> ## Documentation Index > Fetch the complete documentation index at: https://docs.hyperprop.com/llms.txt > Use this file to discover all available pages before exploring further. # Get trading rules for your organization > Retrieve all trading rules configured for your organization. **What are trading rules?** Trading rules define the constraints and targets for your evaluation accounts. They determine when a trader passes, fails, or violates their account. Rules are attached to trading plans. **Rule parameters explained:** | Parameter | Description | |-----------|-------------| | `profitTarget` | Amount trader must profit to pass (e.g., $10,000) | | `dailyLoss` | Max loss allowed in a single day (e.g., $2,500) | | `maxLoss` | Max total loss from starting balance (e.g., $5,000) | | `dailyDrawdown` | Max daily drawdown from day's high (e.g., $2,500) | | `maxDrawdown` | Max drawdown from high water mark (e.g., $5,000) | | `maxContracts` | Max position size in mini-equivalent contracts (e.g., 10) | | `microConversionRatio` | How many micros count as 1 unit toward maxContracts (default 10) | | `consistency` | Consistency rule percentage (0 = disabled) | | `dailyProfit` | Max daily profit cap (0 = unlimited) | | `maxProfit` | Max total profit cap (0 = unlimited) | | `personalRiskPolicy` | Bounds on the risk controls traders set for themselves (see below) | **Personal risk policy (`personalRiskPolicy`):** Traders can impose their own risk controls on an account — a personal daily loss limit (optionally trailing their session peak), a daily profit target, max trades per day/week, per-symbol contract limits, symbol blocks and automatic brackets. These are enforced by the trade engine in real time and can only ever make an account **stricter** than your rule set. `personalRiskPolicy` lets you bound what a trader may choose: ```json { "personalRiskPolicy": { "dailyLossLimitMax": 1000, "dailyLossLimitDefault": 500, "requireDailyLossLimit": true, "maxTradesPerDayMax": 20, "requireAutoBracket": false, "lockedByFirm": false } } ``` - Every value is a **ceiling**: a trader may always pick something stricter. - A ceiling is an *effective* bound, not just form validation. If the trader leaves the field empty, your value applies (`dailyLossLimitDefault` when set, otherwise `dailyLossLimitMax`) — nobody escapes a bound by leaving a field blank. - `requireDailyLossLimit` also forces the limit to be **armed**: a trader cannot set the action to "do nothing". - `lockedByFirm: true` makes the whole personal risk panel read-only; the trader's own API calls are rejected with `FIRM_LOCKED`. - Omit the object entirely (or send `null` on update) to leave traders unconstrained. Nothing changes for existing rule sets. Traders read and write their own settings through the trade API (`GET`/`POST /trade/account/risk-settings`); this policy is the only knob you need on your side. **Example rule sets:** *Standard Challenge (beginner-friendly):* - Profit target: $10,000 (10%) - Daily loss: $2,500 (2.5%) - Max drawdown: $5,000 (5%) *Aggressive Challenge (experienced traders):* - Profit target: $8,000 (8%) - Daily loss: $4,000 (4%) - Max drawdown: $6,000 (6%) **Filtering by metadata:** ```http # Find strict rule sets GET /organization/trading-rules?metadata=strict:true # Find rules by version GET /organization/trading-rules?metadata=ruleVersion:2.1 # Find rules for specific markets GET /organization/trading-rules?metadata=market:futures ``` **Use cases:** - Display rule details on your website - Validate rule IDs before creating accounts - Compare different rule configurations - Audit your risk parameters ## OpenAPI ````yaml /api-reference/openapi.json get /v1/organization/trading-rules openapi: 3.0.0 info: title: Hyperprop Platform API version: 1.0.0 description: >- REST API for the Hyperprop Trading Platform — provision evaluation and funded trading accounts, manage traders and plans, react to account lifecycle events via signed webhooks, and reconcile billing. Built for prop firms integrating from their own backend. ## Authentication Two methods, depending on who is calling: ### Bearer Token (JWT) — users & dashboard Most endpoints accept a JWT via `Authorization: Bearer `. Used by the dashboard and client applications. ### API Key — organizations (prop firms) Organization endpoints also accept `X-API-Key: hp_live_...` for programmatic access from your backend — no browser session needed. Keys are managed by organization admins in the dashboard; each key carries permissions (`read`, `write`, `admin`) and can be rotated or revoked at any time. Keys are stored hashed (SHA-256) — the raw key is shown once at creation. Endpoints that create or modify data require `write` or `admin`. ## Quick Start ```bash # 1. List your trading plans (grab a tradingPlanId) curl "https://api.hyperprop.com/platform/v1/organization/trading-plans" \ -H "X-API-Key: hp_live_your_key_here" # 2. Create a trading account for a trader (by Hyperprop user ID or email) curl -X POST "https://api.hyperprop.com/platform/v1/organization/trading-accounts" \ -H "X-API-Key: hp_live_your_key_here" \ -H "Content-Type: application/json" \ -d '{"type": "evaluation", "tradingPlanId": "", "email": "trader@example.com"}' ``` ## Response Envelope & Error Handling **Success** responses always wrap the payload: ```json { "success": true, "data": { ... }, "message": "optional human-readable note" } ``` **Errors** — including request-validation failures, auth failures, and errors proxied from the trade engine — always return this single uniform shape with a machine-readable `code` you can switch on: ```json { "success": false, "statusCode": 404, "error": "Not Found", "message": "No Hyperprop user found with that email. The trader must have a Hyperprop account before an account can be created for them.", "code": "TRADER_NOT_FOUND" } ``` Parse rule of thumb: check `success`; on `false`, switch on `code` (never on `message` text — messages can be reworded). Some errors carry additional structured context alongside these fields (e.g. payout rejections include a `consistency` block). Common codes: `VALIDATION_ERROR` (malformed payload/params), `UNAUTHORIZED`, `INSUFFICIENT_PERMISSIONS` / `NOT_ADMIN` (key lacks write/admin), `*_NOT_FOUND` (missing resource), `*_NOT_IN_ORG` (resource belongs to another organization), `IDEMPOTENCY_KEY_IN_PROGRESS` (duplicate in flight), `ENGINE_UNREACHABLE` (trade engine down — retry with the same idempotency key). Endpoint-specific codes (e.g. payout `OPEN_EXPOSURE`, `CONSISTENCY_BLOCKED`) are documented on each endpoint. ## Idempotency **Every mutating endpoint (POST, PUT, PATCH, DELETE) honors idempotency keys uniformly.** Send an `Idempotency-Key` header (the `X-Idempotency-Key` spelling is accepted as an alias) to retry any write safely without creating duplicates. How it works: - The key is scoped to your organization + the request path. The first request with a given key executes normally and its response is cached for **24 hours**. - A replay (same key, same path) within 24 hours returns the cached response with an `Idempotency-Replayed: true` response header — the operation is **not** executed again. - If a request with the same key is still in flight, the duplicate gets `409 IDEMPOTENCY_KEY_IN_PROGRESS` — back off and retry; you'll then receive the cached response. - 5xx responses are **not** cached, so retrying after a server error re-executes the request (that's what you want). 2xx-4xx responses are cached — if a request failed validation and you fix the payload, use a **fresh key**. - Keys are free-form strings up to 255 characters. Use something that identifies the operation on your side, e.g. `order-8814-attempt-1`. ```bash curl -X POST "https://api.hyperprop.com/platform/v1/organization/trading-accounts" \ -H "X-API-Key: hp_live_your_key_here" \ -H "Idempotency-Key: order-8814-attempt-1" \ -H "Content-Type: application/json" \ -d '{"type": "evaluation", "tradingPlanId": "...", "traderId": "..."}' ``` This applies to account creation, account PATCH (status, currentBalance, metadata), rules, plans, lockouts, payouts, team, webhooks — every write on the platform API. Payouts additionally forward the key to the trade engine for engine-level double-withdrawal protection. ## Pagination & Sorting List endpoints support both styles: - **Cursor (recommended):** pass `?cursor=` from the previous response's `pagination.nextCursor`. Stable under concurrent writes. - **Offset:** `?limit=&offset=` with `pagination.total` / `hasMore` in the response. Sorting uses `?sort=field:direction` (e.g. `?sort=created_at:asc`); allowed fields are listed per endpoint. Default: `created_at:desc`. ## Custom Metadata Trading accounts, purchases, traders, plans, and rules all carry a free-form `metadata` JSON object. Use it to store your own references — payment IDs, campaign tags, payout records, internal notes. Hyperprop stores and returns it verbatim (and lets you filter list endpoints by it, e.g. `?metadata=stripePaymentId:pi_123`) but never interprets it. Update endpoints support `mergeMetadata: true` for shallow (top-level) merges instead of wholesale replacement. ## Webhooks Subscribe to account lifecycle events (`account.created`, `account.status_changed`, `account.updated`, `account.passed`, `account.failed`, and more) via the Webhooks endpoints. Deliveries are HMAC-SHA256 signed — verify `X-Hyperprop-Signature` with your endpoint secret, using `X-Hyperprop-Timestamp` for replay protection; `X-Hyperprop-Delivery` gives you a unique delivery ID for deduplication. Failed deliveries are retried with backoff, and you can redeliver any event from the dashboard or API. ## MCP Connector (AI Agents) The platform ships a built-in [MCP](https://modelcontextprotocol.io) server, so AI agents and assistants (Claude, Cursor, custom agents) can operate your organization directly — no integration code required. ```http Endpoint: POST https://api.hyperprop.com/platform/v1/mcp Transport: Streamable HTTP (stateless, JSON responses) Auth: X-API-Key header, Authorization: Bearer hp_live_..., or OAuth ``` **Claude web / desktop (Add custom connector):** paste the endpoint URL and leave the OAuth Client ID/Secret fields empty — the connector registers itself automatically. Claude opens a Hyperprop consent page where an org admin pastes the organization API key once; access then follows that key's permissions and ends if the key is revoked. (Under the hood: OAuth 2.1 with PKCE and dynamic client registration.) **Cursor / Claude Code — `mcp.json`:** ```json { "mcpServers": { "hyperprop": { "url": "https://api.hyperprop.com/platform/v1/mcp", "headers": { "X-API-Key": "hp_live_your_key_here" } } } } ``` **Available tools (12):** `list_trading_plans`, `list_trading_accounts`, `get_trading_account`, `get_account_audit_log`, `list_traders`, `get_trader`, `list_purchases`, `get_purchase`, `get_billing_summary` (read) · `create_trading_account`, `update_trading_account`, `record_payout` (write). Every tool call executes the corresponding REST endpoint with your key, so organization scoping, permissions, validation, audit logging, and webhooks apply exactly as documented on each endpoint. Read tools work with any key; write tools need `write`/`admin` permission — connect a **read-only key** if you want a strictly read-only agent. `create_trading_account` accepts an optional `idempotencyKey` so agent retries can't create duplicates, and `record_payout` implements the documented payout recipe (append to `metadata.payouts`, adjust `currentBalance`, audit-logged `reason`). ## Endpoint Groups - **Authentication** — Sign up, sign in, OAuth, MFA, password reset. No auth required for most. - **User** — Profile, notifications, demo accounts, audit logs. Requires **Bearer token** (JWT). - **Organization** — Trading accounts, plans, rules, traders, purchases, lockouts, billing, bulk operations, webhooks, analytics. Accepts **Bearer token** OR **API Key**. - **System** — Health checks. No auth required. x-logo: url: https://app.hyperprop.com/logo-icon.svg altText: Hyperprop href: https://hyperprop.com servers: - url: https://api.hyperprop.com/platform description: Production security: [] tags: - name: Authentication description: >- User authentication - signup, signin, signout, password reset, email verification, OAuth, and MFA - name: User description: >- User account management - profile, notifications, agreements, dismissals, and audit logs. Requires Bearer token. - name: Organization description: >- Organization management - profile, team, trading accounts, plans, and rules. Supports **dual authentication**: Bearer JWT token (dashboard users) OR X-API-Key (programmatic access). - name: Demo description: >- Demo account management - import, list, and delete demo trading accounts. Requires Bearer token. - name: Market Data description: CME futures contracts and market data. Requires Bearer token. - name: System description: System endpoints - health checks and connectivity paths: /v1/organization/trading-rules: get: tags: - Organization summary: Get trading rules for your organization description: >- Retrieve all trading rules configured for your organization. **What are trading rules?** Trading rules define the constraints and targets for your evaluation accounts. They determine when a trader passes, fails, or violates their account. Rules are attached to trading plans. **Rule parameters explained:** | Parameter | Description | |-----------|-------------| | `profitTarget` | Amount trader must profit to pass (e.g., $10,000) | | `dailyLoss` | Max loss allowed in a single day (e.g., $2,500) | | `maxLoss` | Max total loss from starting balance (e.g., $5,000) | | `dailyDrawdown` | Max daily drawdown from day's high (e.g., $2,500) | | `maxDrawdown` | Max drawdown from high water mark (e.g., $5,000) | | `maxContracts` | Max position size in mini-equivalent contracts (e.g., 10) | | `microConversionRatio` | How many micros count as 1 unit toward maxContracts (default 10) | | `consistency` | Consistency rule percentage (0 = disabled) | | `dailyProfit` | Max daily profit cap (0 = unlimited) | | `maxProfit` | Max total profit cap (0 = unlimited) | | `personalRiskPolicy` | Bounds on the risk controls traders set for themselves (see below) | **Personal risk policy (`personalRiskPolicy`):** Traders can impose their own risk controls on an account — a personal daily loss limit (optionally trailing their session peak), a daily profit target, max trades per day/week, per-symbol contract limits, symbol blocks and automatic brackets. These are enforced by the trade engine in real time and can only ever make an account **stricter** than your rule set. `personalRiskPolicy` lets you bound what a trader may choose: ```json { "personalRiskPolicy": { "dailyLossLimitMax": 1000, "dailyLossLimitDefault": 500, "requireDailyLossLimit": true, "maxTradesPerDayMax": 20, "requireAutoBracket": false, "lockedByFirm": false } } ``` - Every value is a **ceiling**: a trader may always pick something stricter. - A ceiling is an *effective* bound, not just form validation. If the trader leaves the field empty, your value applies (`dailyLossLimitDefault` when set, otherwise `dailyLossLimitMax`) — nobody escapes a bound by leaving a field blank. - `requireDailyLossLimit` also forces the limit to be **armed**: a trader cannot set the action to "do nothing". - `lockedByFirm: true` makes the whole personal risk panel read-only; the trader's own API calls are rejected with `FIRM_LOCKED`. - Omit the object entirely (or send `null` on update) to leave traders unconstrained. Nothing changes for existing rule sets. Traders read and write their own settings through the trade API (`GET`/`POST /trade/account/risk-settings`); this policy is the only knob you need on your side. **Example rule sets:** *Standard Challenge (beginner-friendly):* - Profit target: $10,000 (10%) - Daily loss: $2,500 (2.5%) - Max drawdown: $5,000 (5%) *Aggressive Challenge (experienced traders):* - Profit target: $8,000 (8%) - Daily loss: $4,000 (4%) - Max drawdown: $6,000 (6%) **Filtering by metadata:** ```http # Find strict rule sets GET /organization/trading-rules?metadata=strict:true # Find rules by version GET /organization/trading-rules?metadata=ruleVersion:2.1 # Find rules for specific markets GET /organization/trading-rules?metadata=market:futures ``` **Use cases:** - Display rule details on your website - Validate rule IDs before creating accounts - Compare different rule configurations - Audit your risk parameters operationId: getV1OrganizationTradingrules parameters: - description: Filter by metadata key:value (e.g., "strict:true", "level:advanced") name: metadata in: query required: false schema: type: string - description: 'Results per page (default: 50, max: 100)' name: limit in: query schema: type: integer minimum: 1 maximum: 100 default: 50 - description: Pagination offset name: offset in: query schema: type: integer minimum: 0 default: 0 - description: >- Cursor for pagination. Pass the `nextCursor` value from the previous response to get the next page. When using cursor, do not send `offset` — it will be ignored. **How it works:** The cursor is an opaque string that points to the last item you received. The server uses it to efficiently fetch the next set of results without scanning previous pages. **Backwards compatible:** If you don't send a cursor, offset/limit pagination works as before. name: cursor in: query required: false schema: type: string responses: '200': description: Success - Returns all trading rules content: '*/*': schema: $ref: '#/components/schemas/Model138' '401': description: Unauthorized - Invalid or missing session token content: '*/*': schema: $ref: '#/components/schemas/Model139' '403': description: Forbidden - Your account is not associated with an organization content: '*/*': schema: $ref: '#/components/schemas/Model140' '500': description: An unexpected error occurred content: '*/*': schema: $ref: '#/components/schemas/Model3' security: - Bearer: [] - X-API-Key: [] components: schemas: Model138: type: object properties: success: type: boolean example: true data: $ref: '#/components/schemas/Model137' Model139: type: object properties: statusCode: type: number example: 401 error: type: string example: Unauthorized message: type: string example: Invalid or expired session Model140: type: object properties: statusCode: type: number example: 403 error: type: string example: Forbidden message: type: string example: This endpoint is only available for organization users code: type: string example: NOT_ORGANIZATION_USER Model3: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 500 error: type: string example: Internal Server Error message: type: string example: An unexpected error occurred code: type: string description: Machine-readable error code — switch on this, not on message text example: INTERNAL_ERROR Model137: type: object example: organizationId: a6fcc0ce-eb28-4f43-b256-96a3144b0d34 organizationName: FakePropFirm rules: - id: 6bec94a1-425b-47be-bb41-a80e3140e2e7 name: Standard Rules description: >- Balanced evaluation rules with 8% profit target and 5% max trailing loss. profitTarget: 4000 dailyProfit: 0 maxProfit: 0 dailyLoss: 1000 maxLoss: 2500 dailyDrawdown: 2 maxDrawdown: 5 drawdownType: static consistency: 0 maxContracts: 10 microConversionRatio: 10 metadata: {} createdAt: '2025-12-30T12:03:09.385Z' updatedAt: '2026-03-03T15:00:00.000Z' - id: 6cf3821e-0ad4-427f-85a5-c3d498aa342e name: Aggressive Rules description: Higher risk tolerance with 10% profit target and 6% max loss. profitTarget: 10000 dailyProfit: 0 maxProfit: 0 dailyLoss: 3000 maxLoss: 6000 dailyDrawdown: 3 maxDrawdown: 6 drawdownType: trailing consistency: 0 maxContracts: 20 microConversionRatio: 5 metadata: {} createdAt: '2026-02-18T21:19:56.853Z' updatedAt: '2026-03-03T15:00:00.000Z' pagination: total: 4 limit: 50 offset: 0 hasMore: false properties: organizationId: type: string description: Your organization ID organizationName: type: string description: Your organization name rules: $ref: '#/components/schemas/rules' pagination: $ref: '#/components/schemas/Model136' rules: type: array description: Array of trading rules items: $ref: '#/components/schemas/Model135' Model136: type: object description: Pagination info properties: total: type: number description: Total number of rules limit: type: number description: Results per page offset: type: number description: Current offset hasMore: type: boolean description: Whether more results exist nextCursor: type: string description: >- Cursor for the next page. Pass as ?cursor= to get the next set of results. Null if no more results. Model135: type: object properties: id: type: string description: Unique rule ID name: type: string description: Rule set display name description: type: string description: Rule set description profitTarget: type: number description: Profit target to pass ($) dailyProfit: type: number description: Max daily profit cap (0 = unlimited) maxProfit: type: number description: Max total profit cap (0 = unlimited) dailyLoss: type: number description: Max loss allowed per day ($) maxLoss: type: number description: Max total loss ($) dailyDrawdown: type: number description: Max daily drawdown (%) maxDrawdown: type: number description: Max drawdown (%) consistency: type: number description: Consistency rule % (0 = disabled) consistencyEnforced: type: boolean description: >- Whether the engine enforces the consistency rule for accounts on this rule set consistencyBase: type: string description: Configured base mode (null = automatic by account type) consistencyTolerancePct: type: number description: Daily-cap buffer as % of starting balance consistencyLeniency: type: number description: Flat $ daily-cap buffer consistencyMinDays: type: number description: Min profitable days (null = auto ceil(100/consistency)) consistencyProfitableDayMin: type: number description: Min net PnL ($) for a day to count as profitable maxPayouts: type: number description: >- Payout count that triggers account.max_payouts_reached (null = unlimited) payoutMllLockOffset: type: number description: Default move_mll_to_lock offset ($ above initial balance) maxContracts: type: number description: >- Max position size in mini-equivalent contracts. On a market whose contract steps fractionally (the BTCUSDT perpetual steps 0.001 BTC) this counts ENGINE units, so 100 is 0.1 BTC and 1000 is 1 BTC — read `quantityStep` on the contract rather than assuming one unit is one coin. microConversionRatio: type: number description: How many micros count as 1 unit toward maxContracts (default 10) maxPositionByMarket: $ref: '#/components/schemas/maxPositionByMarket' personalRiskPolicy: $ref: '#/components/schemas/personalRiskPolicy' metadata: $ref: '#/components/schemas/Model134' createdAt: type: string updatedAt: type: string maxPositionByMarket: type: object description: >- Per-market position limits in each market's own unit. Overrides maxContracts for the markets it names. example: BINANCE: 0.5 personalRiskPolicy: type: object description: Firm bounds on trader-set personal risk controls Model134: type: object description: Custom metadata securitySchemes: Bearer: type: apiKey name: Authorization in: header description: >- JWT Bearer token for user session auth. Format: "Bearer {token}". Used by User and Organization endpoints. X-API-Key: type: apiKey name: X-API-Key in: header description: >- Organization API key for programmatic access. Format: "hp_live_{key}". Used by Organization endpoints as an alternative to Bearer token. Keys are managed in the dashboard. ```` ## Related topics - [Get a specific trading rule](/platform-api/organization/get-a-specific-trading-rule.md) - [Get trading plans for your organization](/platform-api/organization/get-trading-plans-for-your-organization.md) - [Get trading accounts for your organization](/platform-api/organization/get-trading-accounts-for-your-organization.md) - [Get purchases for your organization](/platform-api/organization/get-purchases-for-your-organization.md) - [Get your organization profile](/platform-api/organization/get-your-organization-profile.md)