1. Parties and Acceptance

This Trade API Agreement (the "Agreement") is entered into between:

ZoneX AG, CHE-192.381.383, a Swiss stock corporation (Aktiengesellschaft) with registered office in the Canton of Zug, Switzerland, having its registered address at Bahnhofstrasse 21, 6300 Zug, Switzerland (also referred to as c/o STAX AG at that address) ("ZoneX", the "Company", "we", "us" or "our"),

and

the individual or legal entity that creates, holds or uses a Trade API key, or that causes software to call the Trade API on an account linked to that person ("you", the "User" or the "Licensee").

By completing the electronic acceptance control, the User expressly agrees to this Agreement. This Agreement may be concluded electronically to the extent permitted by applicable law. ZoneX may retain the timestamp, account identifier, key identifier, source address and document-version record of each acceptance.

If you do not agree to this Agreement, do not create a key and do not use the Trade API.

2. Relationship to Other Official Documents

This Agreement supplements, and does not replace, the ZoneX Terms of Use, Privacy Policy, Risk Disclosure, Cookie Policy, Refund Policy, AML Policy and Complaints Procedure, and — where applicable to the account the key is bound to — the Challenge Terms & Conditions, Challenge Rules, Funded Trader Services Agreement, Account Schedule and Funded Trader Rules (together with this Agreement, the "Official Documents").

On a point that is specifically about programmatic access, API keys, signing, rate limits, sockets, recordings of API calls, or the licence to call the Trade API, this Agreement prevails over the Terms of Use. On a point that is specifically about a Challenge evaluation, the Challenge Terms & Conditions and Challenge Rules prevail. On a point that is specifically about a Funded Trader Arrangement, the Funded Trader Services Agreement, the applicable Account Schedule and the Funded Trader Rules prevail in the order stated in the Terms of Use. In all other respects the Terms of Use prevail.

The current Trade API documentation and authenticated OpenAPI document form part of this Agreement solely with respect to technical and operational parameters, including routes, fields, scopes, rate limits, request requirements and refusal codes. Such documentation does not amend the allocation of legal rights, liability, payment obligations, governing law or other material contractual provisions of this Agreement unless the corresponding amendment is made in accordance with Section 16.

3. What the Trade API Is

The Trade API is a programmatic interface to the same ZoneX trading platform used by the on-screen Terminal. It comprises:

(a) a REST interface hosted at https://trade-api.zonex.trading, with every path under /api/v1; and

(b) a WebSocket interface at wss://trade-api.zonex.trading/api/v1/stream/ws.

A key lets your software read one bound account and, if the key has TRADE scope, place, change and cancel orders and use the other mutating routes described in the documentation — subject to the same platform checks, challenge rules, funded-trader rules, premium entitlements and venue constraints that apply on screen.

The Trade API is not a brokerage, not an exchange, not a venue matching engine, and not a market-data redistribution product. ZoneX does not act as the User’s broker, custodian, investment manager or counterparty merely by providing the Trade API. Where the bound account is a personal exchange account connected to the Terminal, orders are submitted to the third-party exchange you connected. Where the bound account is a Challenge account, trading occurs in a simulated evaluation environment using notional funds and live market data. Where the bound account is a Funded Trader Account Configuration, the environment may be simulated, may use ZoneX-owned proprietary capital, or may combine both, as determined under the funded-stage Official Documents; you do not own that capital.

Company registration is not financial-services authorisation. Nothing in this Agreement constitutes investment, financial, legal, tax or trading advice. You are solely responsible for every instruction your software sends.

4. Licence

Subject to continuous compliance with this Agreement and the other Official Documents, and subject to a current Premium entitlement that includes API access for the relevant account, ZoneX grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable licence for the User’s own internal use, for so long as the key remains live, to:

(a) call the Trade API solely to operate the one ZoneX account to which the key is bound;

(b) receive account, order, position, balance, holding, instrument, journal and quote data returned for that account, solely to operate that account; and

No other licence is granted. In particular, this licence does not include any right to resell, sublicense, white-label, rent, publish, redistribute or commercially exploit the Trade API, the platform, market data, quotes, trades, the OpenAPI document, or any derived feed. Resale, sublicensing, white-labelling and other third-party commercialisation of ZoneX Services require a separate written agreement with ZoneX.

5. Keys, Scopes and Binding

5.1 Creation. Keys are created in Settings → API keys. You must select one account, select a scope, and accept this Agreement. A key belongs to that one account. Another account of yours requires its own key. A passed Challenge that becomes a new funded account requires a new key bound to that funded account.

5.2 Identifiers. The key identifier starts with zxk_. The secret starts with zxs_ and is shown once, at creation. You must store the secret as you would a password. ZoneX will not re-display it. If the secret is lost, compromised or suspected to be compromised, you must revoke the key and create another.

5.3 Scopes. A READ key may perform GET requests and follow the account over the WebSocket. A TRADE key may perform the mutating routes described in the documentation and includes READ. A READ key that attempts a mutating call is refused (including with 403 API_KEY_SCOPE_INSUFFICIENT). You must not request a TRADE key unless you intend your software to place, change or cancel orders.

5.4 Quantity. At most three live keys may exist per account, unless ZoneX publishes a different cap in the documentation or applies a different cap to a particular account.

5.5 IP pinning. You may pin a key to one or more IP addresses. A request from an address that is not pinned is refused (including with 403 API_KEY_IP_NOT_ALLOWED). If you pin a key, you are responsible for the accuracy of the list and for updating it when your infrastructure changes.

5.6 Locking and revocation. ZoneX may pause an account's keys until a stated time (including with 403 API_KEYS_LOCKED). ZoneX may revoke any key at any time where reasonably required for security, abuse prevention, rule enforcement, legal or sanctions reasons, non-payment of Premium, account closure, or material breach. You may revoke your own keys at any time. Revocation does not cancel working orders already accepted by a venue; you remain responsible for flattening risk on screen or through any remaining live TRADE key. Revocation, suspension or expiry of a key does not necessarily cancel working orders, close open positions, reduce exposure or otherwise alter the state of an account or third-party venue. You remain responsible for monitoring and managing the account through another available method.

5.7 Your responsibility for the key. You are responsible for every request signed with your secret, whether made by you, by software you operate, by your authorised personnel or contractors acting on your behalf, or by any person who has obtained the secret. Sharing a secret, embedding a secret in a public repository, or allowing a third party to hold a TRADE key for your account is at your sole risk and, where it amounts to allowing another person to trade or manage your account, may also breach the Challenge Rules or Funded Trader Rules.

6. Premium Entitlement

API access is a Premium feature. The entitlement covers the whole key. If the entitlement lapses, is not purchased, is refunded, or is otherwise not current, every request is refused (including with 402 PREMIUM_REQUIRED) and an open socket is closed. You may still close and cancel on screen, subject to the Terminal remaining available.

Premium features reached through the API (including, where offered, managed positions, trailing-stop arming, conditional orders, limit-order chasing and extended journal history) remain subject to the same paid-feature rules that apply on screen. Holding API access does not itself unlock every Premium tool.

Fees, billing and refunds for Premium are governed by the Terms of Use and the Refund Policy. This Agreement does not create a service-level commitment, availability credit or refund solely because the API refused a call, rate-limited you, or was unavailable.

7. Authentication and Client Obligations

7.1 Signing. Every REST request except GET /api/v1/time must be signed. You send the key identifier in the X-ZX-APIKEY header and an HMAC-SHA256 signature computed over the query string exactly as sent (without the leading "?") concatenated with the raw body bytes, using the full secret as the HMAC key, in the manner described in the documentation.

7.2 Time. Signed requests are refused when their timestamp is more than recvWindow behind the server or more than one second ahead of it. recvWindow may be between 1 and 60,000 milliseconds and is 5,000 milliseconds if omitted. You must read GET /api/v1/time and adjust for clock skew.

7.3 WebSocket. A socket requires a signed session.logon frame within the interval stated in the documentation (presently ten seconds). On close, you must reconnect, re-read state over REST, and then apply subsequent frames. You must not treat the socket as a complete market tape.

7.4 Idempotency. You must give every order a clientOrderId that is unique for that account. You must not retry an unknown outcome under a new clientOrderId. Doing so may create a second live order.

7.5 Data types. Prices and quantities are strings. Missing fields are not zero and do not mean a stated value. Identifiers are opaque and must be sent as returned.

7.6 Follow, do not poll. You must follow the account over the WebSocket rather than polling REST for state you can receive as frames. Persistent polling that is unnecessary in light of the socket may be treated as unfair use.

8. Rate Limits and Fair Use

8.1 Order budget. Non-GET calls draw on an order budget that belongs to the account and is shared by all of its keys. The default published budget is five calls per second and three hundred calls per minute. ZoneX may change these numbers. The response is authoritative. Over budget, the call is refused with 429 RATE_LIMITED, a Retry-After header, and details carrying the wait in seconds. The refused request was not applied.

8.2 Read budget. GET calls draw on a read budget that belongs to the key. The default published budget is 1,200 calls per minute. Over budget, the call is refused with 429 RATE_LIMITED.

8.3 Venue limits. 429 VENUE_RATE_LIMITED means the exchange refused the call. Nothing was applied. You must wait the Retry-After named in that response. Waiting only on your ZoneX budget will not help.

8.4 Unbudgeted routes. GET /api/v1/time, GET /api/v1/openapi.json and the WebSocket itself do not draw on the order or read budgets, but remain subject to fair use and to connection limits ZoneX may apply.

8.5 Fair use. Bots are permitted on Challenge accounts, Funded Trader accounts and personal Terminal accounts. Their trades count toward evaluation and, where applicable, toward payout eligibility, on the same terms as manual trades. What they may not do is play the simulation, the platform or a venue instead of the market. Without limitation, you must not:

(a) exploit delays, errors, stale prices, rollbacks or gaps in simulated or platform execution;

(b) place, amend or cancel orders for the purpose of probing, spoofing, layering or moving the simulated or venue book;

(c) use latency arbitrage, tick-scalping that exploits platform latency, or any other practice listed as prohibited in Challenge Rules Section 7 or the applicable Funded Trader Rules;

(d) circumvent rate limits by rotating keys, distributing one strategy across accounts, or otherwise multiplying budgets;

(e) attempt to discover unpublished internals, matching logic or non-public feeds; or

(f) overload, scan or interfere with the Trade API, the Terminal or related infrastructure.

8.6 Recordings. Every call that changes something, and every refused call, is recorded against the key that made it — including the route, the answer, the time and the address it came from. Successful reads are not recorded in that enforcement log. You acknowledge this recording as necessary for security, billing, rule enforcement and dispute handling, and as processing described in the Privacy Policy.

8.7 Security. ZoneX shall apply technical and organisational measures appropriate to the risks associated with Trade API credentials and API records. No method of electronic storage, transmission or authentication can be guaranteed to be completely secure.

9. Challenge, Funded and Personal Accounts

9.1 Same rules as the screen. Programmatic access does not relax any rule that applies to the bound account. A Challenge action that would end the attempt on screen will end the attempt when sent through the API. On some Challenge configurations an action may proceed and still end the attempt (for example an unstopped entry where stops are required). Liquidation of a Challenge account ends the attempt unconditionally.

9.2 Open risk. Daily-loss and drawdown measures include realized losses, unrealized losses, fees, funding and committed open risk on working orders and stops, as defined in the Challenge Rules. Your software must account for that measurement. The optional Pre-Violation Warning, if enabled, does not change the rules, and the absence of a warning does not confirm that an action is compliant.

9.3 Confirmed breach. On a Challenge account, a confirmed breach fails the attempt — replacing a pass if the account had passed — voids the relevant trades for payout purposes as provided in the Challenge Official Documents, flattens the account and revokes all of its keys.

9.4 Funded stage. Admission to a Funded Trader Arrangement, ownership of capital, and any Performance Remuneration remain governed exclusively by the funded-stage Official Documents. Use of the Trade API on a funded account does not alter ownership of capital, which remains with ZoneX where proprietary capital is used.

9.5 Personal exchange accounts. If the bound account is your own connected exchange account, you trade your own assets at that venue. ZoneX does not hold those assets. Exchange fees, liquidations, venue outages, API changes, order rejections and venue security events are outside ZoneX's control. You must configure exchange-side keys with trading permission and without withdrawal permission when connecting an exchange to the Terminal; that exchange-side key is not a ZoneX Trade API key and is governed by the venue's terms.

10. Prohibited Use

You shall not, directly or indirectly:

(a) reverse engineer, decompile, scrape unpublished endpoints, or probe the Trade API to discover source code, internal architecture or non-public market data;

(b) proxy, wrap or republish the Trade API or any data it returns as a feed, product, hosted service or third-party integration, except to the extent your own software is acting solely on your bound account;

(c) use the Trade API to build or operate a competing evaluation platform, terminal or brokerage interface for third parties;

(d) allow any unauthorised person to trade, access or manage the bound account, or trade an account for another person except where expressly permitted by the applicable Official Documents;

(e) buy, sell, rent, gift or transfer a key, a Challenge, a funded seat or an account;

(f) use multiple accounts, keys or identities to circumvent a rule, a budget, a Premium gate or a lock;

(g) submit false identity or verification information, or access the Services from a Restricted Jurisdiction or as a Prohibited Person as defined in the Terms of Use;

(h) use the Trade API in any way that is unlawful, that violates sanctions, or that manipulates a market or a simulation of a market; or

(i) represent ZoneX access as an exchange listing, a brokerage licence, a guaranteed payout or investment advice.

11. Data, Market Data and Intellectual Property

All software, interfaces, documentation, trademarks, risk-engine logic, evaluation methodology and other materials provided through the Trade API are the exclusive property of ZoneX or its licensors and are protected by Swiss and international intellectual property laws.

Quotes, trades and other market data made available through the Trade API are incomplete, are supplied only for instruments the platform is serving to your session, and may be delayed, interpolated or derived. They are not a complete tape and are not licensed for redistribution, display to third parties, or the creation of a competing data product.

Account data relating to your bound account remains subject to the Privacy Policy and, where it is personal data, to the Swiss Federal Act on Data Protection (FADP). You grant ZoneX a licence to process API logs, signatures metadata, source addresses, request payloads that change state, and refusal records for operating, securing, billing and enforcing the Services.

You retain ownership of your own strategy code. You do not acquire any right in ZoneX software by calling it.

12. No Warranty; Allocation of Risk

THE TRADE API IS PROVIDED ‘AS IS’ AND ‘AS AVAILABLE’. SUBJECT ALWAYS TO LIABILITY AND RIGHTS THAT CANNOT LAWFULLY BE EXCLUDED OR LIMITED, ZONEX DISCLAIMS, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, UNINTERRUPTED AVAILABILITY, LATENCY, CORRECTNESS OR COMPLETENESS OF DATA, AND ANY WARRANTY THAT AN ORDER WILL BE ACCEPTED, EXECUTED OR FILLED AT A PARTICULAR PRICE.

You acknowledge the risks described in the Risk Disclosure, including volatility, leverage and liquidation, venue insolvency and hacks, API connectivity failures, price-feed errors, software bugs, maintenance, and the difference between simulated Challenge outcomes and live-market outcomes. Automated trading concentrates those risks. A bug in your client, a missed socket frame, a clock skew refusal, a rate-limit, or a venue reject can leave you with unwanted risk. You must design for refusal, disconnect and unknown order state.

ZoneX does not guarantee that Pre-Violation Warnings, platform checks or documentation examples will prevent a breach or a loss.

13. Limitation of Liability

To the maximum extent permitted by Swiss law, ZoneX is not liable for:

(a) downtime, unavailability, degraded performance, latency, bugs or errors of the Trade API, the Terminal or the website;

(b) outages, delays, maintenance, API changes, order rejections or other failures of any third-party exchange or liquidity provider;

(c) trading losses, missed trades, slippage, liquidation, funding costs, or missed Challenge or funded-stage outcomes, including outcomes caused by your software;

(d) unauthorised use of a key whose secret left your control; or

(e) regulatory, tax or legal consequences of your trading.

Subject to the exclusions and limitations that are permitted by applicable law, and without limiting liability that cannot lawfully be excluded or limited, ZoneX's total aggregate liability arising out of or in connection with this Agreement and your use of the Trade API is limited to the Premium and other fees you paid to ZoneX for API access and related paid Terminal features in the twelve (12) months preceding the event giving rise to the claim.

Nothing in this Agreement excludes or limits liability that cannot be excluded or limited under Swiss law, including liability for fraudulent misrepresentation or for unlawful intent or gross negligence as provided by mandatory rules.

14. Indemnity

To the extent permitted by applicable law, you shall indemnify ZoneX and its directors, officers, employees and agents against third-party claims, losses, damages and reasonable legal costs arising directly from: (a) your material breach of this Agreement or another applicable Official Document; (b) your unlawful or unauthorised use of the Trade API; (c) your infringement of a third party’s rights; (d) your unauthorised sharing, transfer or disclosure of a Trade API key or secret; or (e) claims by a third party arising from trading instructions submitted through your key where the claim results from your acts, omissions or software. This indemnity does not apply to the extent the relevant claim or loss was caused by ZoneX’s unlawful intent or gross negligence.

15. Suspension, Termination and Consequences

Either party may stop the licence at any time by revoking the keys (you) or by revoking or locking the keys or withdrawing Premium access (ZoneX). ZoneX may suspend or terminate immediately for actual or suspected breach of Sections 8, 9 or 10, for sanctions or eligibility reasons, for security incidents, or as provided in the other Official Documents.

On revocation, suspension or termination: the licence ends; sockets may be closed; in-flight REST calls may be refused; and working orders or open positions are not necessarily cancelled, closed or reduced unless a specific cancel, close or flatten instruction is successfully processed or an applicable Challenge or Funded Trader rule requires otherwise. You remain responsible for monitoring and managing outstanding risk through another available method. You must promptly delete secrets from your systems. ZoneX may retain logs and acceptance records for the periods stated in the Privacy Policy and the Terms of Use.

Survival: Sections 2, 8.6, 11 to 14, 16 to 19 and any accrued payment obligation survive termination.

16. Changes

ZoneX may amend this Agreement from time to time. A revised version shall state its effective date and shall be published in the Legal Centre. Where an amendment materially affects the User’s contractual rights or obligations, ZoneX shall provide reasonable notice and, where appropriate, require acceptance of the revised Agreement before a new key is created or continued use of an existing key after the stated effective date. Changes reasonably required by law, sanctions requirements, security threats, fraud prevention or market integrity may take effect on shorter notice or immediately where reasonably necessary. Changes shall not retroactively alter accrued rights or obligations unless required by applicable law.

Technical and operational parameters in the live OpenAPI document and HTTP responses, including routes, rate limits, Retry-After values, request formats and refusal codes, may change without a new version of this Agreement provided that such changes do not materially alter the contractual allocation of rights and obligations.

17. Complaints and Disputes

Operational determinations (including rate-limit, lock, revocation and Challenge-breach determinations arising from API use) may be challenged through the Complaints Procedure published at https://zonex.pro/en/complaints. Raising a complaint does not stay a lock, a revocation or a Challenge failure unless ZoneX agrees otherwise in writing.

18. Governing Law, Jurisdiction and Language

This Agreement is governed by and construed in accordance with the substantive laws of Switzerland, excluding its conflict-of-law rules and excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

Subject to mandatory statutory places of jurisdiction, the competent courts of the Canton of Zug, Switzerland, shall have exclusive jurisdiction over disputes arising out of or in connection with this Agreement. Nothing in this Section limits any mandatory place of jurisdiction available to a consumer under applicable law. ZoneX may seek provisional, protective or injunctive relief in any court of competent jurisdiction where permitted by law.

This Agreement is drafted in the English language. Any translation is for convenience only. To the extent permitted by applicable law, the English version prevails in the event of inconsistency.

19. General

19.1 Entire agreement. This Agreement, together with the other Official Documents as allocated in Section 2, constitutes the entire agreement on programmatic access to the platform and supersedes prior statements on that subject. Nothing in this Section excludes liability for fraudulent misrepresentation.

19.2 Severability. If a provision is held unenforceable, it is modified to the minimum extent necessary to make it enforceable, and the remainder continues in effect.

19.3 No waiver. A failure to enforce a provision is not a waiver.

19.4 Assignment. You may not assign this Agreement or a key. ZoneX may assign this Agreement to an affiliate or successor.

19.5 No partnership. Nothing in this Agreement creates a partnership, joint venture, employment or brokerage relationship.

19.6 Notices. Legal notices to ZoneX under this Agreement must be sent to legal@zonex.pro, with a copy for operational API matters to dev@zonex.pro. Notices to you may be sent to the email on your account, shown in product, or posted in the Legal Centre.

20. Contact

ZoneX AG

Company number: CHE-192.381.383

Registration number: CH 170.3.042.672

Registered address: Bahnhofstrasse 21, 6300 Zug, Switzerland

Legal: legal@zonex.pro

Support: contact@zonex.pro

Technical: dev@zonex.pro

21. Acknowledgment Presented at Key Creation

The following acknowledgment shall be presented together with a readily accessible link to the full Agreement before creation of a Trade API key. The User must affirmatively accept it before the key is created.

"I have read and agree to the ZoneX Trade API Agreement (Version 1.0). I understand that a key is bound to one account, that TRADE scope can place and cancel orders, that API access requires a current Premium entitlement, that Challenge and funded-trader rules apply to API orders in the same way as on-screen orders, that mutating and refused calls are logged, and that exploiting the simulation or the platform is prohibited. I will store the secret securely and revoke the key if it is lost or compromised."

— End of Trade API Agreement —