Broker API changes, week 42 2026
19 dated changes from 12 Oct 2026 to 18 Oct 2026, grouped by broker or platform. Each one links the page it was read on.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
A change is filed under the week that holds its own date, as its source gives it. That is not always the week this site read it. The checked date beside each source is the day that page was last opened.
Axi
Documentation
The Axi help article on other trading tools, this site's source for Axi's rate limits claim, no longer opens. The claim is now unverified.
Trading platforms, Axi UKchecked
Affected pages: the Axi record, everything recorded for it as one file and its own RSS feed.
Bitget
Documentation
Bitget's current API documentation states an overall limit of 6,000 requests a minute per IP address, alongside per endpoint limits. This site previously held only the legacy v1 figure of 20 requests in 2 seconds for public market data.
Bitget API quick startchecked
Documentation
Bitget's quick start page gives the REST signing timestamp in milliseconds, but for the WebSocket login its text says milliseconds and its JavaScript sample uses milliseconds while its Java step divides by 1,000 and its example holds a ten digit value. This site's authentication entry for Bitget now keeps the milliseconds statement to REST and states no unit for the login, where it previously said only that the timestamp is in milliseconds.
Bitget API quick startchecked
Affected pages: the Bitget record, everything recorded for it as one file and its own RSS feed.
Deriv
Documentation
Deriv's documentation, read on 12 Oct 2026, gives one REST base, https://api.derivws.com, and describes sign in as an OAuth 2.0 app or a Personal Access Token sent as a bearer token, with a Deriv-App-ID header on REST requests made with a Personal Access Token. This site had recorded an app_id plus an API token, sourced to the limits page, which does not describe sign in today. The 2 minute idle timeout recorded before is not on the limits, best practices or ping pages opened today and has been taken out of the streaming claim as not verified; the cap of 10 pings a second per connection is still on the limits page.
Deriv API: authenticationchecked
Documentation
Two Deriv pages give different rate limits. The Limits page gives REST 80 requests a minute per logged in user and 300 a minute and 1,000 per ten minutes per IP, with shared WebSocket budgets a minute and an hour; the API overview in the text form Deriv publishes for AI tools gives REST 60 a minute per token, 100 WebSocket requests a second and 100 subscriptions per connection, and 5 connections per user. This site's Deriv limit now shows both readings as conflicting, where it showed the Limits page alone as verified.
Affected pages: the Deriv record, everything recorded for it as one file and its own RSS feed.
Dukascopy
Ecosystem
Dukascopy publishes its own MCP server for JForex accounts, limited to demo accounts at the time of reading, with live trading announced for summer to autumn 2026.
Dukascopy, trade with AIchecked
Affected pages: the Dukascopy record, everything recorded for it as one file and its own RSS feed.
eToro
Documentation
eToro's reference pages, read on 12 Oct 2026, list one server, https://public-api.etoro.com, and print every path with its own /api/v1 or /api/v2 prefix. This site had recorded the base as https://public-api.etoro.com/api/v1, which doubles the prefix when a documented path is joined to it and is wrong for the version 2 calls. The base is now recorded as the bare host.
Documentation
eToro's AsyncAPI document for its WebSocket API now opens and says the user key and API key travel inside the Authenticate message over the open socket, never as a header; this site's streaming entry said authentication was by headers and that the document could not be opened. The document, the Topics page and the example code agree on one Subscribe shape, so the earlier note of three differing subscribe grammars is withdrawn.
Affected pages: the eToro record, everything recorded for it as one file and its own RSS feed.
FOREX.com / StoneX Trading (City Index)
Documentation
The StoneX API documentation was read directly for the first time: session token authentication, Lightstreamer streaming and a throttle of 500 requests in 5 seconds are now verified where this site held them as unverified.
Affected pages: the FOREX.com / StoneX Trading (City Index) record, everything recorded for it as one file and its own RSS feed.
IG
Documentation
IG's REST reference opened on 12 Oct 2026 at labs.ig.com/rest-trading-api-reference.html, after refusing our reader in September. It prints the working order paths with a hyphen: /working-orders, /working-orders/otc and /working-orders/otc/{dealId}. This site had recorded /workingorders, the spelling in IG's own deprecated Java sample. The three records now carry the reference spelling and are marked conflicting, because IG's two sources disagree and neither was tested against a host. The address without .html answered 500 the same day, so the eighteen records that linked it now link the page for their own call.
Documentation
Re-read against IG's reference on 12 Oct 2026, four IG records changed which fields they call required. Required now means only what the page marks as not null: size alone on DELETE /positions/otc; currencyCode, epic, expiry, forceOpen, guaranteedStop and size on POST /positions/otc; currencyCode, epic, expiry, guaranteedStop, level and size on POST /working-orders/otc. The page marks searchTerm optional on the market search. The _method header on deleting a working order is now recorded as optional, not required: IG's reference documents a plain DELETE, and IG's FAQ offers a POST with _method: DELETE only for clients that cannot send a body on a DELETE. This describes IG's page, not a test of what the host accepts.
Documentation
Three IG Labs addresses this site cited answered 500 on 12 Oct 2026 without a file ending and opened with one: the REST trading API guide, the FAQ and the streaming API guide now sit at rest-trading-api-guide.html, faq.html and streaming-api-guide.html. The IG record links the working addresses. The claims read there are unchanged: the FAQ still gives 12 hours for the session tokens and the guide still gives 6 hours extended up to 72.
IG Labs FAQchecked
Documentation
This site's streaming entry for IG now names Lightstreamer, as IG's Streaming API Guide does throughout, and no longer says IG states the 40 subscription cap cannot be increased: the guide asks you to contact IG to raise it and the FAQ says to manage it by unsubscribing. It previously said IG's pages name no streaming vendor. labs.ig.com/node/158 was dropped as a second source for two limits, since it showed an out of service notice and the FAQ carries the same figures.
IG Labs Streaming API Guidechecked
Affected pages: the IG record, everything recorded for it as one file and its own RSS feed.
Interactive Brokers
Documentation
IBKR's Web API pacing page and its Campus Web API documentation both now state a penalty box of 10 minutes for an IP address that breaks a rate limit. This site previously recorded 15 minutes, and that the two pages disagreed.
Affected pages: the Interactive Brokers record, everything recorded for it as one file and its own RSS feed.
OANDA
Documentation
OANDA's instrument endpoints page answered 404 on 12 Oct 2026 and is no longer in the v20 documentation menu. The candles call this site read there, GET /v3/instruments/{instrument}/candles, is now marked not verified: OANDA's own OpenAPI file on GitHub still defines it, but no page on developer.oanda.com that we opened does. The site documents the account scoped call, GET /v3/accounts/{accountID}/instruments/{instrument}/candles, on its pricing endpoints page. A missing page is not evidence that the call has gone.
Documentation
OANDA's history depth claim was sourced to the instrument endpoints page, which answered 404 on 12 Oct 2026. Each part was re-read on a page that opens: pricing back to 2005 on the introduction, at most 5,000 candles a request with 500 by default on the pricing endpoints page, and at most 365 days of transactions a request in pages of up to 1,000 on the transaction endpoints page. The figures are unchanged.
Affected pages: the OANDA record, everything recorded for it as one file and its own RSS feed.
Pepperstone
Documentation
Pepperstone's API trading page moved to a new address and now names two routes: a Standard API with a generated API key, and a FIX API whose demo environment can be requested by account holders trading at least 160 million euro a month.
Pepperstone API tradingchecked
Affected pages: the Pepperstone record, everything recorded for it as one file and its own RSS feed.
Tickmill
Documentation
This site's demo entry for Tickmill now reads No for its FIX API, as Tickmill's FAQ states, and describes the MetaTrader demo as a platform demo. It previously read Yes.
Affected pages: the Tickmill record, everything recorded for it as one file and its own RSS feed.
Trading 212
Documentation
Trading 212's API docs, read on 12 Oct 2026, name two environments: paper trading on demo.trading212.com and live on live.trading212.com, with every documented path starting /api/v0. This site had recorded only the live address and had the demo host as not settled. Both hosts are now recorded, without the /api/v0 prefix because the paths carry it. The way to build the Basic header is now sourced to the docs, since the help centre article cited before describes how to generate a key but not the header.
Affected pages: the Trading 212 record, everything recorded for it as one file and its own RSS feed.
How to cite this
Broker API changes, week 42 2026. Broker API Hub, https://openbrokerapi.com/changes/weekly/2026-w42, newest check .
Where you rely on a single figure, cite the source and the checked date printed beside it as well.