Order Book

The order book holds your own trading venue's order flow: every order your clients placed, and what happened to it. Once it is stored you can browse it, link each of your client ids to a Seqlense identity, and scan it for order-book market abuse (spoofing, layering, wash trading).

You feed it by importing rows from your exchange exports. See Importing order flow for the full flow.

Concepts

Amounts are stored exactly, with 18 decimal places and no floating point, and returned as strings ("0.0001", not 0.0001). Compare them as strings or with a decimal library.

Everything is scoped to your workspace: a development key sees only the development order book.

Reading what is stored

Totals and coverage

GET /v1/orderbook/summary returns the workspace totals, the 50 most active books, and how much of the flow has a name on it:

curl -H "Authorization: Bearer sq_YOUR_API_KEY" \
    "https://monitoring.seqlense.com/api/v1/orderbook/summary"

{
  "totals": { "events": 12400, "orders": 6150, "clients": 214, "instruments": 9, "venues": 2,
              "first_event": "2025-12-29T12:35:39+00:00", "last_event": "2026-04-20T09:44:17+00:00" },
  "instruments": [
    { "venue": "BYBIT", "instrument": "ETH/USDC", "events": 5100, "orders": 2540,
      "clients": 88, "cancels": 1210, "last_event": "2026-04-20T09:40:02+00:00" }
  ],
  "coverage": { "exact": true, "clients": 214, "matched": 40, "mapped": 42, "stale": 2, "pct": 19 }
}

Books

GET /v1/orderbook/books lists up to 200 books, most active first, with the same fields as instruments above.

Events

GET /v1/orderbook/events returns one page of events, newest first, plus the total behind your filters. All filters are optional and combined:

curl -G -H "Authorization: Bearer sq_YOUR_API_KEY" \
    "https://monitoring.seqlense.com/api/v1/orderbook/events" \
    --data-urlencode "instrument=ETH/USDC" \
    --data-urlencode "event_type=CANCEL" \
    --data-urlencode "from=2026-04-01T00:00:00Z" \
    --data-urlencode "limit=100"

The response carries events, total, limit, offset, and an identities map: for each client id on the page that is linked, its identity id, type and display_name.

Putting a name on a client id

A client id on its own names nobody: an alert on POSTG0000114 is not something an analyst can act on. Linking it to an identity fixes that everywhere the client appears.

curl -H "Authorization: Bearer sq_YOUR_API_KEY" \
    "https://monitoring.seqlense.com/api/v1/orderbook/clients?status=unmatched&limit=200"

{
  "clients": [
    { "client_id": "POSTG0000127", "events": 40, "orders": 20, "venues": 1, "instruments": 1,
      "first_event": "2026-03-21T08:00:00+00:00", "last_event": "2026-03-21T09:00:00+00:00",
      "identity": null, "tags": [] }
  ],
  "linked": 0,
  "total": 1,
  "status": "unmatched",
  "filter_applied": true
}

curl -X POST -H "Authorization: Bearer sq_YOUR_API_KEY" \
    -H "Content-Type: application/json" \
    "https://monitoring.seqlense.com/api/v1/orderbook/link-identity" \
    -d '{"client_id": "POSTG0000127", "identity_id": "8a1d2c3b-4e5f-4a6b-9c7d-0e1f2a3b4c5d"}'

{ "linked": true, "client_id": "POSTG0000127", "identity_id": "8a1d2c3b-4e5f-4a6b-9c7d-0e1f2a3b4c5d" }

A few rules worth knowing:

• One identity, many client ids. A person trading under a separate id per venue or sub-account is the normal case. Link each id to the same identity.
• Linking moves. A client id has at most one identity. Linking one that is already linked replaces the previous match, no unlink needed.
• Unlinking never fails on a client id that was not linked:

curl -X DELETE -H "Authorization: Bearer sq_YOUR_API_KEY" \
    "https://monitoring.seqlense.com/api/v1/orderbook/link-identity?client_id=POSTG0000127"

• Links outlive events. Rolling back or purging events keeps the links; they show up as stale in the summary until matching events come back.
• Nothing is matched automatically. Every link is a decision you make.

Starting over

POST /v1/orderbook/imports/rollback removes the events of one import (see Importing).

POST /v1/orderbook/purge deletes every event and the whole import history of the workspace. Mapping profiles and client links are kept. To confirm, send your workspace's exact tenancy key, the name GET /v1/hello greets you with (it ends in __dev in the development workspace):

curl -X POST -H "Authorization: Bearer sq_YOUR_API_KEY" \
    -H "Content-Type: application/json" \
    "https://monitoring.seqlense.com/api/v1/orderbook/purge" \
    -d '{"confirm": "acme"}'

{ "purged": true, "events_removed": 12400, "imports_removed": 7 }

Every endpoint, with its full schema, is in the API reference.