Systematic Execution in India: APIs, Algos & SEBI Rules

Writing the strategy is the fun part. Running it every week without a mistake is the job. Between your signal and the exchange sit a broker API with rate limits, a token that expires every day, a SEBI framework that went fully live on 1 April 2026, and a market that occasionally halts. This module is the production checklist I wish someone had handed me when I started: the API, the rules, and the boring risk controls that keep a small bug from becoming a large loss.

The Indian broker API landscape

Every systematic strategy needs three things from a broker: a way to place and modify orders, a market data feed, and a way to read positions, holdings and funds. Most large Indian brokers now expose all three through an API. The differences that matter for a systematic investor are not the ones in the marketing:

• Rate limits. Brokers cap orders per second and requests per minute. Below the 10 orders per second threshold the exchange treats you as a generic algo; above it you need registration. Pace your orders well below the limit instead of bursting.
• Authentication. Since April 2026, OAuth based login with two factor authentication is the only allowed method, and most brokers require a fresh login once every trading day. Long lived refresh tokens are gone.
• Static IP. Orders are accepted only from an app ID tied to a whitelisted static IP. Your laptop on home wifi is not a production server any more.
• Market data. A streaming socket for live quotes plus REST calls for history. A socket means you own the reconnect logic.
• Behaviour under load. The real test is the 9:15 am open on a gap day and expiry afternoons. Test with small size on those days before you trust the setup with real capital.

Start with whichever API your own broker offers. The broker you pick matters far less than how carefully your code respects that broker's limits.

Key consideration: authentication and session management

• Plan the daily login. If your broker needs a manual two factor step every morning, your schedule has a human in it. Build the job so that it waits for the session, not one that silently skips the day.
• Never put keys in code. Use environment variables or an encrypted secrets file, and rotate keys if a laptop is lost.
• Handle socket drops. Reconnect with exponential backoff and refresh positions from the REST API after every reconnect, because ticks you missed are gone.
• Hold orders while disconnected. Queue them, then reconcile with the broker's order book before you resend anything.

SEBI's algo trading framework (February 2025, live April 2026)

On 4 February 2025 SEBI issued "Safer participation of retail investors in Algorithmic trading". The exchanges published the operating standards in mid 2025, brokers ran the old and new setups side by side, and from 1 April 2026 the new framework is the only one. Here is what it actually says.

Who is responsible

The broker is the principal. Any algo provider or fintech that connects through the broker's API is the broker's agent, must be empanelled with the exchange, and has its complaints handled by the broker. That single line changed the economics of the whole industry: brokers now carry the risk of what runs on their pipes, so they are strict about who gets access.

The key changes

1. Every algo order carries an exchange identifier. Orders that come through an API are tagged with a unique ID the exchange issues, so every order can be traced to the algo and the client.
2. A speed threshold decides registration. An algo you write yourself needs exchange registration through your broker only if it crosses the orders per second threshold, set at 10 per exchange. Below it, your orders carry a generic algo tag. A registered self built algo can also be used for your family: self, spouse, dependent children and dependent parents.
3. No open APIs. Access only through a unique vendor and client specific API key, a static IP whitelisted by the broker, OAuth authentication and two factor login.
4. White box and black box. An algo whose logic is disclosed and replicable is a white box. One whose logic is not disclosed is a black box, and its provider must register with SEBI as a Research Analyst and keep a research report for every such algo.
5. Exchanges hold a kill switch. The exchange can stop an algo that misbehaves, and brokers must be able to do the same.

One more operational rule is easy to miss. NSE does not accept market orders from algos in the normal session; brokers convert them to limit orders with a price protection band. Algo market orders are allowed in the Closing Auction Session and, since 7 September 2026, in the first five minutes of the pre-open.

What it means for a systematic investor

• A rebalance script that sends 40 orders over two minutes stays far below 10 orders per second. It needs the static IP and daily login, not a separate exchange approval.
• A script that fires 40 orders in one second crosses the line. Add a pacer that spaces orders out.
• Selling your strategy to others is a different business. Then you are an algo provider who must be empanelled, and a black box provider needs Research Analyst registration.

Building your first systematic execution pipeline

The architecture is simpler than the regulation: signal, order management, execution, monitoring.

1. SignalTargets computed on a schedule, stored with a timestamp.
2. Order managementRead holdings, diff, check limits, sells first.
3. ExecutionPriced limit orders with a deterministic tag.
4. MonitoringReconcile fills, log errors, alert on anything odd.

Signal generation

Your model turns data into target weights once per cycle. Run it on a schedule, store the output with a timestamp, and never let the execution code recompute it on the fly. If a weekly job runs at 8:30 am on rebalance days, you can read the targets before the market opens and stop the run if something looks wrong.

Order management

1. Read the truth. Pull holdings, open orders and available funds from the broker. Never trust your own database over the broker's.
2. Diff. Target quantity minus current quantity gives the trade list. Round to whole shares and drop trades too small to matter.
3. Check limits. Single position cap, maximum order value, daily traded value, price band.
4. Sequence. Sells first, so the sale proceeds fund the buys.
5. Place and log. Every request, response and error, with a timestamp.

Execution

Limit orders priced a tick or two through the best price are the workhorse. Good till triggered and after market orders are broker features, not exchange order types, so read your broker's rules before you depend on them. For F&O stocks you can also aim at the closing auction if your model is built on closing prices.

Monitoring and error handling

• Partial rebalance. Five orders went through and the API failed on the sixth. Decide in advance: retry with backoff, finish manually, or leave the rest for the next cycle. Whatever you choose, log it.
• Lost response. You sent an order and the connection died before the reply. Query the order book with your own order tag before resending. Placing the same order twice must never produce two fills. That property is called idempotency.
• Paper first. Run the full pipeline against paper orders for at least two rebalance cycles before money touches it.

Risk controls every algo must have

These are the controls that stop a typo from becoming a headline.

Position limits

Order rate limits, self imposed

Set your own ceiling well below 10 orders per second, say 3 or 4. A bug that loops will hit your ceiling before it hits the exchange threshold and your broker's patience.

Daily loss kill switch

If the portfolio is down more than a set amount in a day, stop sending new orders and alert yourself. For a long only rebalance strategy this is less about trading losses and more about catching a broken data feed that suddenly says sell everything.

Fat finger protection

Cap the value of any single order and reject quantities that are a multiple of what the model expected. One extra zero is the classic mistake, and it is always a code mistake, never a market one.

Market hours and halt awareness

Check the exchange status before every batch. Outside 9:00 am to 3:30 pm, on holidays, or during a market wide circuit breaker halt, queue instead of sending.

Duplicate order detection

A scheduler that fires twice will place every order twice unless your code checks the open order book for the same tag first. Use a deterministic tag per rebalance per stock, such as the date plus the symbol plus the side.

Common mistakes

• Running production from a laptop. Static IP rules make this fragile. A small cloud server with a fixed IP is the norm now.
• Assuming the token lasts. Daily login is the rule since April 2026. Plan the morning.
• Sending market orders from code. They are converted or rejected in the normal session. Price your orders.
• Trusting your own position file. Corporate actions, manual trades and partial fills make it drift. Read holdings from the broker every run.
• Sharing your script with friends. A self built algo can be used for your family only. Anyone beyond that turns you into a provider under the framework.

How this shows up in RupeeCase

RupeeCase exists so that an investor does not have to build any of this. Each index is a published algo: universe, cadence and rebalance history are on its page, model back tested. On a rebalance day you see what changes, you approve, and the orders go to your own broker for your own demat account. The fee is one line, 0.2% of the value traded. If you would rather see the rebalance flow before you read more rules, start with getting started, then open an index such as Large Midcap to see a two week cadence in practice.

Questions people ask me

What to remember

• The SEBI retail algo framework of 4 February 2025 has been the only framework since 1 April 2026.
• Brokers are principals; algo providers are their empanelled agents.
• Static IP, OAuth and daily two factor login for every API order.
• Above 10 orders per second per exchange, an algo needs exchange registration.
• Black box providers need Research Analyst registration.
• Position caps, rate limits, kill switch, fat finger checks and duplicate detection are not optional.