Some API calls require your application to authenticate itself. This is done using an API key associated with your account. You can create an API key by visiting the API Keys section on the settings page.

An API key consists of a key id and a key secret. For example, cnz2yjswbv3jd (key id) and 0hydMZDb9HRR3Qq-iqALwZtXLkbLR4fWxtDZvkB9h4I (key secret).

API requests are authenticated using HTTP basic authentication with the key id as the username and the key secret as the password. A missing, incorrect or revoked key causes error 401 to be returned.

Each API key is granted a set of permissions when it is created. The key can only be used to call the permitted API functions.

Permissions

The following is a list of the possible permissions.

• Perm_R_Balance = 1 (View balance)
• Perm_R_Transactions = 2 (View transactions)
• Perm_W_Send = 4 (Send to any address)
• Perm_R_Addresses = 8 (View addresses)
• Perm_W_Addresses = 16 (Create addresses)
• Perm_R_Orders = 32 (View orders)
• Perm_W_Orders = 64 (Create orders)
• Perm_R_Withdrawals = 128 (View withdrawals)
• Perm_W_Withdrawals = 256 (Create withdrawals)
• Perm_W_ClientDebit = 8192 (Debit accounts)
• Perm_W_ClientCredit = 16384 (Credit accounts)
• Perm_R_Beneficiaries = 32768 (View beneficiaries)
• Perm_W_Beneficiaries = 65536 (Create and delete beneficiaries)

A set of permissions is represented as the bitwise OR of each permission in the set. For example the set of permissions required to view balances and orders is Perm_R_Balance | Perm_R_Orders = 33.

When API keys are created, users can select permission sets that automatically include various permissions for their key. These are listed below.

Timestamps are always represented as an integer number of milliseconds since the UTC Epoch (a Unix timestamp).

Prices and volumes are always represented as a decimal strings e.g. "123.3432". Strings are used rather than floats to preserve the precision.

Parameters for POST calls are sent as URL-encoded forms (application/x-www-form-urlencoded).

The following currencies are supported through the Luno market platform. For complete details, please see Fees & features:

• XBT: Bitcoin
• BCH: Bitcoin Cash
• ETH: Ethereum
• EUR: Euro
• GBP: Pounds
• LTC: Litecoin
• MYR: Malaysian Ringgit
• NGN: Nigerian Naira
• UGX: Ugandan Shilling
• ZAR: South African Rand
• XRP: XRP
• ZMW: Zambian Kwacha

The following are examples of currency pairs that are supported through the Luno market platform. For complete details, please see Fees & Features:

• XBTEUR
• XBTZAR
• XBTUGX
• XBTZMW
• ETHXBT
• BCHXBT

The following methods are available for Funds Withdrawal based on the type of currency or currency pair being withdrawn.

Currency:

• BTC: Bitcoin
• BCH: Bitcoin Cash
• ETH: Ethereum
• LTC: Litecoin
• XRP: XRP

Withdrawal methods:

• ZAR_EFT: EFT
• NAD_EFT: EFT
• KES_EFT: EFT
• KES_MPESA: M-Pesa
• MYR_IBG: Interbank GIRO / IBFT
• IDR_LLG: Bank transfer, Lalu Lintas Giro
• NGN_EFT: Bank transfer
• ZMW_EFT: Bank transfer
• SGD_GIRO: GIRO / FAST
• SGD_WIRE: International Wire
• EUR_SEPA: SEPA transfer
• GBP: Bank transfer
• UGX_EFT: Bank transfer

The Go library is the recommended way to access the API.

The following libraries were implemented by third parties or are no longer under active development and are listed here for convenience. No support is provided by Luno and they may be out of date. A thorough review of the code is recommended before including them in any project.

• Android
• Haskell
• Java
• Node.js
• PHP
• Python
• Ruby

Calls to the Market Data APIs are rate limited to 1 call per second per IP address, with a burst of 5 calls. All other API calls are rate limited to 5 calls per second per customer, with a burst of 25 calls. API call rate limits allow bursts of up to 5 consecutive calls. Exceeding the limit causes HTTP error Code 429 to be returned.

Always use HTTPS when calling the API. Non-TLS HTTP requests cause error 403 to be returned. Using non-TLS requests can leak your authentication credentials.

Verify that your client validates the server's SSL certificate. Many libraries (e.g. urllib2 in Python2) do not validate server certificates by default. Failing to verify the server certificate makes your application vulnerable to man-in-the-middle attack.

All transactions on the Luno platform operate on Accounts. Each Account is denominated in a single currency and contains an ordered list of entries that track its running balance.

Each Account has a separate balance and available balance. The available balance may be lower than the balance if some funds have been reserved (e.g. for an open limit order). Account entries affect the balance and available balance independently.

Account entries are numbered sequentially. It is guaranteed that entries are never reordered or deleted. It is also guaranteed that the core attributes of the entry (the running balances and index) are never modified. Therefore, an Account acts as an append-only log of transactions.

Users are able to access information about their beneficiaries - banks or other financial institutions that are able to receive assets.

Market data API calls can be accessed by anyone without authentication. The data returned may be cached for up to 1 second. The Streaming API (see below) can be used if lower latency market data is needed.