Endpoint reference - ExuraCopy Social Trading

API base URL

https://social-api.example.com

All routes require:

Authorization: Bearer YOUR_CRM_API_KEY

Identity

Method	Path	Primary identifier
`POST`	`/api/v1/sso/start`	`external_reference` in the body.
`PATCH`	`/api/v1/users/password`	`external_reference` in the body.

Branches

Method	Path	Primary identifier
`POST`	`/api/v1/branches/sync`	External branch `id` in the body.

Account webhook administration

These routes require a CRM API key with administrative scope.

Method	Path	Purpose
`POST`	`/api/v1/integrations/crm/account-webhook`	Register the single account-event destination and receive its signing secret.
`GET`	`/api/v1/integrations/crm/account-webhook`	Retrieve the current destination without exposing the signing secret.
`PATCH`	`/api/v1/integrations/crm/account-webhook`	Update the name or URL, or set `ACTIVE`/`DISABLED`.
`POST`	`/api/v1/integrations/crm/account-webhook/rotate-secret`	Replace the HMAC signing secret and return it once.
`GET`	`/api/v1/integrations/crm/account-webhook/events`	List delivery attempts by status with cursor pagination.
`POST`	`/api/v1/integrations/crm/account-webhook/events/{event_db_id}/retry`	Requeue an event that is not already delivered.

Wallet

Method	Path	Idempotency
`GET`	`/api/v1/wallet/external/account`	Not applicable.
`POST`	`/api/v1/wallet/external/deposit`	Required through `idempotency_key`.
`POST`	`/api/v1/wallet/external/withdrawal`	Required through `idempotency_key`.

Common values

Field	Value or rule
`external_reference`	Unique, stable ID controlled by the CRM.
`branch_id`	External CRM branch ID; used in SSO after synchronization.
`wallet_code`	`PAMM_SOCIAL_USD` for this integration.
`currency`	`USD` for this integration.
`amount`	Positive decimal sent as a string.
`idempotency_key`	Unique per movement and reused for retries.

Recommended order

synchronize branches -> migration confirmed by ExuraCopy Support -> SSO with branch_id
                     -> wallet lookup -> deposit or withdrawal -> new lookup
                     -> register the account webhook -> receive social.account.created

Outbound webhook

Direction	Event	Identifier
ExuraCopy → CRM	`social.account.created`	`event_id` in the header and body.

Register the receiver through POST /api/v1/integrations/crm/account-webhook. The signing_secret is returned only during registration or rotation and must be stored immediately. Only one destination is supported per environment; an additional registration returns 409.

This reference describes the external integration contract. ExuraCopy’s internal administration, ledger, and operational logic endpoints are outside the scope of this guide.

Previous: Errors

Return to error handling and recovery.

​API base URL

​Identity

​Branches

​Account webhook administration

​Wallet

​Common values

​Recommended order

​Outbound webhook

Previous: Errors

API base URL

Identity

Branches

Account webhook administration

Wallet

Common values

Recommended order

Outbound webhook