BSL Operations

BSL operations exist to keep professional order flow bounded, observable, and recoverable. A market maker should receive a tested endpoint bundle, not a list of every internal route.

Live Metadata Checks

These checks are safe first probes in private beta:

Check	Expected beta behavior
GET /api/v1/bsl/connectivity	200, endpoint bundle, direct BSL/FIX rules, CompID derivation.
GET /api/v1/fix/connectivity	Same bundle, convenient for FIX-only onboarding.
GET /api/v1/bsl/limits	200, BSL contract headers/body, current rate envelope.
GET /api/v1/bsl/executions	200, stream/replay metadata.
GET /api/v1/bsl/sessions	200, possibly empty session list.
GET /api/v1/bsl/markets/{marketId}/quote-obligations	200, possibly empty obligations.
GET /api/v1/bsl/accounts/{account}/executions?cursor=0 without token	401, protected private-read behavior.

Submit Readiness

Check discovery, authenticated reads and the actual trading lane separately. During the September 9 Trading-API rollout, public /api/v1/status stayed 200 while private BSL HTTP and cancel-all returned 502. A status response describes the queried plane; it is not proof of all-lane reachability or current FIX state.

For server-side onboarding, obtain account routing with HMAC connectivity and use GET /api/v1/trading/accounts?owner=<owner_wallet> with read scope. Session-key registration additionally needs the wallet-signed delegation and matching registered app/domain; see Session Keys.

Before giving a client production quote capacity:

• Run node scripts/e2e/mm-docs-contract-audit.cjs --offline for the static documentation contract. Running without that flag performs a trading probe; use an explicitly authorized account and test scope for that separate step.
• Verify signed compact order submit and cancel cleanup.
• Verify the exact route in the client's bundle:
  • beta alias: /api/order-entry/binary
  • direct compatibility route: /api/v1/mm/orders/batch.bin
  • canonical route: /api/v1/bsl/orders/compact
• Confirm result and response modes. In beta, start with x-bsl-result-mode: ack plus x-senticore-response-mode: detailed.
• Confirm private stream, FIX drop-copy, or account-read reconciliation path.

Backpressure Policy

BSL should reject early when latency cannot stay bounded:

Use the actual lane-specific reject codes, not conceptual names such as SHARD_BUSY as a universal wire contract. Direct TCP capacity rejection is reason 100 (BackpressureFull). Reason 106 (DurabilityUnknown) is not backpressure: reconcile the original identity before sending any replacement. Reason 108 (IpcTransportUnavailable) is live: a proven transport failure before submission, which older gateways reported as 100. Retry only the identical request.

For professional clients this is a feature. A fast reject lets the strategy cancel, widen, or pause immediately.

Observability

Monitor these dimensions per account, market, and shard:

Metric family	Why it matters
Order-entry request latency	Separates edge, auth, signing, sequencing, and read-plane costs.
BSL reject counts by code	Shows whether clients hit queue, risk, market, or auth limits.
Per-shard exposure and locked credit	Protects the venue while allowing multi-market quoting.
Release lag for credit/order reservations	Finds stale locks that reduce quote capacity.
Private stream gap-fill rate	Detects stream disconnects or client lag.
FIX session rejects and resend rate	Catches sequence and conformance drift.

Client Handoff Checklist

• Endpoint bundle contains host, route, TLS/SNI mode, expected BSL result mode, and expected response verbosity.
• FIX bundle contains SenderCompID(49), TargetCompID(56), TargetSubID(57), account, host, port, and TLS SNI. Clients should get these from /api/v1/bsl/connectivity instead of guessing.
• Credential bundle uses institutional_agent HMAC for FIX/BSL machine access, with account binding, allowed markets, scopes, rate tier, cancel-on-disconnect policy, drop-copy entitlement, and FIX permission recorded during onboarding.
• Order-entry lane key is provisioned only when needed for dedicated limits.
• Client has tested capacity, business-risk, halt, authentication and uncertain submission outcomes using the documented codes for its actual lane.
• Cancel-on-disconnect is tested with a resting-order account before unattended quoting. Automatic cancel-on-disconnect applies to session-key BSL Direct TCP sessions (policy cancelOnDisconnect=true), FIX, and FIXP. Wallet-signed BSL TCP sessions do not get an automatic sweep; reconcile and use cancel-all.
• The Core-owned DMS is configured for delegated HTTP and BSL SessionKey orders that explicitly opt in. Use signed DMS heartbeats independently of the transport. Legacy wallet-signed BSL frames cannot opt in. Verify canonical completion; a disconnect notice is not a cancellation receipt. Multi-shard and hot-standby promotion remain outside the current DMS contract. A bounded live BSL Spot expiry canary passed September 12 after the reader replay correction; see the DMS page for scope.