Zerodha API - Indian Market Trading Platform

Base path: /api/zerodha Source: src/routes/zerodha.route.ts

Auth & session

Method	Path	Auth	Description
`GET`	`/login`	None	Redirect to Kite login URL, or restart market data if token is already valid
`GET`	`/callback`	None	OAuth callback — exchanges `request_token` for `access_token` and restarts services
`GET`	`/redirect.js`	None	Client-side redirect script served after successful OAuth
`GET`	`/invalidate-access-token`	`isToken()`	Invalidate the current Kite access token
`GET`	`/zerodha-status`	`isToken()`	Return Zerodha connection and login status
`POST`	`/auto-login`	`isToken()`, `isAdmin`	Trigger headless TOTP auto-login
`POST`	`/webhook`	None	Kite order postback webhook handler
`POST`	`/start-market-data`	None	Restart market data streaming if a valid Zerodha token exists in DB

OAuth flow

Client opens GET /api/zerodha/login.
If no valid token, server redirects to Kite login page.
Kite redirects to GET /api/zerodha/callback?request_token=....
Server calls generateAccessToken, persists token to Zerodha collection, runs handlePostZerodhaLogin, and returns an HTML success page.

Orders

Method	Path	Auth	Description
`POST`	`/order`	`isToken()`, `placeOrderValidator`	Place a new order via Kite Connect (or dummy mode)
`POST`	`/closeOrder`	`isToken()`	Close a single open position/order
`POST`	`/bulkSellOrder`	`isToken()`	Bulk sell all open BUY positions for an index
`DELETE`	`/order/:order_id`	`isToken()`, `cancelOrderValidator`	Cancel an order by Kite `order_id`
`GET`	`/orders`	`isToken()`	Fetch order history from Kite
`GET`	`/order/:order_id`	`isToken()`	Fetch a single order by ID

Place order body (validated)

Field	Type	Required	Notes
`indexName`	string	Yes	Index setting key
`right`	`CALL` \| `PUT`	Yes	Option side
`exchange`	string	Yes	`NSE`, `BSE`, `NFO`, `MCX`
`tradingsymbol`	string	Yes	Kite trading symbol
`transaction_type`	`BUY` \| `SELL`	Yes
`quantity`	number	Yes	Positive integer
`product`	string	Yes	`CNC`, `MIS`, `NRML`
`order_type`	string	Yes	`LIMIT`, `MARKET`, `SL`, `SL-M`
`price`	number	No	Required for LIMIT orders
`strikePrice`	number	No
`validity`	string	No	`DAY`, `IOC`
`isScheduled`	boolean	No	Trailing sell flag
`parent_order_id`	string	No	Link to parent BUY order

Account

Method	Path	Auth	Description
`GET`	`/holdings`	`isToken()`	Portfolio holdings from Kite
`GET`	`/positions`	`isToken()`	Day and net positions
`GET`	`/margins`	`isToken()`	Available and utilized margin

Market data

Method	Path	Auth	Description
`GET`	`/quotes`	`isToken()`	Live quotes — pass `symbol` as query param
`GET`	`/instruments`	`isToken()`	Instrument master list from Kite

/login, /callback, /webhook, and /start-market-data are unauthenticated. Protect these endpoints at the network or reverse-proxy level in production.