Developers

Build on the mxrealstake API

Scoped API keys, signed outbound webhooks, and a REST surface covering properties, orders, portfolios, and lifecycle events.

Authentication

Partner access uses scoped API keys. Request a key from your platform admin — it is shown once and stored hashed. Send it with every request via X-API-Key or as Bearer mxk_…. Scopes are least-privilege: each endpoint requires its ownresource:action scope.

curl -H "X-API-Key: mxk_..." \
https://mxrealstake.mimeld.com/api/v1/developer/properties

Scoped endpoints

GET/api/v1/developer/propertiesproperties:read

Live property feed — name, city, country, type, yield, funding progress. Paginated.

query: status, page, pageSize

GET/api/v1/developer/ordersorders:read

Order feed for the investor bound to your API key. Paginated.

query: page, pageSize

GET/api/v1/developer/portfolioportfolio:read

Holdings (SPV shares, ownership %, acquisition dates) for the bound investor.

query: —

1 live properties currently in the feed.

SDK pattern

A stable fetch shape — wrap this in your language of choice. Responses are JSON; errors are { error, code } with the matching HTTP status.

// Minimal fetch wrapper — the pattern any SDK wraps
const key = process.env.MXREALSTAKE_API_KEY // mxk_...
const res = await fetch('https://mxrealstake.mimeld.com/api/v1/developer/properties?status=live', {
  headers: { 'X-API-Key': key },
})
const { items, total } = await res.json()

Outbound webhooks

Subscribe an endpoint and the platform pushes signed events on lifecycle transitions — order allocations, payments, trades, distributions, exits. Each delivery retries with backoff (up to 5 attempts) and carries HMAC-SHA256 verification headers.

Delivery headers

X-MX-Event: event name (e.g. INVESTMENT_ALLOCATED)
X-MX-Timestamp: unix seconds
X-MX-Signature: sha256=<hmac(timestamp + '.' + body, secret)>
X-MX-Delivery: delivery id (dedupe key)

Events

INVESTMENT_ALLOCATEDOrder confirmed and shares allocated
PAYMENT_COMPLETEDDeposit or order payment settled
PAYMENT_FAILEDPayment attempt failed
TRADE_EXECUTEDMarketplace trade matched
DISTRIBUTION_PAIDRental distribution settled to wallets
EXIT_SETTLEDExit/redemption paid out
KYC_APPROVEDIdentity verification approved
KYC_REJECTEDIdentity verification rejected
ACCREDITATION_EXPIREDAccreditation window lapsed

Verify signatures

// Verify a signed webhook delivery (Node.js)
import { createHmac } from 'crypto'

const expected = 'sha256=' + createHmac('sha256', secret)
  .update(timestamp + '.' + rawBody)
  .digest('hex')
if (headers['x-mx-signature'] !== expected) throw new Error('bad signature')
if (Math.abs(Date.now()/1000 - +timestamp) > 300) throw new Error('stale')

Get a key

API keys are issued by platform admins. Contact your account manager or file a partner request — each key is scoped and can be revoked independently.