← Chat Archive

[Tool: skill_view] {"success": true, "name": "navia-broker-api", "description": "Use when touching the Navia broker API.", "tags": ["trading", "broker", "navia", "rust", "positions"], "related_skills": [], "content": "---\nname: navia-broker-api\ndescription: \"Use when touching the Navia broker API.\"\nversion: 1.0.0\nauthor: Hermes Agent\nlicense: MIT\nmetadata:\n hermes:\n tags: [trading, broker, navia, rust, positions]\n---\n\n# Navia Broker API\n\nNavia (naviaapt.navia.co.in:9003) is a DIRECT broker HTTP API — it is NOT an\nOpenAlgo gateway like the other brokers (Flattrade/Shoonya/Kotak). It is a\n`{base}/?Activity=<name>` REST POST API with JSON-style quirks. Used to pull\nthis user's positions/P&L into the positions dashboard.\n\n## Where the pieces live\n- Rust client lib + CLI: `/home/ubuntu/navia-client` (src/client.rs, session.rs).\n- Positions dashboard integration: `/home/ubuntu/positions-dashboard/src/main.rs`\n (`fetch_navia_positions()`).\n- Token store: `~/.navia/session.json` — `{susertoken, uid, obtained_at, uname}`,\n valid 24h.\n\n## Auth — the flow (each call is POST with `Content-Type: application/json`)\n1. **SendOTP** — body `{uid, pwd}`. Headers: `Module:DEFAULT`, `Source:WEB`,\n `AuthToken:DEFAULT`. Returns \"OTP sent to ...\".\n2. **Login** — body `{uid, pwd, otp}`. Same DEFAULT headers (do NOT add\n APIKey/SecretKey here — causes \"Authentication Failed\"). Returns\n `ResponceDataObject.susertoken`.\n3. **Authed calls** (PositionBook, Holdings, OrderBook, etc.) — the working\n header combo is the CRITICAL quirk below.\n\n## CRITICAL quirk — the APIKey header must be ABSENT on data calls\nThe client's `authed_headers()` sends an `APIKey` header. Navia REJECTS\nPositionBook/Holdings with `Status:Failed, Message:\"Authentication Failed\",\nStatusCode:7` whenever `APIKey` is present. Verified by probing 6 header\nvariants in one run.\n\nWorking combo for PositionBook/Holdings:\n- `AuthToken: <susertoken>`\n- `Module: OrderService`\n- `Source: WEB`\n- `SecretKey: <NAVIA_SECRET_KEY>`\n- `Content-Type: application/json`, `Accept: */*`\n- **NO `APIKey` header.**\n\nAlso: server is self-signed + JSON-style → client must use\n`danger_accept_invalid_certs(true)`, `http1_only()`, and resolve\n`naviaapt.navia.co.in` → `103.217.66.206:9003`. Responses may carry a UTF-8 BOM\n(`\\u{feff}`) — strip it before parsing JSON.\n\n## Token persistence (24h reuse, OTP once/day)\nUse `SessionData`/`SessionManager` in `navia-client/src/session.rs`:\n- `SessionData::save()` writes `~/.navia/session.json` (auto-creates dir).\n- `SessionManager::try_stored_session()` loads + verifies and skips OTP if not\n expired (>24h).\n- **Pitfall:** do NOT hand-copy a token from logs into the JSON file — one\n mistyped char silently corrupts it and every authed call fails with\n \"Authentication Failed\". Always let `SessionData::save()` write it.\n\nWhen the token expires, the dashboard's Navia card shows an error. Refresh by\nrunning a lo ... [5196 chars total, truncated]

[Tool: terminal] {"output": "total 12\ndrwxrwxr-x 2 ubuntu ubuntu 4096 Aug 8 22:33 .\ndrwxr-x--x 70 ubuntu ubuntu 4096 Aug 20 12:27 ..\n-rw-rw-r-- 1 ubuntu ubuntu 215 Aug 20 12:45 session.json\n---\n{\n \"susertoken\": \"qdlV1PAoFm0fYYAwveLrYWNkwXncEYALTnEK2bat34Vjq6TeIONOKfLXSNlefvUZtpPOA3UO3SEuZSd6hajpKaAy1YQ1jIQd3Y+bsd4r2kE=\",\n \"uid\": \"96500127\",\n \"obtained_at\": 1787210112,\n \"uname\": \"HARMEET SINGH SIDANA\"\n}\n---\nlive_test.rs\nplace_order_test.rs\nposition_full.rs\nposition_probe.rs\nposition_variants.rs\nverify_token.rs\nCargo.lock\nCargo.toml\nREADME.md\nsrc\ntarget", "exit_code": 0, "error": null}

[Tool: terminal] {"output": "1787283690\nThu Aug 20 12:45:12 IST 2026\n---\n# Navia API Client (Rust)\n\nA Rust client for the Navia trading API, focused on order placement.\n\n## Setup\n\n1. Copy `.env.example` to `.env` and fill in your credentials:\n```\ncp .env.example .env\n```\n\n2. Edit `.env`:\n```\nNAVIA_BASE_URL=https://naviaapt.navia.co.in:9003\nNAVIA_API_KEY=i2CwOz-pQZCNv-nmL3_9IvMUkJwfvagwo4R2PGwQkjk\nNAVIA_UID=YOUR_CLIENT_CODE\nNAVIA_PWD=YOUR_PASSWORD\n```\n\n3. Build and run:\n```\ncargo run\n```\n\n## Authentication Flow\n\nThe Navia API requires OTP-based login:\n\n1. **SendOTP** — sends OTP to your registered mobile/email\n2. **Login** — submit the OTP to get a `susertoken`\n3. The token is automatically stored and used for all subsequent calls\n\n## Available Operations\n\n| Function | Description |\n|---|---|\n| `send_otp()` | Trigger OTP to registered mobile/email |\n| `login(otp)` | Authenticate and store session token |\n| `check_login()` | Verify session is still valid |\n| `place_order(req)` | Place an order (MKT, LIMIT, SL-L, SL-M) |\n| `order_book(traded_only)` | Fetch order book |\n| `trade_book()` | Fetch trade book |\n| `holdings()` | Fetch holdings |\n| `position_book()` | Fetch positions |\n| `cancel_order(cl_ord_id)` | Cancel an order |\n| `modify_order(body)` | Modify an existing order |\n| `get_order_margin(body)` | Check margin requirement |\n| `get_user_info()` | Fetch user info |\n| `logout()` | End session |\n\n## Order Types\n\nThe `PlaceOrderRequest` struct has convenience builders:\n\n- `PlaceOrderRequest::market(...)` — market order\n- `PlaceOrderRequest::limit(...)` — limit order\n- `PlaceOrderRequest::sl_limit(...)` — stop-loss limit\n- `PlaceOrderRequest::sl_market(...)` — stop-loss market\n\n## Usage as a Library\n---\n23: // Full login flow; token saved by the SessionData API (no manual copy/typo risk)\n25: if let Err(e) = client.send_otp().await { eprintln!(\"SendOTP FAILED: {e}\"); std::process::exit(1); }\n28: let login_resp = match client.login(&otp.trim()).await {\n30: Err(e) => { eprintln!(\"Login FAILED: {e}\"); std::process::exit(1); }\n33: let uname = login_resp.responce_data_object.as_ref().and_then(|d| d.uname.clone());", "exit_code": 0, "error": null, "hint": "exit_code 0 here is the status of the last pipeline command (tail/head/cat/...), NOT of the command before the pipe — and the output contains failure indicators. Treat this run as FAILED until proven otherwise: re-run the command WITHOUT the pipe (output is auto-truncated and the full text is saved to a file, so piping through tail/head is never needed) to get the real exit code."}

[Tool: read_file] {"content": "1|use navia_client::{NaviaClient, SessionData};\n2|use reqwest::header::{HeaderMap, HeaderValue, CONTENT_TYPE, ACCEPT};\n3|use std::io::{self, Write};\n4|\n5|const BASE: &str = \"https://naviaapt.navia.co.in:9003\";\n6|\n7|fn d_headers(token: &str, secret: Option<&str>) -> HeaderMap {\n8| let mut h = HeaderMap::new();\n9| h.insert(CONTENT_TYPE, HeaderValue::from_static(\"application/json\"));\n10| h.insert(ACCEPT, HeaderValue::from_static(\"*/*\"));\n11| h.insert(\"AuthToken\", HeaderValue::from_str(token).unwrap());\n12| h.insert(\"Module\", HeaderValue::from_str(\"OrderService\").unwrap());\n13| h.insert(\"Source\", HeaderValue::from_str(\"WEB\").unwrap());\n14| if let Some(s) = secret { h.insert(\"SecretKey\", HeaderValue::from_str(s).unwrap()); }\n15| h\n16|}\n17|\n18|#[tokio::main]\n19|async fn main() {\n20| let _ = dotenvy::dotenv();\n21| let mut client = NaviaClient::new().expect(\"client\");\n22|\n23| // Full login flow; token saved by the SessionData API (no manual copy/typo risk)\n24| println!(\"[1] Sending OTP...\");\n25| if let Err(e) = client.send_otp().await { eprintln!(\"SendOTP FAILED: {e}\"); std::process::exit(1); }\n26| print!(\"Enter OTP: \"); io::stdout().flush().unwrap();\n27| let mut otp = String::new(); io::stdin().read_line(&mut otp).unwrap();\n28| let login_resp = match client.login(&otp.trim()).await {\n29| Ok(r) => r,\n30| Err(e) => { eprintln!(\"Login FAILED: {e}\"); std::process::exit(1); }\n31| };\n32| let token = client.auth_token().unwrap().to_string();\n33| let uname = login_resp.responce_data_object.as_ref().and_then(|d| d.uname.clone());\n34| let session = SessionData::new(token.clone(), client.uid().to_string(), uname);\n35| session.save().expect(\"save session\");\n36| println!(\"[OK] Token saved by API to {} (24h reuse)\", SessionData::default_path().display());\n37|\n38| // Now fetch PositionBook with the fresh token + variant-D auth\n39| let secret = std::env::var(\"NAVIA_SECRET_KEY\").ok();\n40| let uid = client.uid().to_string();\n41| let url = format!(\"{BASE}/?Activity=PositionBook\");\n42| let body = serde_json::json!({ \"uid\": uid, \"actid\": uid });\n43| let hc = reqwest::Client::builder()\n44| .danger_accept_invalid_certs(true).http1_only()\n45| .resolve(\"naviaapt.navia.co.in\", std::net::SocketAddr::from(([103,217,66,206],9003)))\n46| .timeout(std::time::Duration::from_secs(30)).build().unwrap();\n47| match hc.post(&url).headers(d_headers(&token, secret.as_deref())).json(&body).send().await {\n48| Ok(r) => {\n49| let t = r.text().await.unwrap_or_default();\n50| let t = t.strip_prefix('\\u{feff}').unwrap_or(&t).to_string();\n51| if t.contains(\"\\\"Status\\\":\\\"Ok\\\"\") && t.contains(\"Positions\") {\n52| println!(\"[OK] PositionBook fetched. Status Ok.\");\n53| if let Ok(v) ... [3986 chars total, truncated]

[Tool: terminal] {"output": "/home/ubuntu/navia-client/src/session.rs:142: pub async fn try_stored_session(\n/home/ubuntu/navia-client/src/session.rs:202: if let Some(session) = Self::try_stored_session(client).await {\n---\n[package]\nname = \"navia-client\"\nversion = \"0.1.0\"\nedition = \"2021\"\ndescription = \"Navia API client for order placement (Rust)\"\n\n[dependencies]\nreqwest = { version = \"0.12\", features = [\"json\", \"rustls-tls\"], default-features = false }\nserde = { version = \"1.0\", features = [\"derive\"] }\nserde_json = \"1.0\"\ntokio = { version = \"1.0\", features = [\"full\"] }\nthiserror = \"1.0\"\ndotenvy = \"0.15\"\ntracing = \"0.1\"\ntracing-subscriber = { version = \"0.3\", features = [\"env-filter\"] }\n\n[profile.release]\nopt-level = 3\nlto = true---\nlive_test.rs\nplace_order_test.rs\nposition_full.rs\nposition_probe.rs\nposition_variants.rs\nverify_token.rs", "exit_code": 0, "error": null}

[Tool: read_file] {"content": "120| uname,\n121| }\n122| }\n123|}\n124|\n125|/// Session manager that handles the full auth flow with persistence.\n126|///\n127|/// Typical usage:\n128|/// 1. `SessionManager::get_or_login()` — tries stored token, falls back to OTP login\n129|/// 2. If token is invalid (CheckLogin fails), automatically triggers re-login\n130|/// 3. Token is persisted for next run\n131|pub struct SessionManager;\n132|\n133|impl SessionManager {\n134| /// Try to use a stored session token. Returns Some((client, session)) if valid.\n135| ///\n136| /// This does NOT do an OTP login. It:\n137| /// 1. Loads the session file\n138| /// 2. Checks if the token is expired (> 24h)\n139| /// 3. If not expired, sets the token on the client\n140| /// 4. Verifies with CheckLogin (but tolerates IP-block errors)\n141| /// 5. Returns the client if token is not expired\n142| pub async fn try_stored_session(\n143| client: &mut crate::client::NaviaClient,\n144| ) -> Option<SessionData> {\n145| let session = SessionData::load()?;\n146|\n147| if session.is_expired() {\n148| eprintln!(\"[Session] Stored token is expired (age: {}), need re-login\", session.age_human());\n149| return None;\n150| }\n151|\n152| eprintln!(\"[Session] Found stored token (age: {}), verifying...\", session.age_human());\n153|\n154| // Set the token on the client\n155| client.set_auth_token(session.susertoken.clone());\n156|\n157| // Verify with CheckLogin — but tolerate IP-block errors\n158| // Navia's IP whitelist may block CheckLogin while still\n159| // allowing the token to be valid for other calls\n160| match client.check_login().await {\n161| Ok(resp) => {\n162| let logged_in = resp.message.as_deref().map(|m| m.eq_ignore_ascii_case(\"LoggedIn\")).unwrap_or(false);\n163| if logged_in {\n164| eprintln!(\"[Session] Stored token is VALID — skipping OTP login\");\n165| return Some(session);\n166| }\n167|\n168| // Check if it's an IP address error — token might still be valid\n169| let is_ip_error = resp.message.as_deref()\n170| .map(|m| m.contains(\"IP address\"))\n171| .unwrap_or(false);\n172|\n173| if is_ip_error {\n174| eprintln!(\"[Session] CheckLogin blocked by IP restriction — using stored token anyway\");\n175| return Some(session);\n176| }\n177|\n178| eprintln!(\"[Session] CheckLogin returned: {:?} {:?} — token invalid, need re-login\", resp.status, resp.message);\n179| None\n180| }\n181| Err(e) => {\n182| let err_str = e.to_string();\n183| if err_str.contains(\"IP address\") {\n184| ... [4992 chars total, truncated]

[Tool: terminal] {"output": "20:pub struct NaviaClient {\n35: pub fn new() -> Result<Self, NaviaError> {\n60: pub fn with_credentials(base_url: &str, api_key: &str, uid: &str, pwd: &str) -> Result<Self, NaviaError> {\n80: pub fn set_auth_token(&mut self, token: String) {\n85: pub fn auth_token(&self) -> Option<&str> {\n89: pub fn uid(&self) -> &str {\n176: pub async fn send_otp(&self) -> Result<SendOtpResponse, NaviaError> {\n216: pub async fn login(&mut self, otp: &str) -> Result<LoginResponse, NaviaError> {\n262: pub async fn check_login(&self) -> Result<CheckLoginResponse, NaviaError> {\n270: pub async fn logout(&self) -> Result<serde_json::Value, NaviaError> {\n282: pub async fn place_order(&self, req: &PlaceOrderRequest) -> Result<PlaceOrderResponse, NaviaError> {\n300: pub async fn order_book(&self, only_traded: bool) -> Result<OrderBookResponse, NaviaError> {\n312: pub async fn cancel_order(&self, cl_ord_id: &str, ordno: Option<&str>) -> Result<CancelOrderResponse, NaviaError> {\n325: pub async fn modify_order(&self, body: &serde_json::Value) -> Result<serde_json::Value, NaviaError> {\n336: pub async fn holdings(&self) -> Result<serde_json::Value, NaviaError> {\n347: pub async fn position_book(&self) -> Result<serde_json::Value, NaviaError> {\n358: pub async fn trade_book(&self) -> Result<serde_json::Value, NaviaError> {\n369: pub async fn get_order_margin(&self, body: &serde_json::Value) -> Result<serde_json::Value, NaviaError> {\n376: pub async fn get_user_info(&self) -> Result<serde_json::Value, NaviaError> {", "exit_code": 0, "error": null}

[Tool: write_file] {"bytes_written": 1747, "dirs_created": true, "verified": true, "lint": {"status": "error", "output": "error[E0670]: `async fn` is not permitted in Rust 2015\n --> /home/ubuntu/navia-client/src/bin/login_check.rs:7:1\n |\n7 | async fn main() -> ExitCode {\n | ^^^^^ to use `async fn`, switch to Rust 2018 or later\n |\n = help: pass `--edition 2024` to `rustc`\n = note: for more on editions, read https://doc.rust-lang.org/edition-guide"}, "resolved_path": "/home/ubuntu/navia-client/src/bin/login_check.rs", "files_modified": ["/home/ubuntu/navia-client/src/bin/login_check.rs"]}

[Tool: terminal] {"output": "fs::write(path, json)\n .map_err(|e| NaviaError::Config(format!(\"Failed to write session file: {}\", e)))?;\n Ok(())\n }\n\n /// Delete the session file (force re-login on next run).\n pub fn clear() -> Result<(), NaviaError> {\n let path = Self::default_path();\n if path.exists() {\n fs::remove_file(&path)\n .map_err(|e| NaviaError::Config(format!(\"Failed to delete session file: {}\", e)))?;\n }\n Ok(())\n }\n\n /// Create new session data from a login response.\n pub fn new(susertoken: String, uid: String, uname: Option<String>) -> Self {\n let obtained_at = SystemTime::now()\n .duration_since(UNIX_EPOCH)\n .map(|d| d.as_secs())\n .unwrap_or(0);\n Self {\n susertoken,\n uid,\n obtained_at,\n uname,\n }\n }\n}\n\n/// Session manager that handles the full auth flow with persistence.\n60: pub fn age_human(&self) -> String {\n148: eprintln!(\"[Session] Stored token is expired (age: {}), need re-login\", session.age_human());\n152: eprintln!(\"[Session] Found stored token (age: {}), verifying...\", session.age_human());", "exit_code": 0, "error": null}

[Tool: terminal] {"output": "NAVIA_BASE_URL\nNAVIA_API_KEY\nNAVIA_SECRET_KEY\nNAVIA_UID\nNAVIA_PWD\n---\n Finished `release` profile [optimized] target(s) in 0.26s", "exit_code": 0, "error": null, "cwd": "/home/ubuntu/navia-client"}

[Tool: terminal] {"output": "Background process started", "session_id": "proc_7b83d3a65266", "pid": 2135030, "exit_code": 0, "error": null, "hint": "background=true without notify_on_complete=true means this process runs SILENTLY — you will not be told when it exits. If this is a bounded task (test suite, build, CI poller, deploy, anything with a defined end), you almost certainly wanted notify_on_complete=true so the system pings you on exit. Re-launch with notify_on_complete=true, or call process(action='poll') / process(action='wait') yourself to learn the outcome. Only ignore this hint for genuine long-lived processes that never exit (servers, watchers, daemons)."}

[Tool: process] {"session_id": "proc_7b83d3a65266", "command": "cd /home/ubuntu/navia-client && ./target/release/verify_token", "status": "running", "pid": 2135030, "uptime_seconds": 2, "output_preview": "[1] Sending OTP...\r\n[DEBUG send_otp] URL: https://naviaapt.navia.co.in:9003/?Activity=SendOTP\r\n[DEBUG send_otp] Body: {\"uid\":\"96500127\",\"pwd\":\"Gobind@10\"}\r\n[DEBUG send_otp] HTTP status: 200 OK\r\n[DEBUG send_otp] Body (first 300): {\"Status\":\"OK\",\"Message\":\"OTP sent to ********21 and har***********@*****.***\",\"StatusCode\":0,\"RequestID\":\"e3f9c938-0a86-4d39-9009-7820ff307a65\",\"Responce\":null,\"ResponceDataObject\":{\"DealerUCC\":\"96500127\",\"DealerStatus\":1,\"ClientType\":3,\"request_time\":\"09:12:06:9576 21-08-2026\",\"rpt\":null,\"status\":\r\n[DEBUG send_otp] Parsed status: Some(\"OK\")\r\n[DEBUG send_otp] Parsed message: Some(\"OTP sent to ********21 and har***********@*****.***\")\r\nEnter OTP: "}

[Tool: process] {"status": "ok", "bytes_written": 7}

[Tool: process] {"status": "exited", "command": "cd /home/ubuntu/navia-client && ./target/release/verify_token", "exit_code": 0, "completion_reason": "exited", "termination_source": "", "output": "[1] Sending OTP...\r\n[DEBUG send_otp] URL: https://naviaapt.navia.co.in:9003/?Activity=SendOTP\r\n[DEBUG send_otp] Body: {\"uid\":\"96500127\",\"pwd\":\"Gobind@10\"}\r\n[DEBUG send_otp] HTTP status: 200 OK\r\n[DEBUG send_otp] Body (first 300): {\"Status\":\"OK\",\"Message\":\"OTP sent to ********21 and har***********@*****.***\",\"StatusCode\":0,\"RequestID\":\"e3f9c938-0a86-4d39-9009-7820ff307a65\",\"Responce\":null,\"ResponceDataObject\":{\"DealerUCC\":\"96500127\",\"DealerStatus\":1,\"ClientType\":3,\"request_time\":\"09:12:06:9576 21-08-2026\",\"rpt\":null,\"status\":\r\n[DEBUG send_otp] Parsed status: Some(\"OK\")\r\n[DEBUG send_otp] Parsed message: Some(\"OTP sent to ********21 and har***********@*****.***\")\r\nEnter OTP: 472816\r\n[DEBUG login] URL: https://naviaapt.navia.co.in:9003/?Activity=Login\r\n[DEBUG login] Body: {\"uid\":\"96500127\",\"pwd\":\"Gobind@10\",\"otp\":\"472816\"}\r\n[DEBUG login] HTTP status: 200 OK\r\n[DEBUG login] Response (first 500): {\"Status\":\"OK\",\"Message\":\"Authendication Success\",\"StatusCode\":0,\"RequestID\":\"c09f5221-6d4c-48c2-8c77-7a292cd4a5be\",\"Responce\":null,\"ResponceDataObject\":{\"susertoken\":\"qdlV1PAoFm0fYYAwveLrYfG6m8OTv4f57rfMt9hT4MWJljZbdHnN4dy0Jho5mgx0oL6CCJveHQrxm5DdaoNtVUewcRbl3kYuwnqFn4jSx+Q=\",\"AuthorizedActivity\":null,\"values\":{\"92205\":\"stocks\",\"72180\":\"DEFAULT\"},\"mws\":{\"92205\":[{\"MarketWatchId\":92205,\"MarketWatchName\":\"stocks\",\"exch\":\"NSE\",\"token\":764553,\"tsym\":\"DHOOTTRANS-EQ\",\"Segment\":\"1\",\"instname\":\"EQ\",\"pp\r\n[DEBUG login] Token received (first 30): qdlV1PAoFm0fYYAwveLrYfG6m8OTv4...\r\n[OK] Token saved by API to /home/ubuntu/.navia/session.json (24h reuse)\r\n[OK] PositionBook fetched. Status Ok.\r\n 3 positions:\r\n KAYNES-EQ | qty 3 | avg 3828.76 | lp 3822.0 | mtm(pnl) -20.27 | rpnl 0.0\r\n JYOTICNC-EQ | qty 25 | avg 960.99 | lp 948.0 | mtm(pnl) -324.81 | rpnl 0.0\r\n AGIIL-EQ | qty 100 | avg 303.18 | lp 309.0 | mtm(pnl) 582.5 | rpnl 0.0\r\n\r\n=== done (token now reusable for 24h, no more OTP today) ===\r\n"}