BlackArrow API integration services (Nelogica / OpenFinance)

Deliverables checklist

• API specification in OpenAPI / Swagger for every exposed endpoint
• Protocol & auth flow report — login, token refresh, session/cookie chain, request signing
• Runnable source code (Python and/or Node.js) for login, trade history, statement and market-data calls
• Normalization layer mapping multiple broker back ends to one BlackArrow account schema
• Automated test suite plus Postman / HTTPie collections
• Compliance notes: LGPD data handling, CVM/B3 context, MiFID II investor-protection pointers, retention guidance

API example: account login (pseudocode)

// Step 1 - exchange app credentials for a session token
POST /api/v1/blackarrow/auth/login
Content-Type: application/json

{
  "broker": "nelogica-partner-xyz",
  "username": "TRADER_LOGIN",
  "password": "********",
  "device_id": "of-lab-connector-01"
}

// Response
HTTP/1.1 200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_9f2c...",
  "expires_in": 3600,
  "accounts": [
    { "account_id": "BA-77421", "type": "live", "currency": "USD" },
    { "account_id": "BA-77422", "type": "demo", "currency": "BRL" }
  ]
}

// On 401: { "error": "invalid_credentials" }  -> re-prompt
// On 423: { "error": "device_not_bound" }     -> run device-binding flow first

1 · Monthly statement export for accounting

Context: a trading firm needs each trader's monthly statement inside its accounting/ERP system. Data/API: GET /accounts/{id}/statement?from=&to= returning cash movements, commissions and realized P&L; GET /accounts/{id}/trades for the fill ledger. OpenFinance mapping: behaves like an account-information request — read-only, consent-scoped, paginated — so the same connector can be slotted next to bank-statement feeds in a unified ledger.

2 · Prop-firm risk desk live exposure

Context: a prop firm must see aggregate exposure across hundreds of funded BlackArrow accounts in near real time. Data/API: GET /accounts/{id}/positions plus a webhook on new fills and stop adjustments. OpenFinance mapping: an event-driven "transaction notification" pattern — each fill is pushed, deduplicated by exec_id, and folded into a firm-wide risk view with drawdown limits.

3 · Copy-trading / signal mirroring

Context: a signal provider runs strategies in BlackArrow and wants followers' accounts to mirror them. Data/API: stream of executions and order changes from the master account; downstream order placement happens through each follower's own broker connection. OpenFinance mapping: read on the master side, authorized write on the follower side, with full consent and audit trails on both legs.

4 · Tax & compliance reporting

Context: year-end capital-gains and transaction reports for individual traders. Data/API: full-year trades and statement pulls, joined with the instrument catalogue for asset classification. OpenFinance mapping: a bulk, immutable export with checksums — the same shape regulators expect for transaction reporting, exportable to CSV/PDF for filing.

5 · Analytics & backtesting data lake

Context: a quant team wants BlackArrow fills, equity curves and OHLCV candles in its data warehouse. Data/API: incremental trades and equity deltas plus historical candles per timeframe, landed via an ingestion job. OpenFinance mapping: scheduled bulk extraction with watermarking, feeding the same lake that holds open-banking and market-data sources for cross-dataset analysis.

6 · Unified multi-platform portfolio view

Context: a wealth dashboard that already shows MetaTrader and broker accounts needs BlackArrow holdings too. Data/API: positions + balance normalized to the dashboard's canonical schema. OpenFinance mapping: account-aggregation — one more "account provider" behind the same consent and refresh mechanics the dashboard already uses.

Statement query (request / response)

POST /api/v1/blackarrow/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "account_id": "BA-77421",
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "include":   ["trades", "cash", "fees"],
  "page": 1,
  "page_size": 200
}

// Response (truncated)
{
  "account_id": "BA-77421",
  "currency": "USD",
  "opening_balance": 25140.55,
  "closing_balance": 27890.12,
  "realized_pnl": 2974.40,
  "items": [
    { "ts": "2026-04-03T13:22:07Z", "kind": "trade",
      "symbol": "WINFUT", "side": "buy", "qty": 2,
      "price": 130245.0, "fee": -1.20, "exec_id": "EX-5512" },
    { "ts": "2026-04-03T13:41:55Z", "kind": "trade",
      "symbol": "WINFUT", "side": "sell", "qty": 2,
      "price": 130980.0, "fee": -1.20, "exec_id": "EX-5513" }
  ],
  "next_page": null
}

Fill webhook (push callback)

POST https://your-app.example/hooks/blackarrow
X-OFLab-Signature: sha256=8d2a...   // HMAC over raw body
Content-Type: application/json

{
  "event": "order.filled",
  "account_id": "BA-77421",
  "exec_id": "EX-5512",
  "symbol": "WINFUT",
  "side": "buy",
  "qty": 2,
  "price": 130245.0,
  "oco_group": "OCO-118",
  "trailing_stop": { "active": true, "distance": 150 },
  "ts": "2026-04-03T13:22:07Z"
}

// You MUST verify X-OFLab-Signature, then 200 within 5s.
// Retries: exponential backoff up to 24h; dedupe on exec_id.

Market Monitor snapshot (Python client)

import requests

S = requests.Session()
S.headers["Authorization"] = f"Bearer {ACCESS_TOKEN}"

def watchlist(account_id, name="Default"):
    r = S.get(
        "https://api.openfinance-lab.com/v1/blackarrow/watchlist",
        params={"account_id": account_id, "name": name},
        timeout=15,
    )
    r.raise_for_status()          # 4xx/5xx -> raise, caller logs + retries
    return r.json()["symbols"]    # [{symbol,last,bid,ask,chg_pct,vol}, ...]

for q in watchlist("BA-77421"):
    print(q["symbol"], q["last"], f'{q["chg_pct"]:+.2f}%')

Data flow / architecture

A minimal pipeline has four nodes: BlackArrow client / broker back end → OpenFinance Lab connector (auth, polling + webhooks, normalization) → storage (your warehouse or our managed store) → output (REST API, scheduled CSV/Excel export, or BI dashboard). Authentication and consent live at the connector; idempotency keys (exec_id, statement checksums) make re-runs safe; everything is logged for audit. You can run the connector yourself from the delivered source, or call our hosted endpoints pay-per-call.

Regulatory context

BlackArrow originates with a Brazilian provider, so the primary frame is Brazil's LGPD (Lei Geral de Proteção de Dados) for personal-data handling and the CVM (Comissão de Valores Mobiliários) plus B3 rulebooks for market conduct. Brazil's Open Finance programme, led by the Banco Central do Brasil, is the natural model for consent-based read access to financial accounts. Where a partner broker serves EU clients, the relevant investor-protection regime is MiFID II / ESMA; UK-facing flows fall under the FCA. We map the integration to whichever set applies to your client base.

How we work

• Access only under your written authorization or via documented public/authorized endpoints — no detection-evasion techniques.
• Consent records and full request/response logging for every account touched.
• Data minimization: we pull only the fields a scenario needs, with configurable retention windows.
• Secrets handling: tokens encrypted at rest, rotated on schedule, never written to client-side code.
• NDAs and data-processing terms on request; security review of the delivered connector before hand-off.

• MetaTrader 4 — the long-standing forex/CFD client; accounts hold trade history, open positions and statements that firms routinely export alongside BlackArrow data.
• MetaTrader 5 — the multi-asset successor (FX, stocks, futures); similar account ledger and equity data, so unified portfolio views usually cover both MT5 and BlackArrow.
• cTrader — ECN/STP-oriented platform with cBot automation; holds order, position and execution data many copy-trading services pull together with BlackArrow.
• TradingView — browser-based charting and social trading; watchlists, alerts and broker-connected positions that overlap with BlackArrow's Market Monitor data.
• NinjaTrader — futures-focused desktop platform (Nelogica's own Black Arrow brokerage onboarding is documented through NinjaTrader); trade logs and account performance data are a natural companion dataset.

• TradeStation — broker-platform package with EasyLanguage scripting; holds order history, positions and account statements comparable to BlackArrow's.
• Thinkorswim — options- and equities-heavy platform; account activity and balance data that analytics teams often consolidate with other trading sources.
• ProRealTime — European charting and trading platform; watchlists, candle data and broker-linked positions sit in the same analytics pipelines.
• Tradovate — cloud/web futures platform; trade and equity data exported through APIs in the same way a BlackArrow connector would.
• Profit (Nelogica ProfitChart) — BlackArrow's sister product from the same vendor; many Brazilian traders run both, so cross-platform statement and position exports are a common request.

About us

We are an independent technical studio focused on app interface integration and authorized API work for fintech and trading products. Our team has spent years on mobile apps, brokerage back ends, FIX/market-data plumbing, protocol analysis and cloud infrastructure, and we ship end-to-end integrations under real security and compliance constraints rather than throwaway scripts.

• Trading platforms, brokerage data, payments, digital banking and cross-border reporting
• Enterprise API gateways, webhook delivery and security reviews
• Custom Python / Node.js / Go SDKs, test harnesses and Postman collections
• Full pipeline: protocol analysis → build → validation → compliance hand-off
• Source-code delivery from $300 — runnable API source code plus full documentation; pay after delivery once you are satisfied
• Pay-per-call API billing — call our hosted endpoints and pay only per call, no upfront cost; suited to teams that prefer usage-based pricing

Contact

Send us the target app and your requirements (which data, which broker, expected volume) and we will come back with scope, timeline and a quote.

Contact page

Two engagement models: one-off source-code delivery (from $300, pay on satisfaction) or hosted pay-per-call API access.

Engagement workflow

1. Scope confirmation — which data, which broker back end(s), which delivery shape (source code vs hosted API).
2. Protocol analysis and API design — auth flow, endpoints, normalization schema (2–5 business days, complexity-dependent).
3. Build and internal validation — connector, tests, sample data (3–8 business days).
4. Documentation, samples and test cases — OpenAPI spec, Postman collection, runbook (1–2 business days).
5. Typical first delivery in 5–15 business days; third-party or broker approvals may extend timelines.

FAQ

What do you need from me to start a BlackArrow integration?

How long does a first BlackArrow API delivery take?

How do you handle compliance and data privacy?

Can you deliver source code instead of a hosted API?