Is smartapi-angel-one safe to install?

SaferSkills independently audited smartapi-angel-one (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

SKILL.md · 1 file

SKILL.md8.9 KB · Markdown

name: smartapi-angel-one

description: >

Complete integration reference for SmartAPI (Angel One's REST API for algorithmic trading).

Use this skill whenever the user is building, debugging, or asking about Angel One SmartAPI

integrations — including login/session management, placing or managing orders, fetching

market data, historical OHLC data, portfolio/holdings, GTT orders, WebSocket streaming,

margin estimation, or any SmartAPI endpoint. Trigger on keywords like "SmartAPI",

"Angel One API", "AngelBroking API", "place order", "symboltoken", "jwtToken",

"feedToken", "GTT rule", "getCandleData", "getLtpData", or any reference to

angelone.in / angelbroking.com API URLs. Also trigger when the user is writing Python,

JavaScript, or any code that calls these endpoints.

SmartAPI (Angel One) Integration Skill

Quick Reference

Need	Go to section
Login & tokens	[Session Flow]
Place / modify / cancel	[Order Management]
Real-time price / quote	[Market Data]
OHLC candlestick history	[Historical Data]
Holdings & positions	[Portfolio]
Conditional (GTT) orders	[GTT Orders]
Live streaming	[WebSocket]
Margin / brokerage calc	[Utilities]
Error codes	[Error Handling]

For full endpoint field references, read references/endpoints.md.

Base URLs

Current:  https://apiconnect.angelone.in/rest
Legacy:   https://apiconnect.angelbroking.com/rest
GTT:      https://apiconnect.angelone.in/gtt-service/rest

All paths below are relative to the Current base URL unless noted otherwise.

Session Flow

Every integration must follow this lifecycle:

1. POST /auth/angelbroking/user/v1/loginByPassword   → jwtToken, refreshToken, feedToken
2. Include jwtToken in Authorization header for all secure calls
3. On JWT expiry → POST /auth/angelbroking/jwt/v1/generateTokens
4. POST /secure/angelbroking/user/v1/logout           → end session

Required Headers (all secure endpoints)

Content-Type:       application/json
Accept:             application/json
Authorization:      Bearer <jwtToken>
X-UserType:         USER
X-SourceID:         WEB
X-ClientLocalIP:    127.0.0.1
X-ClientPublicIP:   <your public IP>
X-MACAddress:       00:00:00:00:00:00
X-PrivateKey:       <API key from SmartAPI portal>

💡 X-ClientLocalIP, X-ClientPublicIP, X-MACAddress can use placeholder values during development.

POST /auth/angelbroking/user/v1/loginByPassword

{ "clientcode": "AB1234", "password": "mypassword", "totp": "123456" }

Response tokens:

jwtToken → Authorization: Bearer header
refreshToken → regenerate expired JWT
feedToken → WebSocket streaming

Token Refresh

POST /auth/angelbroking/jwt/v1/generateTokens
{ "refreshToken": "r_ABC123..." }

Order Management

Place Order

POST /secure/angelbroking/order/v1/placeOrder

{
  "variety": "NORMAL",
  "tradingsymbol": "TCS-EQ",
  "symboltoken": "12345",
  "transactiontype": "BUY",
  "exchange": "NSE",
  "ordertype": "MARKET",
  "producttype": "DELIVERY",
  "duration": "DAY",
  "quantity": 1,
  "price": 0,
  "triggerprice": 0,
  "disclosedquantity": 0
}

Returns: { "data": { "orderid": "...", "uniqueorderid": "..." } }

⚠️ Save uniqueorderid — required for tracking individual order status.

Key field values:

variety: NORMAL | AMO | SL
ordertype: MARKET | LIMIT | SL | SL-M
producttype: DELIVERY | CARRYFORWARD | MIS
duration: DAY | IOC | FILL_OR_KILL
price: Set 0 for MARKET orders
triggerprice: Required for SL and SL-M

Modify / Cancel

POST /secure/angelbroking/order/v1/modifyOrder   # same fields + "orderid"
POST /secure/angelbroking/order/v1/cancelOrder

Track Order Status

GET /secure/angelbroking/order/v1/details/{uniqueorderid}   # preferred (10 req/s)
GET /secure/angelbroking/order/v1/getOrderBook              # all orders (~1 req/s)
GET /secure/angelbroking/order/v1/getTradeBook              # executed trades
GET /secure/angelbroking/order/v1/getPosition               # open positions

💡 Always prefer `/details/{uniqueorderid}` over polling the full order book — 10x higher rate limit.

Market Data

Symbol Lookup

POST /secure/angelbroking/order/v1/searchScrip
{ "exchange": "NSE", "searchscrip": "TCS" }

Returns tradingsymbol, exchange, symboltoken. Always resolve symboltoken before placing orders.

LTP (Multiple Symbols)

POST /secure/angelbroking/order/v1/getLtpData
{ "exchange": "NSE", "symboltoken": ["2885", "26000"] }

Real-Time Quote

POST /secure/angelbroking/market/v1/quote
{ "mode": "snapshot", "exchangeTokens": ["12345"] }

Other Market Data

Endpoint	Description
`POST /marketData/v1/optionGreek`	Delta, Gamma, Theta, Vega
`POST /marketData/v1/gainersLosers`	Top gainers/losers
`GET /marketData/v1/putCallRatio`	NIFTY PCR
`POST /marketData/v1/OIBuildup`	OI buildup for indices
`GET /marketData/v1/nseIntraday`	NSE intraday data

Historical Data

Candlestick (OHLC)

POST /secure/angelbroking/historical/v1/getCandleData
{
  "exchange": "NSE",
  "symboltoken": "12345",
  "interval": "ONE_DAY",
  "fromdate": "2024-01-01 09:15",
  "todate": "2024-01-31 15:30"
}

Intervals: ONE_MINUTE | FIVE_MINUTE | ONE_HOUR | ONE_DAY Response: Array of [timestamp, open, high, low, close, volume]

Historical Open Interest

POST /secure/angelbroking/historical/v1/getOIData

Same structure as getCandleData; returns oi and changeinOi per bucket.

Portfolio / Holdings

GET /secure/angelbroking/portfolio/v1/getHolding       # equity holdings
GET /secure/angelbroking/portfolio/v1/getAllHolding     # all segments

GTT (Good-Till-Trigger) Orders

⚠️ GTT endpoints use a different base URL prefix: https://apiconnect.angelone.in/gtt-service/rest/secure/angelbroking/gtt/v1/

Create GTT Rule

POST /gtt-service/rest/secure/angelbroking/gtt/v1/createRule
{
  "tradingsymbol": "TCS-EQ", "symboltoken": "12345", "exchange": "NSE",
  "transactiontype": "BUY", "ordertype": "MARKET", "producttype": "DELIVERY",
  "price": 0, "quantity": 1, "triggerPrice": 2300,
  "disclosedquantity": 0, "scripConsent": "yes"
}

Action	Method	Path suffix	Key Body
Modify	POST	`modifyRule`	same fields + `"id": <rule_id>`
Cancel	POST	`cancelRule`	`{ "id": <rule_id> }`
Details	POST	`ruleDetails`	`{ "id": <rule_id> }`
List	POST	`ruleList`	`{ "status": ["ACTIVE"], "page": 1, "count": 10 }`

WebSocket Streaming

URL:    wss://smartapisocket.angelone.in/smart-stream
Auth:   feedToken from login response
Topics: real-time market quotes, order status notifications

Utilities

POST /secure/angelbroking/margin/v1/batch              # margin for a batch of orders
POST /secure/angelbroking/brokerage/v1/estimateCharges # brokerage + tax breakdown

Error Handling

All responses share this envelope:

{
  "status": true,
  "message": "SUCCESS",
  "errorCode": "",
  "data": { }
}

Always check "status": true before reading data.

Code Range	Meaning
AG8001–8005	Auth / authorization errors
AG8002	Invalid input parameters
AG5000	Server-side errors

Rate Limits

Operation	Limit
Place / Modify / Cancel order	20 req/s
Individual order status	10 req/s
Order book (full)	~1 req/s
Historical / market data	Generous

Integration Checklist

[ ] Implement JWT auto-refresh on 401 — don't let the token expire silently
[ ] Resolve symboltoken via searchScrip before every order
[ ] Use uniqueorderid (not orderid) to track individual order status
[ ] Use GTT base URL prefix for all GTT operations
[ ] Set price: 0 for MARKET orders; always set triggerprice for SL/SL-M
[ ] Page through ruleList results using page + count

Need more detail?

Read references/endpoints.md for complete request/response field tables for every endpoint.

smartapi-angel-one— agent skill

Is smartapi-angel-one safe to install?

SmartAPI (Angel One) Integration Skill

Quick Reference

Base URLs

Session Flow

Required Headers (all secure endpoints)

Token Refresh

Order Management

Place Order

Modify / Cancel

Track Order Status

Market Data

Symbol Lookup

LTP (Multiple Symbols)

Real-Time Quote

Other Market Data

Historical Data

Candlestick (OHLC)

Historical Open Interest

Portfolio / Holdings

GTT (Good-Till-Trigger) Orders

Create GTT Rule

WebSocket Streaming

Utilities

Error Handling

Rate Limits

Integration Checklist

Need more detail?

Audit the pieces. Scan the whole. Decide.

Is smartapi-angel-one safe to install?

SmartAPI (Angel One) Integration Skill

Quick Reference

Base URLs

Session Flow

Required Headers (all secure endpoints)

Login

Token Refresh

Order Management

Place Order

Modify / Cancel

Track Order Status

Market Data

Symbol Lookup

LTP (Multiple Symbols)

Real-Time Quote

Other Market Data

Historical Data

Candlestick (OHLC)

Historical Open Interest

Portfolio / Holdings

GTT (Good-Till-Trigger) Orders

Create GTT Rule

WebSocket Streaming

Utilities

Error Handling

Rate Limits

Integration Checklist

Need more detail?

Audit the pieces. Scan the whole. Decide.