Introduction

Cessio is a confidential OTC RFQ desk on Canton Network. A taker requests quotes for a swap of two catalog instruments (e.g. cBTC ↔ USDCx) from a chosen set of makers; makers answer with signed quotes; the taker accepts one, and the swap settles atomically (delivery-versus-payment) in a single Canton transaction. The ledger shows the trade only to its parties: the other makers invited to the RFQ learn that their own quote lost, never the winning price or who won.

This documentation covers the desk's public API. Most of it is written from the maker's seat — everything you need to run a quoting bot — but the same identity and X-API-Key also open the taker surface (POST /rfq, POST /quote/{id}/accept, GET /trades; see the API reference), and the MCP server wraps both roles for AI agents.

Building with an AI coding agent? Paste this documentation straight into it:

Copy prompt

How a maker participates

1. Register — self-register with your own Ed25519 party key and get an API key back.
2. Subscribe to the WebSocket stream: it delivers RFQ invitations, and keeping it open is what makes you invitable at all.
3. Quote — post a price. The desk prepares an on-ledger commitment (your committed allocations) and you sign it with your party key; the desk never holds that key. See The sign queue.
4. Settle — if the taker picks your quote, settlement runs atomically; you watch progress events and read the on-ledger proof.

Quickstart walks all four end to end, with runnable code.

Where your key lives

Over the API there is one kind of maker, and you are it: an externally signing maker. You generate the party key, you keep it, and every ledger effect waits for your signature — each call that needs one returns it, and a trade you accept as taker can queue more (see The sign queue). A maker who trades from the Cessio web app does the same with the key held by a passkey in the browser, or by its own Canton wallet: identical quotes, a different front door.

Custody, honestly

The desk never sees your party key, and the API key it issues is hashed at rest. A bot's party is still hosted on the desk's participant node: the desk cannot sign for it, but it runs the node your party lives on. (Web users can instead connect a wallet whose party lives on its own validator.) Treat the desk as a trading venue, not as custody infrastructure.

Stuck?

Support has the addresses to write to, what to put in a report, and where the source, the npm packages and the announcements live.