaign1"}) 

}); 

var options = { 

host:  'platform-api.backpack.io',

method: 'POST',path:  '/index/register',headers: { 

 "Authorization": "Basic " + new  Buffer("user:password").toString('base64'), 

 "RETURNTRANSFER": 1, 

 "Content-Type": "application/x-www-form-urlencoded",  

 "Content-Length": Buffer.byteLength(data) 

}

}; 

var post_req =  https.request(options, function(res) {console.log('STATUS: ' + res.statusCode);console.log('HEADERS: ' +  JSON.stringify(res.headers)); 

res.setEncoding('utf8');res.on('data', function (chunk) { 

 console.log('BODY: ' + chunk); 

 }); 

}).on('error', function(err) {// Handle errorconsole.log("Error: " +  err); 

 }); 

post_req.write(data);  post_req.end(); 

More Registration Methods (public) 

As mentioned in the "Guidelines and  Conventions" section, the API requires credentials. 

However, some of the main functions are accessible  to the public (no credentials are needed). 

Basic

Use this method (AJAX) when you want to perform the  registration, get the status and control what to do next in your application.  Main features supported in this method: 

§ Get json response with no  redirect 

e.g. 

{"success":true,"session":"39dfb270b1cfbf1eb045715a1b37b4d8","firstName":"TestN  ame13","lastName":"TestLastName13","email":"TestAccount13@mailinator.com","do  b":null,"mobile":"972541234567","location":"be"}  

§ Doesn't require API  credentials 

§ Will send email to the  registered user 

• Confirm your email – contains a  link to the platform with automatic login (in case a password was used) 

• Activate your account – sent with  temporary password (in case registration was made without password) 

§ Banned countries login –  blocks registration from banned countries (US, IT, IL) 

§ DDOS protection

Example 

This example will register a new user and assign it  to an affiliate ID 123456789 with serial camp1. 

https://Fintech.domain.com/ajax/index/sign-

up?firstName=FirstName&lastName=LastName&email=TestAccount@mailinator.com&coun  try=be&locale=fr_BE&password=e10adc3949ba59abbe56e057f20f883e&phone=9725412345 67&landing={"a_aid":"123456789",  "serial":"camp1"}