> ## Documentation Index > Fetch the complete documentation index at: https://docs.trdrs.co/llms.txt > Use this file to discover all available pages before exploring further. # Set an account’s risk controls > Replaces the five controls on one firm-issued account in a single write. An enabled control needs a positive value (loss/profit in account currency; the EOD close in whole minutes before the 16:00 CT close, 1–240); a disabled control’s value is ignored. Enforcement is live from the write: the risk monitor re-arms immediately, and a control that fires flattens and locks the account exactly as if the trader had set it themselves. This writes the same settings row the trader edits — last write wins, and the response returns the state as stored so your system can mirror it. The trader’s own "prevent changes while locked" preference is not on this surface and survives your write. ## OpenAPI ````yaml /partner-platform/openapi.json put /api/partner/accounts/risk openapi: 3.1.0 info: title: trdrs Engine API version: 1.1.0 description: >- ## API Reference This is the served OpenAPI contract for the trdrs engine: market data, trading and account routes for your firm's traders, trdrs Connect account-registration handoff, and preview challenge routes. See Quick Start for the first integration path: key setup, market config, chart data, Connect account registrations, idempotency, stream reconnects, and conformance. See Overview and API Standards for the cross-cutting contract rules. servers: - url: https://app.trdrs.co description: Production - url: / description: This engine security: [] tags: - name: Venue platform preview description: >- Disabled private-preview venue configuration APIs. VENUE_CONFIGURATION_ENABLED and a vault are required. Every route documented here under /api/partner/ is also served under /api/operator/ to a verified owner session, by the same router with a different credential: a browser must never hold a venue key, so an operator console reaches the identical checks that way rather than through a second copy of this surface. Not part of the stable public contract until qualification and release; existing partner APIs remain unchanged. - name: Market data description: >- Symbol search and resolution, OHLCV history, quote snapshots, the server clock, and the live bar stream. Crypto rides each venue’s public feed; futures stream from the caller’s own connected Rithmic account. With none connected, futures requests answer 503 `feed_requires_connection`. - name: News description: >- Aggregated market news and the economic calendar, from licensed/open sources, keyword-tagged with futures roots at ingest. Platform-wide content (nothing per-user), admitted exactly like Market data: a licensed origin, a session, or a firm API key. Headlines page by published time, scope by instrument root, and stream live over SSE; thumbnails serve through the image proxy. - name: Trading description: >- The money surface: entries, exits, replaces, cancels, and position/account flattening. Every order-placing call uses `clientOrderId` as its idempotency key. - name: Account description: >- Reading a connected account. You do not create trading accounts here: a trader connects their own broker account (or creates a free demo account) in the app, and firms create evaluation accounts through the Partner API (Firm accounts → Create evaluation accounts) or register venue accounts through Connect (Create an account registration). Account state and the durable ledgers: balances, positions, working orders, fills, P&L history, and the live account stream. - name: Connect description: >- Connect is the trader-facing module: the account picker a trader opens in the app or on a partner’s site, listing the five built-in brokers and every listed venue. These routes are its own API and stay; a venue reaches Connect by getting listed, and provider connections under the venue are a different thing (a firm bringing its own execution). trdrs Connect account registration, for partner firms. Register an account you issued on your own venue — a pending account registration — with the trader’s sign-in email, optionally the venue account id and the login name your venue issued. The trader finds it waiting in the connect flow the moment they sign in with that email: the connect step is pre-filled with everything except the credential, which the trader always enters themselves. A registration never transmits a password and never grants access to anything before the trader’s own login succeeds. These routes answer a partner-scoped key only; a firm API key or a user session gets 401. Registrations expire after 30 days; re-registering the same email + account refreshes the expiry instead of duplicating. The end-to-end flow guide is **[Quick Start](/docs/guides/quick-start)**. - name: Firm accounts (legacy) description: >- Legacy. Every route in this group has a venue twin under `/api/partner/venues/{venueId}/accounts…`, reached with a venue key and a named scope, and new integrations use those; this group stays for firms that predate venues, and the same operation runs behind both doors. Evaluation accounts your firm issues on the trdrs venue, through your partner key — the other half of account setup. Connect registrations hand off accounts that exist on your venue; these routes create and manage accounts on ours: the trader trades them on trdrs, and your firm owns the lifecycle. Every route is scoped to accounts your firm created through this API — an account the same trader opened themselves is invisible and untouchable here, by construction. Creation is batched with per-item results, and every write carries your own `referenceId`, so a crashed pipeline retries safely. Served when the deployment runs the prop engine; without it, every route in this group answers `404`. - name: Webhooks description: >- Being replaced by the venue API: venue-scoped events are not built yet, so this is the one job a venue-only backend still needs a Partner key for; nothing here is removed until they are. The outbound event bus: register an https endpoint and the platform pushes events to it instead of your back office polling us. Every delivery is signed (`trdrs-signature: t=,v1=` over `${t}.${rawBody}`) so you can prove it came from us and is fresh, and every delivery is durable — a failed attempt is retried with backoff for about nine hours and the whole log is readable, so an endpoint that was down is a delay rather than a lost event. Serves brokers and prop firms alike: the account-registration (`registration.*`) events fire wherever Connect does, and the account events fire where the prop engine runs. - name: Challenges description: >- Being replaced by the venue API: stage rules on the venue carry the firm’s half of this; the trader’s enroll flow has not moved yet. The prop evaluation surface: challenge programs and a trader’s own enrollments. **Preview: the one group on this page outside the additive-only guarantee** (the pre-contract v1 scaffold; the Phase-1 rebuild will change these shapes; see Stability). **Cookie-authenticated, not key-authenticated**, and served only when the engine runs with `CHALLENGES_ENABLED`; without that flag the bundle is absent and every route below returns `404`. The firm-console/admin half of this surface is deliberately not documented here. It is back office, not licensed surface. paths: /api/partner/accounts/risk: put: tags: - Firm accounts (legacy) summary: Set an account’s risk controls description: >- Replaces the five controls on one firm-issued account in a single write. An enabled control needs a positive value (loss/profit in account currency; the EOD close in whole minutes before the 16:00 CT close, 1–240); a disabled control’s value is ignored. Enforcement is live from the write: the risk monitor re-arms immediately, and a control that fires flattens and locks the account exactly as if the trader had set it themselves. This writes the same settings row the trader edits — last write wins, and the response returns the state as stored so your system can mirror it. The trader’s own "prevent changes while locked" preference is not on this surface and survives your write. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PartnerRiskSetRequest' responses: '200': description: >- The controls as stored + current lock state (PartnerRiskStateResponse) content: application/json: schema: $ref: '#/components/schemas/PartnerRiskStateResponse' '400': description: >- Malformed input — a missing accountNumber, or an enabled control without a positive in-range value content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: The bearer is not a partner-scoped key for an active partner firm content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: >- No firm-issued account with that number (or issuing accounts is not enabled on this deployment) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - partnerKey: [] x-codeSamples: - lang: javascript label: TypeScript source: >- const res = await fetch('https://app.trdrs.co/api/partner/accounts/risk', { method: 'PUT', headers: { 'content-type': 'application/json', Authorization: `Bearer ${process.env.TRDRS_API_KEY}`, }, body: JSON.stringify({ "accountNumber": "EVAL-7C21A9", "dailyLossEnabled": true, "dailyLossValue": 1000, "eodCloseEnabled": true, "eodCloseValue": 15 }), }) const data = await res.json() - lang: shell label: cURL source: |- curl -X PUT 'https://app.trdrs.co/api/partner/accounts/risk' \ -H "Authorization: Bearer $TRDRS_API_KEY" \ -H 'content-type: application/json' \ -d '{"accountNumber":"EVAL-7C21A9","dailyLossEnabled":true,"dailyLossValue":1000,"eodCloseEnabled":true,"eodCloseValue":15}' components: schemas: PartnerRiskSetRequest: type: object description: >- PartnerRiskSetRequest. Replaces the account’s five controls in one write. An enabled control must carry a positive value; a disabled control’s value is ignored and stored as null. properties: accountNumber: type: string description: A firm-issued account number. dailyLossEnabled: type: boolean dailyLossValue: type: number weeklyLossEnabled: type: boolean weeklyLossValue: type: number dailyProfitEnabled: type: boolean dailyProfitValue: type: number weeklyProfitEnabled: type: boolean weeklyProfitValue: type: number eodCloseEnabled: type: boolean eodCloseValue: type: number description: Whole minutes before the 16:00 CT close, 1–240. required: - accountNumber example: accountNumber: EVAL-7C21A9 dailyLossEnabled: true dailyLossValue: 1000 eodCloseEnabled: true eodCloseValue: 15 PartnerRiskStateResponse: type: object description: >- PartnerRiskStateResponse. The account’s risk controls plus whether trading is currently blocked, and by what. properties: accountNumber: type: string settings: $ref: '#/components/schemas/PartnerRiskSettings' halted: type: boolean description: >- True when trading on the account is currently blocked — by your halt, a risk trigger, or an evaluation breach. lockReason: type: - string - 'null' description: >- Why trading is blocked: `firm_halt` (yours), `daily_loss`, `weekly_loss`, `daily_profit`, `weekly_profit`, `eod_close`, or `eval_breach`. Null when trading. required: - accountNumber - settings - halted - lockReason example: accountNumber: EVAL-7C21A9 settings: dailyLossEnabled: true dailyLossValue: 1000 weeklyLossEnabled: false weeklyLossValue: null dailyProfitEnabled: false dailyProfitValue: null weeklyProfitEnabled: false weeklyProfitValue: null eodCloseEnabled: true eodCloseValue: 15 updatedAt: 1787582400 halted: false lockReason: null ErrorResponse: type: object properties: error: type: string required: - error example: error: invalid_instrument PartnerRiskSettings: type: object description: >- PartnerRiskSettings. The five per-account controls, each a toggle plus a threshold. Loss/profit values are in account currency and positive; a disabled control’s value is null. `eodCloseValue` is minutes before the 16:00 CT session close, 1–240. properties: dailyLossEnabled: type: boolean dailyLossValue: type: - number - 'null' description: >- Flatten + lock for the rest of the session day when the day’s net P&L reaches −value. weeklyLossEnabled: type: boolean weeklyLossValue: type: - number - 'null' description: >- Flatten + lock for the rest of the trading week at −value for the week. dailyProfitEnabled: type: boolean dailyProfitValue: type: - number - 'null' description: >- Lock the rest of the session day once the day’s net P&L reaches +value. weeklyProfitEnabled: type: boolean weeklyProfitValue: type: - number - 'null' description: Lock the rest of the trading week at +value for the week. eodCloseEnabled: type: boolean eodCloseValue: type: - number - 'null' description: >- Flatten this many minutes before the 16:00 CT close and block entries until the 17:00 CT reopen (no-overnight-holding rules). updatedAt: type: integer description: Epoch seconds of the last settings write. required: - dailyLossEnabled - dailyLossValue - weeklyLossEnabled - weeklyLossValue - dailyProfitEnabled - dailyProfitValue - weeklyProfitEnabled - weeklyProfitValue - eodCloseEnabled - eodCloseValue - updatedAt example: dailyLossEnabled: true dailyLossValue: 1000 weeklyLossEnabled: false weeklyLossValue: null dailyProfitEnabled: false dailyProfitValue: null weeklyProfitEnabled: false weeklyProfitValue: null eodCloseEnabled: true eodCloseValue: 15 updatedAt: 1787582400 securitySchemes: partnerKey: type: http scheme: bearer description: >- A partner-scoped API key (`trdrs_sk_…`), issued to a trdrs Connect partner firm and accepted only under `/api/partner/`. Same format as the firm (`tenant`) key, different scope: a firm API key is refused here, and this key is refused everywhere else. ````