CME Globex Order Entry Web Service APIs

Clients now have access to CME Group futures and options on the new Order Entry suite of APIs - Hosted by Google Cloud. This solution is accessible over the public internet without the commitment of leased line or colocation investments. RESTful and WebSocket APIs with full order routing and instrument creation functionality deliver real-time trading and market access. This lightweight product is optimized for the needs of less latency sensitive traders and algorithms, while still offering fulsome functionality and utilizing the full suite of CME Globex risk and credit controls.

The OE APIs are made up of two Web Service APIs; RESTful and WebSocket. These APIs support:

Order Submission and Modifications
Spread Creation (UDS) and Request for Quotes (RFQ) Capabilities
Order and Trade information

Contents

Revision History

Date	Description
October 30, 2024	Key Events and Dates Production date updated to "To Be Announced".
April 22, 2024	Updated Message Spec table
April 1, 2024	Updated Key Events and Request Throttles
March 27, 2024	Updated Production Milestone Date
February 21,2024	Updated Web Socket API table
December 14, 2023	Added FAK/FOK and Stop Order content
November 28, 2023	Message Specification Websocket Connection update
November 27, 2023	Updated Product and Instrument Referential Data section
October 30, 2023	Initial Release

Key Events and Dates

Include all necessary milestones. Delete any unnecessary milestones.

Date	Milestone
Available Now	New Release
Available Now	AutoCert+
To Be Announced	Production

Testing and Certification

Customers are required to certify in New Release before accessing the APIs in Production.

Contact Global Account Management (GAM) for more information on certification.

Contact Certification Support for Electronic Trading (CSET) for assistance with testing and certification.

Onboarding and Entitlements

Client Onboarding

Authorization and Entitlement

A registered OAuth API ID is required to access the CME OE API services. API IDs for CME Group Logins are created and managed in the CME Customer Center - My Profile menu. Client API IDs must also be entitled prior to accessing CME OE APIs.

Complete the step(s) that are applicable to your account:

New Clients	Clients with Existing CME Group Logins
Create a CME Group Login. After creating and activating a CME Group Login ID, login to CME Customer Center under My Profile and create an OAuth API ID. Client API IDs must be entitled. To request access to the CME OE APIs, contact Global Account Management (GAM).	Login to CME Customer Center and under My Profile create an OAuth API ID. Client API IDs must be entitled. To request access to the CME OE APIs, contact Global Account Management (GAM).

CME Group requires customers to create unique OAuth API IDs for the each environment.

Entitlements and Roles

To request entitlements be added to the API IDs, contact Global Account Management (GAM) requesting role assignments to New Release and Production API IDs.

All OE API IDs must have a specific role assigned:

CME Globex Order Submitter
- Can submit orders
- Can request order status
CME Globex Order Viewer
- Can request order and trade status

Product and Instrument Referential Data

OE API does not support instrument referential data or market data. Clients must obtain instrument referential data, and market data if desired, from one of the many other services offered by CME Group:

Referential Data APIs

Reference Data API
Reference Data Warehouse on Google Cloud

OWASP Compliance

The OE APIs are hosted on Google Cloud and protected by Google Cloud Armor with preconfigured Web Application Firewall(WAF) rules leveraging the OWASP Top 10 rules.

Customers must test their applications' compliance with the OWASP Top 10 rules in the New Release environment to ensure no Production issues occur.

Access CME OE APIs on Google Cloud

To access the CME OE API Web Services in the New Release and Production environments, an OAuth API ID and access token are required.

OAuth 2.0 Authorization Server Access Token Retrieval Endpoints

The below Endpoints are available to request and refresh access tokens in the New Release and Production environments.

OAuth 2.0 Authorization Server Endpoints
Detail	New Release	Production
OAuth Token Endpoint	https://authnr.cmegroup.com/as/token.oauth2	https://auth.cmegroup.com/as/token.oauth2

Tokens will expire after 30 minutes.

Connectivity Methods

Once clients have completed onboarding and granted entitlements they can access the OE APIs. OE APIs support the following API protocols:

OE API supports HTTPS RESTful connections over the internet.
WebSocket API supports WSS connections over the internet.

Base URL for OE APIs

HTTPS RESTful API

The value from the Path column with environment specific Base URL prefix will be a specific end point for the HTTPS call.
Each HTTPS call must have the header parameter "Authorization" with value "Bearer" pre-pended to the OAuth token (including a space separator).
example: "Bearer <Oauth Access token>"

Environment	Base URL
New Release	https://markets.api.uat.cmegroup.com/orderentry/v2
Production	https://markets.api.cmegroup.com/orderentry/v2

Web Socket API

Web Socket Initiation must have the header parameter "Authorization" with value "Bearer" pre-pended to the OAuth token (including a space separator).
example: "Bearer <Oauth Access token>"

Environment	Base URL
AutoCert+ Certification	wss://markets.api.uat.cmegroup.com/autocert/orderentry
New Release	wss://markets.api.uat.cmegroup.com/orderentry/v2
Production	wss://markets.api.cmegroup.com/orderentry/v2

Message Specifications

The business message specifications for CME OE APIs are available at Order Entry API V2

HTTPS RESTful Web Service			Web Socket
Name	Path	Method	Message	Description
Establish Websocket connection	/order/events	`GET`		Establish Websocket connections to the Order Entry Service with capability to configure Cancel on Disconnect preferences for the session. Cancel on Disconnect will not be enabled when no parameters are provided on connect All required parameters need to be provided to enable Cancel on Disconnect functionality.
Submit Order	/order/new	`POST`	Submit Order	Submit a new order.
Cancel Order	/order/cancel	`PUT`	Cancel Order	Cancel a working order by the Venue Order ID and/or Customer Order ID.
Update Order	/order/update	`PUT`	Update Order	Update a working order by the Venue Order ID and/or Customer Order ID.
Get Order Status	/order/status	`POST`	Get Order Status	Get order status for single (or multiple) working order(s).
Search for Trades	/trades/search	`POST`	Search For Trades	Request a trade record using custom criteria. Based on query parameters, one or more trades may be returned.
Mass Order Cancel	/order/cancel-mass	`PUT`	Mass Order Cancel	Submit mass order cancel request.
Create Instrument	/instruments	`POST`	Create Instrument	Submit new tradeable instrument request
Submit Request For Quote	/quotes/new	`POST`	Submit Request For Quote	Solicit a quote on an instrument.
			Heartbeat	Applicable only to Web Socket connections. Heartbeat is sent by the server every 5 seconds. No Heartbeat requirement from the client system.
			Order Expired	Applicable only to Web Socket connections. Asynchronous order status message indicating order expiry.
			Trade Fill	Applicable only to Web Socket connections. Asynchronous order message indication fills.
			Business Reject	Business reject is sent when inbound client message fails business logic.

Technical Considerations

WebSocket inbound messages contain sequence numbers. If a gap is detected, customers should disconnect and reconnect. Once reconnected a order status or trade search message should be sent.
WebSocket customers will receive heartbeats from Order Entry Service every 5 seconds to ensure connectivity.
Clients on the WebSocket API should receive a message at least once every 5 seconds. If you have not received any message for 15 seconds, please disconnect and re-connect to ensure a stable instance. Clients can use Order Status and Trade Search to recover any possible missed information.

Cancel on Disconnect

Only available for WebSocket connections.
Cancel on Disconnect capability must be established during WebSocket initialization request.
Upon ungraceful disconnect, (non GT) resting orders for registered ExecutionFirmID, AccountID and OperatorID will be removed from the book.

Fill and Kill (FAK) and Fill or Kill (FOK) Order Duration Types

When FOK order duration type is sent, customers should be aware of the response. Customers will receive an order status with duration type Fill and Kill (FAK) and minimum quantity integer equal to total order quantity.

FOK orders must be fully filled immediately, or the entire order is canceled with an order status of expired.
FAK orders are immediately executed against resting orders. If the order cannot be fully filled, the remaining balance is canceled with an order status of expired. A minimum quantity can be specified. If the specified minimum quantity cannot be filled, the order is cancelled with a status of expired.

Stop Orders

When Stop orders (with protection) are sent, customers should be aware of the response:

Customer submits a New Order message with order type as STOP with stop price.
When a Stop order (with protection) order is accepted, a message is returned with type as STOP LIMIT.

Post-Trade Instructions

More information on Post-Trade Instructions will be available soon.

Special Character Restrictions

OE APIs support alphanumeric characters in the Customer Order Id and Customer Account Id fields with a specific number of allowable special characters.

Operator ID - This value represents the individual or team submitting the message and is subject to registration requirements and character limits as required by CME Group -Rule-576 Advisory.

Customer Account ID - A unique account identifier in Execution Firm accounts.

See RMI Accounts with Special Characters documentation for a complete list of allowable special characters.

Request Throttles

Order Management, User-Defined Instrument and Query Status services are throttled as follows:

The Order Entry and User-Defined Instrument APIs are limited to 8 post per second for each API.
The Order Query Status API is limited to 8 total concurrent requests.
Any call that exceeds these limits will result in a Response Code 429 (rate limit has been exhausted) .

Sample messages

RESTful WebSerivce

Crude Oil futures LIMIT order submitted for a quantity of 4 at a price of 2025

{

"header": {

"messageType": "ORDNEW",

"applicationName": "OEAPI",

"applicationVendor": "CME",

"applicationVersion": "1.0.0",

"requestId": "498",

"sentTime": "2023-08-23T18:52:37.098136467Z"

},

"payload": {

"customerOrderHandlingInstr":"CLIENT_ELECTRONIC",

"customerOrderId": "AB-12345",

"displayQtyInt": 4,

"durationType": "DAY",

"entities": {

"operatorId": "SENDER_ID_1",

"senderCountry": "US",

"senderState": "NY",

"executingFirmId": "123",

"customerAccountId": "456",

"customerType": "MEMBER_OWN",

"customerOriginType": "CUSTOMER"

},

"instrument": {

"glbxSecurityId": 112233

},

"manualInd": "YES",

"memo": "comments",

"minimumQtyInt": 0,

"price": 2025,

"qtyInt": 4,

"selfMatchPreventionId": "-1",

"selfMatchPreventionInstr": "CANCEL_NEWEST",

"sideInd": "SELL",

"type": "LIMIT"

}

{

"header": {

"requestId": "498",

"sentTime": "2023-08-23T18:52:37.640499845Z"

},

"payload": {

"action": "NEW",

"customerOrderHandlingInstr": "CLIENT_ELECTRONIC",

"customerOrderId": "AB-12346",

"displayQtyInt": 4,

"durationType": "DAY",

"entities": {

"customerAccountId": "123",

"customerOriginType": "CUSTOMER",

"customerType": "MEMBER_OWN",

"executingFirmId": "456",

"operatorId": "SENDER_ID_1",

"senderCountry": "US",

"senderState": "NY"

},

"instrument": {

"glbxSecurityId": 112233

},

"manualInd": "YES",

"price": 2025,

"qtyInt": 4,

"sideInd": "SELL",

"status": "NEW",

"transactionTime": "2023-08-23T18:52:37.098136467Z",

"type": "LIMIT",

"venueExecutionId": "80000:79999",

"venueOrderId": "123456123456"

}

WebSocket

Crude Oil futures LIMIT order submitted for a quantity of 4 at a price of 2025

Includes Heartbeat messages with sequence numbers

{"header":{"messageType":"HEARTBEAT","sentTime":"2023-08-24T22:26:08.916Z","sequenceNbr":"5"},"payload":{"status":"CONNECTED"}}
17:26:08

{"header":{"messageType":"HEARTBEAT","sentTime":"2023-08-24T22:26:03.916Z","sequenceNbr":"4"},"payload":{"status":"CONNECTED"}}