User APIs¶

This section covers endpoints for retrieving user-specific information like account profile and funds.

Getting Your Access Token¶

There are two ways to get the access_token used in the Authorization header on every request.

Method 1: Dashboard token generation¶

Individual traders can directly get their Access Token from web.indstocks.com. All INDstocks users are eligible to get free access to Trading APIs. Here's how to get your Access Token:

1. Log in to indstocks.com
2. Go to indstocks.com/app/api-trading/access-tokens and generate your access token.

Method 2: TOTP-based token generation¶

For server-side / headless integrations, you can generate an access token using a TOTP (Time-based One-Time Password) instead of logging into the dashboard each time.

Setup (one-time)

1. Log in to indstocks.com and go to indstocks.com/app/api-trading/access-tokens — the same page where you generate your dashboard access token and set up your Static IP.
2. Click Setup TOTP and follow the steps to link an authenticator app. Scan the QR code (or enter the key manually), then submit one code from the app to confirm.
3. Once TOTP setup succeeds, the page displays your Client ID — this is the static x-api-key value for your account, used in place of the Authorization header for this endpoint only.
4. You can now generate a fresh access token at any time by calling the endpoint below instead of returning to the dashboard.

Endpoint

POST /generate/token

Headers

Request Body

Example Request

curl --location 'https://api.indstocks.com/generate/token' \
--header 'x-api-key: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{
    "mpin": "YOUR_MPIN",
    "totp": "123456"
}'

Response Payload (Success)

The response returns the access token in a field named token (not access_token). Use its value in the Authorization header of every other request, same as the dashboard-generated token.

Token lifecycle

Only one TOTP-generated token is live at a time. Each successful call to /generate/token invalidates the token issued by the previous call. There is no way to hold two valid TOTP tokens concurrently.

The practical consequences:

• Generate your token once per session and reuse it for the rest of the day. Don't call /generate/token before each request — you'll invalidate the token your other processes are using.
• If you run multiple processes or machines, have one of them generate the token and share it with the others. Two processes each generating their own token will keep killing each other's.
• A token remains valid for 24 hours from generation, unless it's replaced by a newer one, revoked from the dashboard, or invalidated by disabling TOTP.
• The currently-live token is displayed on the dashboard next to your Client ID, with an option to revoke it. Revoking takes effect immediately — in-flight and subsequent calls with that token will fail with TokenException.

TOTP limits and lockouts

These numbers are the launch values and may be tuned once we see real traffic. Build your client to read the error response rather than hard-coding these thresholds, and always back off on failure instead of retrying immediately.

Failure cases

User Profile¶

Retrieves the profile information for the authenticated user. This is a useful endpoint to test if your access token is valid.

Endpoint

GET /user/profile

Example Request

curl --location 'https://api.indstocks.com/user/profile' \
--header 'Authorization: YOUR_ACCESS_TOKEN'

Response Payload (Success)

{
  "status": "success",
  "data": {
    "user_id": "1234567",
    "email": "john.doe@example.com",
    "first_name": "John",
    "last_name": "Doe",
    "demat_id": "",
    "is_nse_onboarded": true,
    "is_bse_onboarded": true,
    "is_nse_fno_onboarded": true,
    "is_bse_fno_onboarded": true,
    "ucc": "1ABCDE2N7X",
    "is_ddpi_active": true
  }
}

Response Fields

Get Funds¶

Retrieves the funds utilization and availability for the authenticated user.

Endpoint

GET /funds

Example Request

curl --location 'https://api.indstocks.com/funds' \
--header 'Authorization: YOUR_ACCESS_TOKEN'

Response Payload (Success)

{
    "status": "success",
    "data": {
        "sod_balance": 4996.47,
        "pledge_received": 0,
        "pledge_remained": 0,
        "detailed_avl_balance": {
            "option_sell": 2980.40,
            "future": 2980.40,
            "option_buy": 4449.65,
            "comm_option_buy": 2980.40,
            "eq_mis": 2980.40,
            "eq_cnc": 2980.40,
            "eq_mtf": 2980.40
        },
        "withdrawal_balance": 2983.47,
        "funds_added": 0,
        "funds_withdrawn": 0,
        "realized_pnl": -751.92,
        "unrealized_pnl": 62.15,
        "brokerage": 0,
        "eq_charges": 0,
        "fno_charges": 0
    }
}

Response Fields

See Also¶

• API Conventions — request/response format and rate limits
• Glossary & Constants — TOTP fields, ID prefixes, shared enums
• Error Bucket — TokenException and other auth-related errors