API for advanced users

The strategy is JSON validated with Zod. You can export it from the library or from a shared link. Key fields: schemaVersion, name, market, symbol, timeframe, direction, indicators, entry, exit, risk and costs.

{
  "schemaVersion": 1,
  "name": "Cruce EMA 20/50",
  "description": "Tendencia clásica",
  "market": "crypto",
  "symbol": "BTCUSD",
  "timeframe": "1h",
  "direction": "both",
  "reverseOnOpposite": true,
  "indicators": [
    { "id": "ema_fast", "kind": "ema", "period": 20, "source": "close" },
    { "id": "ema_slow", "kind": "ema", "period": 50, "source": "close" }
  ],
  "entry": {
    "long": { "mode": "all", "conditions": [
      { "left": { "type": "indicator", "indicatorId": "ema_fast" },
        "op": "crossAbove",
        "right": { "type": "indicator", "indicatorId": "ema_slow" } }
    ] },
    "short": null
  },
  "exit": { "long": null, "short": null },
  "risk": { "positionSizePct": 10, "sizingMode": "riskPct",
            "riskPerTradePct": 1, "maxLeverage": 1,
            "stopLossMode": "atr", "stopLossAtrMultiple": 2.5,
            "takeProfitMode": "atr", "takeProfitAtrMultiple": 4 },
  "costs": { "spreadPct": 0.01, "commissionPct": 0.02, "slippagePct": 0.01,
             "swapLongPctPerDay": 0.005, "swapShortPctPerDay": 0.005,
             "spreadBySession": { "asia": 1.4, "london": 1,
                                  "overlap": 0.9, "newYork": 1.1,
                                  "offHours": 1.6 } },
  "timeFilter": { "enabled": true, "days": [1,2,3,4,5],
                  "startHourUtc": 7, "endHourUtc": 20,
                  "sessions": ["london", "overlap", "newYork"] }
}

The engine rejects references to non-existent indicators, duplicate ids and empty entry groups. The same JSON is used in backtest, portfolio, deployment and MQL5 export.

• Web: httpOnly session cookie `oryon_session`. Mutations require a trusted Origin.
• Runner/PC: `Authorization: Bearer <token>` or the `x-oryon-runner` header. The token is obtained when pairing the PC, and only its hash lives on the web.
• There are no user API keys. If you automate from a script, sign in and reuse the cookie, or use the runner token for runner routes.
• Public without a session: backtest, walkforward, optimize, demo, status, shares and waitlist. Strategies, account, billing and runner require their credential.

POST /api/backtest accepts `strategy`, `bars`, `dataSource` (`real` or `synthetic`) and `trials`. It's public but has a per-IP rate limit. With a session, it deducts backtest quota from your plan.

curl -X POST https://tu-dominio/api/backtest \
  -H "Content-Type: application/json" \
  -d '{"strategy": { ... }, "bars": 1500, "dataSource": "real"}'

GET /api/demo?preset=ema|rsi|breakout returns a preloaded, cached real backtest. No account required.

curl "https://tu-dominio/api/demo?preset=ema"

• `costs.spreadBySession` multiplies the spread by UTC session. `swapLongPctPerDay` and `swapShortPctPerDay` prorate swap/funding over time in market.
• `timeFilter` blocks entries outside the selected days, hours or sessions. Exits by stop, target, signal or time are always allowed.
• `higherTimeframe` conditions use the last closed candle of a higher timeframe; base candles are aggregated and no future data is used.
• `risk.sizingMode: "riskPct"` calcula el notional desde la distancia real al stop. `maxLeverage` limita el tamaño; si no hay stop, se usa el % fijo como respaldo.

• POST /api/monitors creates a daily or weekly watch. POST /api/monitors/[id]/run runs it now. The cron calls /api/monitors/run with the server secret.
• Each run stores the regime, metrics and alerts. If the regime changes or a threshold is crossed, a `monitor_alert` is sent.
• POST /api/journal saves notes, tags, screenshot and lesson. PATCH/DELETE /api/journal/[id] edits or deletes. Screenshots are validated and never served from disk.
• Version history calculates changes against the previous version; it doesn't overwrite old definitions.

• TradingView: POST /api/integrations/tradingview/[token] accepts JSON or text and stores a signal. The token is only shown when creating the connection.
• Binance and Bybit connect in read-only mode to test credentials and query the account. Execution is still reserved for MT5.
• cTrader stores the OAuth configuration; the full flow is still pending a later phase.

• POST /api/portfolio/backtest: `versionIds` (2–12), limits and `dataSource`. Requires a session and deducts portfolio quota.
• POST /api/walkforward, /api/optimize and /api/optimize/sensitivity use the same strategy format and have stricter rate limits.

The PC reports heartbeat, deployments and Strategy Tester results. The website doesn't talk directly to MetaTrader.

curl -X POST https://tu-dominio/api/runner/report \
  -H "Authorization: Bearer $ORYON_RUNNER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"host":"mi-pc","account":"demo","equity":10000,"running":[]}'

GET /api/status is public and returns the status of the website, database and data providers. Ideal for monitors.

curl https://tu-dominio/api/status

Outgoing alerts can be sent to a webhook. If you configure a secret, the body is signed with HMAC-SHA256 in `X-Oryon-Signature: sha256=...`.

POST https://tu-servidor/hook
Content-Type: application/json
X-Oryon-Event: order_rejected
X-Oryon-Signature: sha256=<hmac>

{
  "event": "order_rejected",
  "title": "Orden rechazada",
  "body": "EURUSD · ...",
  "severity": "warning",
  "url": "https://tu-dominio/operar/...",
  "timestamp": "2026-11-09T12:00:00.000Z",
  "data": {}
}

• When a quota is exceeded, the API responds 402 with `{ ok:false, upgrade:true, plan, quota }`.
• The per-IP rate limit responds 429 with `Retry-After`. Exact limits are on the Pricing page.
• Validation errors respond 422 with readable `issues`. Nothing is saved halfway.

There are no secrets in the client. AI keys are encrypted on the server, sessions are stored as hashes and the runner token is compared against its hash. CSP, HSTS, Origin checks and rate limits are applied in the proxy.

To report a vulnerability: oryon.help@outlook.com.

GET /api/strategies/[id]/export?version=... downloads a JSON with `{ format, formatVersion, exportedAt, strategy }`. POST /api/strategies/import accepts that JSON or a standalone strategy and validates it with the same schema.