API Reference
TestMax exposes two REST APIs that give you full programmatic control over backtesting, order execution, and strategy management. Whether you are building a Python trading bot, integrating with an external tool, or automating your workflow, these APIs cover everything you need.
The two APIs
TestMax has two distinct APIs, each serving a different purpose:
Simulator API
Base path: https://api.test-max.com/api/sim/
The Simulator API implements common futures-gateway request shapes. Changing the base URL alone does not migrate a bot: adapt authentication, replay-session setup and the bar loop using the Gateway Compatibility guide.
This is the API you use when writing Python strategies in the Algo Playground or when building standalone trading bots.
Authentication: Bearer token obtained via Auth/loginKey (requires an API key generated in Settings).
Covers: Authentication, accounts, contracts, order placement, positions, trades, historical bars, replay control, and simulated withdrawals in the performance phase.
Playground API
Base path: https://api.test-max.com/api/playground/
The Playground API manages the Algo Playground experience — running backtests, managing saved strategies, browsing templates, and viewing run history.
Authentication: Cookie-based JWT (same session as the web app). No additional API key required.
Covers: Strategy templates, backtest execution, speed control, strategy CRUD, and run history.
Base URL
All API requests are made to:
https://api.test-max.comThe full URL for any endpoint is the base URL plus the API path. For example:
https://api.test-max.com/api/sim/Auth/loginKeyhttps://api.test-max.com/api/playground/templatesStandard response format
Every API response follows a consistent JSON structure:
{ "success": true, "errorCode": 0, "errorMessage": null, ...data}| Field | Type | Description |
|---|---|---|
success | boolean | true if the request succeeded, false if there was an error |
errorCode | number | 0 for success, non-zero for errors |
errorMessage | string or null | Human-readable error description, or null on success |
Additional data fields are included alongside these three fields depending on the endpoint. For example, Account/search returns an accounts array at the top level of the response object.
Authentication overview
The Simulator API uses Bearer token authentication.
- Generate an API key in the TestMax web app under Settings > API Access
- Send a
POSTrequest toAuth/loginKeywith your email and API key - Receive a token in the response
- Include the token in all subsequent requests via the
Authorizationheader
Authorization: Bearer <your-token>Tokens can be refreshed with Auth/validate and invalidated with Auth/logout.
The Playground API uses cookie-based JWT authentication — the same session cookie set when you log into the TestMax web app. No additional API key is needed.
If you are calling the Playground API from a script outside the browser, you will need to include the session cookie in your requests. In practice, most users interact with the Playground API through the web UI, and the cookie is handled automatically.
See the Authentication page for the complete auth flow with code examples.
Rate limits
TestMax enforces the following limits to ensure fair usage:
| Limit | Value |
|---|---|
| Max concurrent backtests per user | 1 |
| Backtest execution timeout | 30 minutes |
| Memory for one backtest | 2 GB for the script and every process it starts together |
| Processes and threads for one backtest | 64 |
| Max strategy script size | 200 KB |
| Playground speed range | 1x to 50x |
Auth/loginKey attempts | 10 per 15 minutes per IP, 5 per 15 minutes per email |
History/retrieveBars requests | 20 per minute per account |
Replay/start calls | 20 per minute per account; at most 10 live replay sessions per account (the 11th answers errorCode 4) |
| Playground CRUD/control endpoints | 100 per minute per user |
| Daily bar budget (bulk loads) | 1,000,000 bars per account per UTC day |
When a rate limit is hit, the API responds with HTTP 429 and a Retry-After header telling you how many seconds to wait.
Trading and replay endpoints (Order/*, Position/*, and Replay/* other than Replay/start) have no per-minute limits — the simulator is designed for rapid-fire order placement and bar stepping within a single session.
The daily bar budget covers bulk loads only: History/retrieveBars and the chart’s own history loads. Stepping a replay (Replay/step) is not billed against it, so a backtest that walks a whole session never exhausts it. Stepping and jumping do count against the separate daily streaming allowance and the per-second egress rate: over either, Replay/step and Replay/jumpTo answer HTTP 429 with a Retry-After; while the session is loading its next data window or another operation holds it, they answer HTTP 503 with Retry-After: 1. Retry both with a bounded backoff — the bundled api() helper does. Exceeding the budget returns HTTP 429 with "Daily data limit reached. Resets at 00:00 UTC." and a Retry-After pointing at the reset. An identical History/retrieveBars request (same contract, window, time range and limit) repeated within 5 minutes is served from cache and is not billed again — re-running a backtest over the same range costs one pull, not one per run.
Getting started
The fastest way to start using the API is through the Algo Playground, where authentication and session setup are handled automatically. If you want to build a standalone bot or integrate directly:
- Create an account at test-max.com
- Generate an API key in Settings > API Access
- Authenticate via
POST Auth/loginKey - Search for accounts via
POST Account/search - Find your contract via
POST Contract/search - Start a replay session via
POST Replay/start - Step through bars and place orders using the Order and Replay endpoints
- End the session via
POST Replay/endto get final results