{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "upbit", "name": "Upbit Open API", "vendor": "Dunamu Inc.", "vendorUrl": "https://docs.upbit.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Upbit, the Korean exchange run by Dunamu, has a REST and WebSocket Open API for KRW, BTC and USDT market data, orders, balances, deposits and withdrawals, with official SDKs, a CLI and agent skills but no MCP server.", "url": "https://www.anchorterminal.com/tools/upbit", "markdownUrl": "https://www.anchorterminal.com/tools/upbit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/upbit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/upbit.json", "dns": "upbit.grade.anchorterminal.com", "repo": "https://github.com/upbit-official", "transports": [], "packages": [ { "registry": "npm", "name": "@upbit-official/upbit-cli" }, { "registry": "pypi", "name": "upbit-sdk" } ], "auth": "api-key", "authNotes": "Access and secret keys issued on the PC web site under My Page \u003e Open API Management after identity verification and two-factor authentication. At issuance the person picks the functions the key may use and must register at least one public IPv4 address, since the allow-list is mandatory. Each request carries a JWT signed with HMAC SHA512 over the access key, a fresh nonce and a SHA512 hash of the query, as a Bearer token. A key with withdrawal permission gets a withdrawal safe-lock by default that is lifted only in the mobile app. Up to 10 keys on the main pocket and 5 per sub-pocket; expired keys answer expired_access_key (https://docs.upbit.com/kr/docs/api-key.md, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "Trading fees per fill. The fee schedule is on upbit.com, whose robots.txt disallows every path for our crawler, so no rate is recorded. Public quotation endpoints need no key and no account (https://upbit.com/robots.txt, checked 2026-11-03).", "priceSummary": "Pay per use", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, llms.txt, the SDK licence or the CLI docs (checked 2026-11-03). Fees are taken from each fill.", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": 91, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.upbit.com/kr/reference/api-overview", "llmsTxt": "https://docs.upbit.com/llms.txt", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.balances", "exchange.transfers", "market.crypto" ], "tags": [ "hosted", "api-key", "closed-source", "usage-priced", "cli", "agent-skills", "llms-txt", "python", "typescript", "go", "no-status-page" ], "lastRelease": "2026-10-20", "graded": true, "anchor": { "graded": true, "score": 54.7, "grade": "C", "agentReady": false, "rank": 860, "ranked": true, "rankOf": 1349, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 83, "payments": 15, "reliability": 42, "schema": 66, "security": 59, "transparency": 54 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 42, "points": 8.4, "reason": "Read with the hosted lines. No status page found on docs.upbit.com or in llms.txt; a wallet-status endpoint and an announcements stream stand in (0). No readable incident history (5). Rate limits documented with numbers per group, per IP and per pocket, updated 7 October 2026 (15). 429 then 418 with a stated block length and a Remaining-Req header, an order-test endpoint and a self-match-prevention default; an order identifier for safe retries was not checked (12 of 15). No SLA found (0). Generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 66, "points": 10.73, "reason": "No OpenAPI found; the reference is a readme.io site with a Markdown twin of every page (5 of 25). llms.txt on docs.upbit.com and a kr/llms.txt index (10). Each reference page states what the endpoint does, its group and its errors, with warnings such as market_offline after maintenance (14 of 20). Typed parameters with enums for order type, side and time in force and required flags (11 of 15). Recipes in Python, Java and Node.js and an error format of error.name and error.message with HTTP statuses (13 of 15). Feature versions in page histories (v1.6.1) and dated notices with effective dates, no single API version (13 of 15). 5 + 10 + 14 + 11 + 13 + 13 = 66.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 70, "points": 11.38, "reason": "Graded on the REST API with the CLI. Candle counts, list limits and the CLI's --max-items and --transform size responses (16 of 25). Paging and filters on orders and history (15 of 20). error.name codes to branch on, which the November 2026 notice tells clients to use, and 418 with its block length (15 of 20). An order-test endpoint and a CONFIRM gate in the skills; an order identifier for idempotent placement was not checked (11 of 20). Few required parameters, SDKs in three languages and a CLI, but keys need the PC web site and a registered IP (13 of 15). 16 + 15 + 15 + 11 + 13 = 70.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 59, "points": 10.33, "reason": "Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 15, "points": 1.88, "reason": "No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 54, "points": 4.72, "note": "editorial 42, provenance 66", "reason": "The editorial half. A closed service whose user and Open API terms could not be fetched under upbit.com's robots.txt, and whose SDK licence page calls the SDK material not open source while the repositories carry Apache-2.0 (8 of 30). The developer centre's privacy policy names Dunamu Inc., gives retention periods and names Zendesk in Japan; the main privacy policy was not read (14 of 30). Notices with effective dates, including the path-format change and the deprecated Remaining-Req min field (12 of 20). Zendesk and Google Analytics named with a location for the developer centre only (8 of 20). 8 + 14 + 12 + 8 = 42.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API with the CLI. Candle counts, list limits and the CLI's --max-items and --transform size responses (16 of 25). Paging and filters on orders and history (15 of 20). error.name codes to branch on, which the November 2026 notice tells clients to use, and 418 with its block length (15 of 20). An order-test endpoint and a CONFIRM gate in the skills; an order identifier for idempotent placement was not checked (11 of 20). Few required parameters, SDKs in three languages and a CLI, but keys need the PC web site and a registered IP (13 of 15). 16 + 15 + 15 + 11 + 13 = 70.", "maintenance": "Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83.", "payments": "No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15.", "reliability": "Read with the hosted lines. No status page found on docs.upbit.com or in llms.txt; a wallet-status endpoint and an announcements stream stand in (0). No readable incident history (5). Rate limits documented with numbers per group, per IP and per pocket, updated 7 October 2026 (15). 429 then 418 with a stated block length and a Remaining-Req header, an order-test endpoint and a self-match-prevention default; an order identifier for safe retries was not checked (12 of 15). No SLA found (0). Generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.", "schema": "No OpenAPI found; the reference is a readme.io site with a Markdown twin of every page (5 of 25). llms.txt on docs.upbit.com and a kr/llms.txt index (10). Each reference page states what the endpoint does, its group and its errors, with warnings such as market_offline after maintenance (14 of 20). Typed parameters with enums for order type, side and time in force and required flags (11 of 15). Recipes in Python, Java and Node.js and an error format of error.name and error.message with HTTP statuses (13 of 15). Feature versions in page histories (v1.6.1) and dated notices with effective dates, no single API version (13 of 15). 5 + 10 + 14 + 11 + 13 + 13 = 66.", "security": "Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59.", "transparency": "The editorial half. A closed service whose user and Open API terms could not be fetched under upbit.com's robots.txt, and whose SDK licence page calls the SDK material not open source while the repositories carry Apache-2.0 (8 of 30). The developer centre's privacy policy names Dunamu Inc., gives retention periods and names Zendesk in Japan; the main privacy policy was not read (14 of 30). Notices with effective dates, including the path-format change and the deprecated Remaining-Req min field (12 of 20). Zendesk and Google Analytics named with a location for the developer centre only (8 of 20). 8 + 14 + 12 + 8 = 42." }, "sources": [ { "what": "robots.txt (upbit.com disallows all; docs.upbit.com allows; sg.upbit.com and www.dunamu.com disallow all)", "url": "https://upbit.com/robots.txt", "seen": "2026-11-03" }, { "what": "llms.txt index (guides, reference, notices)", "url": "https://docs.upbit.com/llms.txt", "seen": "2026-11-03" }, { "what": "API overview", "url": "https://docs.upbit.com/kr/reference/api-overview.md", "seen": "2026-11-03" }, { "what": "authentication (JWT HS512, nonce, query hash)", "url": "https://docs.upbit.com/kr/reference/auth.md", "seen": "2026-11-03" }, { "what": "API key issuance (permissions, IP allow-list, withdrawal safe-lock, key counts)", "url": "https://docs.upbit.com/kr/docs/api-key.md", "seen": "2026-11-03" }, { "what": "rate limits, 7 October 2026", "url": "https://docs.upbit.com/kr/reference/rate-limits.md", "seen": "2026-11-03" }, { "what": "order test endpoint (v1.6.1, 27 October 2025)", "url": "https://docs.upbit.com/kr/reference/order-test.md", "seen": "2026-11-03" }, { "what": "AI agent overview (SDK, CLI, Skills, Strategy Toolkit; no MCP)", "url": "https://docs.upbit.com/kr/docs/upbit-ai-agent-overview.md", "seen": "2026-11-03" }, { "what": "CLI page (package, flags, output formats)", "url": "https://docs.upbit.com/kr/docs/upbit-cli.md", "seen": "2026-11-03" }, { "what": "agent skills page (CONFIRM gate)", "url": "https://docs.upbit.com/kr/docs/upbit-agent-skills.md", "seen": "2026-11-03" }, { "what": "SDK overview and Python SDK (package, Python 3.9)", "url": "https://docs.upbit.com/kr/docs/python-sdk.md", "seen": "2026-11-03" }, { "what": "SDK licence v1.0 (Dunamu Inc., not open source)", "url": "https://docs.upbit.com/kr/page/upbit_developer_sdk_license.md", "seen": "2026-11-03" }, { "what": "technical support notice (open-api@upbit.com)", "url": "https://docs.upbit.com/kr/page/upbit_open_api_support.md", "seen": "2026-11-03" }, { "what": "developer centre privacy policy V1.5", "url": "https://docs.upbit.com/kr/page/privacy_policy_v1_5.md", "seen": "2026-11-03" }, { "what": "changelog index and the path-format notice effective 16 November 2026", "url": "https://docs.upbit.com/kr/changelog/api-path-format-error-handling.md", "seen": "2026-11-03" }, { "what": "SDK v1.1.0 notice, 20 October 2026", "url": "https://docs.upbit.com/kr/changelog/upbit-sdk-v1-1-0.md", "seen": "2026-11-03" }, { "what": "global docs llms.txt and AI guide (Singapore, Indonesia, Thailand)", "url": "https://global-docs.upbit.com/docs/ai-guide.md", "seen": "2026-11-03" }, { "what": "upbit-official repositories (licences, push dates, issues)", "url": "https://api.github.com/orgs/upbit-official/repos", "seen": "2026-11-03" }, { "what": "npm @upbit-official/upbit-cli (1.0.0, 1 September 2026)", "url": "https://registry.npmjs.org/@upbit-official%2fupbit-cli", "seen": "2026-11-03" }, { "what": "official MCP registry search for upbit (one third-party entry)", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=upbit", "seen": "2026-11-03" }, { "what": "GitHub search for upbit mcp (third-party servers only)", "url": "https://api.github.com/search/repositories?q=upbit+mcp\u0026sort=stars\u0026per_page=10", "seen": "2026-11-03" }, { "what": "RDAP for upbit.com", "url": "https://rdap.verisign.com/com/v1/domain/upbit.com", "seen": "2026-11-03" } ], "openQuestions": [ "Kind http-api: the REST and WebSocket API is the only hosted surface; the SDKs, CLI and skills are clients of it. No MCP server found after reading the AI agent section, the GitHub organisation and the registry.", "unchecked: the fee schedule, the user terms, the Open API Terms of Use, security.txt and the main privacy policy, all on upbit.com (or sg.upbit.com), whose robots.txt disallows every path for our crawler. Payments pricing and the terms' automation clauses are scored absent for that reason.", "unchecked: the full permission list on the key issuance screen (the docs name withdrawal and say at least one function is chosen), the key expiry period, an order identifier for idempotent placement, and the CLI's and skills' source beyond the docs (no clone made).", "firstReleased is 27 October 2025, the v1.6.1 release of the order-test endpoint, the earliest first-hand date found; the Open API itself is years older and the developer centre gives no launch date. lastRelease is 20 October 2026, the SDK v1.1.0 notice.", "The SDK licence page (Upbit Developer SDK License v1.0, not open source, no business use) and the GitHub repositories (Apache-2.0) disagree on the SDK licence. Recorded in transparency, not deducted; a person may want to ask which governs.", "Humans: no person with a key role on a readable first-hand page; www.dunamu.com and upbit.com disallow our crawler. The developer centre privacy policy names a privacy officer, not a leader. Ownership unknown from the pages read; no investor search was made for the same reason.", "Our own products. It doesn't do LocalGhost's or letme's job." ] }, "negative": 0, "verdict": "Upbit's Open API has a mandatory IP allow-list, scoped keys with a default withdrawal lock, per-group rate limits with 429 and 418 signalling, an order-test endpoint, official SDKs, a CLI and agent skills with a CONFIRM gate. There is no MCP server, sandbox or status page, and the fees and terms sit on a host our crawler may not read.", "bestFor": "KRW-market trading for agents acting for a verified Korean account, with first-party SDKs, a CLI and skills but no MCP.", "strengths": [ "Keys need a registered public IP, carry only the chosen functions and get a withdrawal safe-lock by default that only the mobile app lifts", "Rate limits published per group with numbers, a Remaining-Req header on every response, 429 then 418 with a stated block length", "POST /v1/orders/test checks an order and the pair's state at no cost, and the skills run it before a live order", "Official Python, TypeScript and Go SDKs at v1.1.0 (20 October 2026), a CLI with JSON output and agent skills that require a typed CONFIRM before any write", "Notices carry effective dates, such as the path-format change of 16 November 2026" ], "weaknesses": [ "No MCP server; the agent route is the CLI through skills, which need a terminal", "No sandbox or testnet beyond the order-test endpoint, and no status page or SLA", "Keys can only be issued on the PC web site after Korean identity verification and 2FA, and the exchange serves the Korean market", "The fee schedule, user terms and Open API terms are on upbit.com, which disallows every crawler path, so none is recorded first-hand", "The SDK licence page says the SDK material is not open source while the GitHub repositories carry Apache-2.0" ], "agentNotes": [ "Ask the person for a key with only the functions the task needs and your server's public IPv4 address registered; a private or unregistered IP is refused", "Sign every request with a fresh JWT (HS512, new nonce, SHA512 query hash) and branch on error.name, not error.message", "Run POST /v1/orders/test before a live order; it costs nothing and shares the 8-a-second order-test group", "Read Remaining-Req and keep orders under 12 a second per pocket; on 429 wait for the next second and on 418 wait out the stated block", "Leave the withdrawal safe-lock on unless the person lifts it in the app, and send paths with single slashes and no trailing slash before 16 November 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.7 } ], "editorialScores": { "ergonomics": 70, "maintenance": 83, "payments": 15, "reliability": 42, "schema": 66, "security": 59, "transparency": 42 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "C", "kind": "listed", "method": "0.7", "score": 54.7 } ] }, "connect": { "install": "npm install -g @upbit-official/upbit-cli", "http": "curl 'https://api.upbit.com/v1/ticker?markets=KRW-BTC'" }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/upbit" }, "notable": [ "MCP server, none found. The developer centre's AI agent section covers SDKs, a CLI, agent skills and a backtest-only strategy toolkit and never mentions MCP; the upbit-official GitHub organisation has six repositories and none is an MCP server; the official MCP registry lists only a third party's io.github.mrfentmen/upbit-mcp, and other third-party servers (solangii/upbit-mcp-server, BrainDAO/mcp-upbit) are not Upbit's (https://docs.upbit.com/kr/docs/upbit-ai-agent-overview.md)", "Upbit Agent Skills (upbit-official/upbit-agent-skills, installed with `npx skills add`) drive the `upbit` CLI from Claude Code or Cursor and require the person to type CONFIRM on its own line before any order, cancellation, withdrawal, KRW deposit, address creation or pocket transfer; order tests and dry runs need no confirmation (https://docs.upbit.com/kr/docs/upbit-agent-skills.md)", "Rate limits, updated 7 October 2026: quotation groups 10 requests a second per IP; exchange groups per pocket, 30 a second by default, 12 a second for orders, 8 a second for order tests and 1 per 2 seconds for cancel-all; WebSocket 5 connections a second and 5 messages a second or 100 a minute per connection. 429 on a breach, 418 with a block duration after repeats, and a Remaining-Req header on every response (https://docs.upbit.com/kr/reference/rate-limits.md)", "No sandbox. POST /v1/orders/test validates an order and the pair's state without placing it, at no fee, released as v1.6.1 on 27 October 2025 (https://docs.upbit.com/kr/reference/order-test.md)", "A notice effective 16 November 2026 makes requests with doubled or trailing slashes in the path return an error and tells clients to branch on error.name rather than error.message (https://docs.upbit.com/kr/changelog/api-path-format-error-handling.md)", "Official SDKs for Python (`upbit-sdk`, Python 3.9 or later), TypeScript and Go, licensed Apache-2.0 on GitHub, v1.1.0 on 20 October 2026; the developer centre's SDK licence page says Dunamu's SDK material is under the Upbit Developer SDK License v1.0, which \"is not an open-source license\" and bars business use (https://docs.upbit.com/kr/page/upbit_developer_sdk_license.md)", "The CLI `@upbit-official/upbit-cli` 1.0.0 (1 September 2026, Apache-2.0, Go, also installable with go install) takes keys from UPBIT_ACCESS_KEY and UPBIT_SECRET_KEY and prints json, jsonl, yaml or raw with --transform (GJSON) and --max-items (https://docs.upbit.com/kr/docs/upbit-cli.md)", "The developer centre's privacy policy V1.5 (from 18 May 2026) names Dunamu Inc., keeps complaint records for 3 years, Google Analytics data for up to 26 months, and transfers complaint data to Zendesk in Japan (https://docs.upbit.com/kr/page/privacy_policy_v1_5.md)", "upbit.com and sg.upbit.com disallow every path for our crawler, so the fee schedule, the user terms, the Open API terms of use and security.txt were not read; the AI guide warns that commercial use or redistribution of the docs may breach the Open API Terms of Use (https://global-docs.upbit.com/docs/ai-guide.md)", "Separate docs at global-docs.upbit.com cover Upbit Singapore, Indonesia and Thailand (SGD, IDR and THB markets); this listing is the Korean exchange (https://global-docs.upbit.com/llms.txt)" ], "area": "payments", "details": [ { "label": "Surface listed", "value": "The Korean Open API (REST at api.upbit.com and WebSocket) read from docs.upbit.com, its llms.txt and Markdown twins, the upbit-official GitHub organisation, npm and the MCP registry on 3 November 2026. No account was made, no private endpoint was called and the CLI was not run" }, { "label": "MCP server", "value": "None found. Looked in the developer centre's AI agent section (SDKs, CLI, Skills, Strategy Toolkit, CCXT), the upbit-official GitHub organisation (six repositories) and the official MCP registry, whose only upbit entry is a third party's io.github.mrfentmen/upbit-mcp (stdio, 21 September 2026). solangii/upbit-mcp-server and BrainDAO/mcp-upbit are also third-party" }, { "label": "Key permissions", "value": "Functions chosen at issuance (the docs name withdrawal and say at least one must be picked; the full list is on the issuance screen); a mandatory public IPv4 allow-list; withdrawal safe-lock on by default for keys with withdrawal permission, lifted only in the app; up to 10 keys on the main pocket and 5 per sub-pocket; secret shown once; expiry period not stated. Withdrawal address registration is a separate step in the account" }, { "label": "Rate limits", "value": "Quotation 10 a second per IP per group (market, candle, trade, ticker, orderbook). Exchange per pocket, default 30 a second, order 12 a second, order-test 8 a second, cancel-all 1 per 2 seconds; travel-rule checks 1 per 10 minutes per deposit. WebSocket 5 connections a second, 5 messages a second and 100 a minute per connection; requests with an Origin header 1 per 10 seconds. 429 on a breach, 418 after repeats with a block duration, Remaining-Req header (min deprecated). Updated 7 October 2026" }, { "label": "Testnet", "value": "None. POST /v1/orders/test validates an order without placing it (v1.6.1, 27 October 2025)" }, { "label": "Countries", "value": "The Korean exchange, with KRW, BTC and USDT markets, Korean identity verification and 2FA for keys and a KRW bank account for fiat. Upbit Singapore, Indonesia and Thailand have separate docs at global-docs.upbit.com. No served or excluded country list was readable; the terms are on upbit.com, which disallows our crawler" }, { "label": "Fees", "value": "Unchecked. The fee page is on upbit.com, whose robots.txt disallows every path" }, { "label": "FIX and WebSocket", "value": "WebSocket public streams (ticker, trade, orderbook, candle) and private streams (my order, my asset, announcements, technical indicators for KRW markets). No FIX found in the docs" }, { "label": "Terms on automation", "value": "Unchecked. The Open API Terms of Use are on upbit.com. The technical support notice says sample code is for reference at the user's own responsibility and refers to those terms; the AI guide says commercial use or redistribution of the docs may breach them" }, { "label": "Agent tooling", "value": "SDKs (Python `upbit-sdk`, TypeScript, Go; Apache-2.0 on GitHub), CLI `@upbit-official/upbit-cli` 1.0.0, Skills `upbit-official/upbit-agent-skills` for Claude Code and Cursor with a CONFIRM gate, and a backtest-only Strategy Toolkit in beta. Pocket API supported across them" }, { "label": "Changelog", "value": "Ten notices on docs.upbit.com, dated items among them the SDK v1.1.0 (20 October 2026), the rate-limit page (7 October 2026) and the path-format change effective 16 November 2026" }, { "label": "Legal entity", "value": "Dunamu Inc. (두나무 주식회사), per the SDK licence and the developer centre's privacy policy" } ], "provenance": { "legalEntity": "Dunamu Inc.", "domain": "upbit.com", "domainRegistered": "2004-01-10", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://docs.upbit.com/kr/page/privacy_policy_v1_5.md", "statusPage": "", "changelog": "https://docs.upbit.com/kr/changelog", "securityTxt": "unknown", "checked": "2026-11-03", "notes": [ "Dunamu Inc. is named as the licensor in the Upbit Developer SDK License v1.0 and as the company in the developer centre's privacy policy V1.5 (from 18 May 2026).", "upbit.com/robots.txt disallows every path for User-agent * (a second group adds /terms_and_policy and others), allowing only Googlebot, MSNBot, Yeti and Daumoa; sg.upbit.com and www.dunamu.com do the same. The user terms, the Open API terms, the fee schedule and security.txt on those hosts were therefore not fetched; the terms URL is left empty.", "docs.upbit.com/robots.txt allows everything but edit, login and api-next paths and points to llms.txt, with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives upbit.com a registration date of 10 January 2004.", "No status page found; the API has a service-status (wallet status) endpoint and an announcements WebSocket stream." ], "score": 66, "checks": [ { "check": "Legal entity named", "value": "Dunamu Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "upbit.com, registered 2004-01-10 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "upbit.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 1 of the 8 things a reader expects", "points": 4.8, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "could not be fetched", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "not researched yet", "points": 0, "max": 0, "state": "na" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://docs.upbit.com/kr/page/privacy_policy_v1_5.md", "state": "read", "readAt": "2026-11-03", "words": 2017, "points": 4.8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": false }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": false }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "…이메일 프로필명, 상담내용\u003c/td\u003e\\n \u003ctd style=\\\"padding: 10px;\\\"\u003e일본, privacy@zendesk.com\u003c/td\u003e\\n \u003ctd style=\\\"padding: 10px;\\\"\u003e고충 처리 시, 네트워크를 통해 이전\u003c/td\u003e\\n \u003ctd style=\\\"padding: 10px;\\\"\u003e3 년\u003c/td\u003e\\n \u003c/tr\u003e\\n \u003c/tbody\u003e\\n \u003c/table\u003e\\n\\n \u003ch2 id=\\\"article-7\\\" style=\\\"border-bottom: 1px solid #eee;", "says": "privacy@zendesk.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ] } ] }, "humans": { "slug": "upbit", "checked": "2026-11-03", "company": "Dunamu Inc.", "peopleNote": "No first-hand page naming a founder or executive could be read. www.dunamu.com, upbit.com and sg.upbit.com disallow every path for our crawler, so the company pages that would name Dunamu's leadership were not fetched. The developer centre's privacy policy V1.5 names Dunamu Inc. as the company and a privacy officer in its privacy team, which is not a key role, so nobody is listed. Ownership is recorded as unknown because no page read states whether Dunamu is privately held or listed, and no investor search was made since the company's own pages were off limits.", "companySocial": { "github": "https://github.com/upbit-official" }, "support": { "emails": [ "open-api@upbit.com" ], "urls": [ "https://docs.upbit.com/kr/page/upbit_open_api_support.md", "https://docs.upbit.com" ], "community": [ { "label": "upbit-official GitHub", "url": "https://github.com/upbit-official", "kind": "github" } ], "contactEmails": [ "cs@upbit.com" ] }, "sources": [ "https://docs.upbit.com/kr/page/upbit_open_api_support.md", "https://docs.upbit.com/kr/page/upbit_developer_sdk_license.md", "https://docs.upbit.com/kr/page/privacy_policy_v1_5.md", "https://docs.upbit.com/kr/docs/upbit-ai-agent-overview.md", "https://api.github.com/orgs/upbit-official/repos", "https://www.dunamu.com/robots.txt" ], "ownership": { "status": "unknown", "checked": "2026-11-03", "sources": [ "https://docs.upbit.com/kr/page/upbit_developer_sdk_license.md", "https://docs.upbit.com/kr/page/privacy_policy_v1_5.md" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/upbit.json", "live": { "slug": "upbit", "securityTxt": { "url": "https://upbit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:27.560288922Z" }, "updatedAt": "2026-11-04T15:53:27.560288922Z" } } }