An actor is a trading identity, a person on your desk, or a bot. Actors are how a team trades a shared venue relationship without sharing a login.
What an actor is
Each actor holds its own API key. That key is minted for one specific actor-and-pod pairing, and identity is taken from the key on every request. An actor cannot claim to be someone else, and cannot reach a pod it was not granted.
An actor working in two pods holds two keys, one per pod. Nothing is shared between them.
What an actor can do
Actor keys are trading keys. An actor can:
- Place orders in its pod
- Read its own orders and fills
- Cancel its own orders
- Read its pod’s balance
Placing, tracking, and cancelling are a single responsibility, so they carry a single grant. There is no arrangement in which an actor can cancel an order it cannot see, and none in which an actor can see another actor’s orders.
Some facts are pod-scoped rather than actor-scoped — the pod’s balance, and the pod’s authoritative position. An actor key can read those for its own pod: the figure describes the pod rather than the actor asking, and an actor trading a pod needs to know what the pod holds. What stays out of reach is another actor’s slice of it. Where a pod-scoped read carries per-actor attribution, that attribution is narrowed to the calling actor — you see your own cost basis and P&L against the pod’s totals, never another desk’s.
Oversight lives in the console, not in actor keys. An admin sees the whole organization: every pod, every actor, and rollups across them. Actor keys deliberately cannot do this.
Attribution
Every order carries the actor that placed it. That gives you, without any additional work:
- Per-actor position, derived from that actor’s own fills
- Per-actor realized and unrealized P&L
- A complete record of who did what, in which pod, at which venue
See Portfolio and positions.
Rotate and revoke
Two operations, and they are not the same thing.
Rotate issues the actor a new key and retires the old one. Same actor, same access, new credential. Use it on a schedule, or when a key may have been exposed.
Revoke withdraws the actor’s access. It takes effect at the front door: subsequent requests on that key are rejected. Revocation is reversible — you can grant the actor back — and it is deliberately soft, because pulling access should never be a decision anyone hesitates over.
What revoking does not do
Revoking an actor does not close its positions. Those positions remain open, and remain the pod’s. Manage them from the console or through another actor in the pod.
Actor states
