Docs
Key Add a key

API

Entitlements and limits

What an API key can read, the three 403 codes and what each means, and the limits on deep-history reads.

Who can use a key

A key works only when its account has API access:

  • The web Pro plan includes the API Explorer tier, for exploratory use.
  • The API plan includes API Pro.

A key on an account without API access gets 403 not_entitled_tier on every route.

The account must also have declared its market-data classification (non-professional or professional). Until it has, every route answers 403 attestation_required. The declaration is made once, in account settings.

What a key cannot read

  • Index symbols — SPX, NDX, VIX and the like — and options on them are available in the ITMatrixHQ apps only. A key gets 403 not_entitled_symbol for them on every symbol-scoped route.
  • In-app features use first-party sessions and are not part of this API. The reference lists exactly what a key can call.

Installing an SDK does not change any of this: entitlements are decided by the server for the credential that makes the call.

The three 403s

CodeMeansFix
not_entitled_tierYour plan or API tier does not include this data.Check the plan on the account the key belongs to.
not_entitled_symbolThis symbol is not available to keys (index data).Use an equity or ETF symbol.
attestation_requiredThe account has not declared its market-data classification.Declare it once in account settings.

meta.caps

Entitlement-checked routes report what they applied in meta.caps: tier is the plan the request was served under, and applied lists any cap that shaped the response (empty means nothing was clamped). Read it rather than assuming a response is unrestricted.

Limits

  • Deep-history reads (long bar ranges, historical sessions) are limited to a small number in flight per key at once — two by default. Past that, the API answers 429 rate_limited with Retry-After: 1. Run bulk history jobs with at most two concurrent requests per key.
  • Flow reads are deliberately small: live large trades need a symbol or a min_premium_usd floor, end-of-day flow needs an explicit session plus one of those, and both return at most 100 events.
  • Streams cap subscriptions and distinct symbols per connection; a new subscription past the cap is refused with quota_exceeded. See Streaming.