stonepy 0.2.0__tar.gz → 0.2.2__tar.gz

{stonepy-0.2.0 → stonepy-0.2.2}/CHANGELOG.md

@@ -7,6 +7,55 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-06-28
+
+### Fixed
+
+- Correct the request path for the v2 endpoints across the `market`, `message`,
+  `client_preference`, `order`, `preference`, `watchlist`, `session`, `price_alert`, and
+  `user_account` resource groups. The frozen catalog composed each path as `/{target}{uri_template}`,
+  doubling the resource segment the v2 `uri_template` already carries (for example
+  `/market/v2/market/...`), so every one returned `404`. The generator now emits the documented
+  `/v2/...` template for v2 endpoints, served under the existing `/TradingAPI` base. Routes were
+  verified against the live CIAPI demo
+  ([#15](https://github.com/aaronmgn/stonepy/issues/15),
+  [#16](https://github.com/aaronmgn/stonepy/issues/16),
+  [#17](https://github.com/aaronmgn/stonepy/issues/17),
+  [#18](https://github.com/aaronmgn/stonepy/issues/18),
+  [#19](https://github.com/aaronmgn/stonepy/issues/19),
+  [#20](https://github.com/aaronmgn/stonepy/issues/20),
+  [#21](https://github.com/aaronmgn/stonepy/issues/21)).
+- Correct three v2 order/preference routes whose upstream `uri_template` is itself wrong:
+  `order.get_active_stop_limit_order` now calls the v1-style
+  `/order/{orderId}/activeStopLimitOrder` (the 0.2.0 `/order/v2/...` override also 404s),
+  `order.get_open_position` calls `/v2/order/{orderId}/openPosition`, `order.save_order` posts to
+  `/v2/order`, and `user_preference.get_user_preference` calls the singular `/v2/Preference`
+  (the catalog pluralised it to `/v2/Preferences`)
+  ([#18](https://github.com/aaronmgn/stonepy/issues/18),
+  [#19](https://github.com/aaronmgn/stonepy/issues/19)).
+
+## [0.2.1] - 2026-06-28
+
+### Fixed
+
+- `session.log_on` now calls the host-root `/v2/session` endpoint that CIAPI actually serves,
+  instead of the unreachable `/session/v2/Session` that returned `401` against the documented
+  base URL ([#8](https://github.com/aaronmgn/stonepy/issues/8)).
+- `user_account.get_client_and_trading_account` now calls the host-root
+  `/v2/UserAccount/ClientAndTradingAccount` endpoint instead of the doubled
+  `/userAccount/v2/userAccount/ClientAndTradingAccount` path
+  ([#9](https://github.com/aaronmgn/stonepy/issues/9)).
+- `margin.get_client_account_margin` now calls the v1 `/margin/ClientAccountMargin` endpoint
+  (under the `/TradingAPI` base) that CIAPI serves, instead of the `/margin/v2/margin/...` path
+  that 404s ([#10](https://github.com/aaronmgn/stonepy/issues/10)).
+
+### Added
+
+- `EndpointSpec.host_rooted`: endpoints flagged host-rooted resolve their path against the server
+  host root (scheme and host of `base_url`) rather than the configured base path, so CIAPI's
+  `/v2` session and account endpoints can be reached from the same `base_url` as the `/TradingAPI`
+  resources.
+
 ## [0.2.0] - 2026-06-27
 
 ### Added
@@ -116,7 +165,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Generated endpoint bindings, DTO models, synchronous and asynchronous clients, retry handling,
   rate-limit handling, and typed resource groups.
 
-[Unreleased]: https://github.com/aaronmgn/stonepy/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/aaronmgn/stonepy/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/aaronmgn/stonepy/releases/tag/v0.2.2
+[0.2.1]: https://github.com/aaronmgn/stonepy/releases/tag/v0.2.1
 [0.2.0]: https://github.com/aaronmgn/stonepy/releases/tag/v0.2.0
 [0.1.3]: https://github.com/aaronmgn/stonepy/releases/tag/v0.1.3
 [0.1.2]: https://github.com/aaronmgn/stonepy/releases/tag/v0.1.2

{stonepy-0.2.0 → stonepy-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stonepy
-Version: 0.2.0
+Version: 0.2.2
 Summary: Python client for the StoneX (CIAPI) v2 trading API
 Project-URL: Homepage, https://github.com/aaronmgn/stonepy
 Project-URL: Repository, https://github.com/aaronmgn/stonepy

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/__init__.py

@@ -18,7 +18,7 @@ from stonepy._core.errors import (
 )
 from stonepy.client import AsyncStoneXClient, StoneXClient
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 __all__ = [
     "AsyncStoneXClient",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_core/config.py

@@ -11,7 +11,7 @@ from stonepy._core.logging import safe_repr
 from stonepy._core.status import StatusDecoder, default_status_decoder
 
 _T = TypeVar("_T")
-_FALLBACK_VERSION = "0.2.0"
+_FALLBACK_VERSION = "0.2.2"
 
 
 def _default_user_agent() -> str:

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_core/endpoint.py

@@ -56,6 +56,9 @@ class EndpointSpec(Generic[ResponseT]):
         response_model: The Pydantic model the response body is validated against.
         request_model: The Pydantic model for the request body, if any.
         params: The ordered path, query, and body parameter bindings.
+        host_rooted: Whether ``path`` is resolved against the server host root rather than the
+            configured base URL. CIAPI serves its v2 session and account endpoints from
+            ``/v2`` at the host root, not under the ``/TradingAPI`` base.
     """
 
     name: str
@@ -67,3 +70,4 @@ class EndpointSpec(Generic[ResponseT]):
     response_model: type[ResponseT]
     request_model: type | None = None
     params: tuple[Param, ...] = field(default_factory=tuple)
+    host_rooted: bool = False

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_core/transport.py

@@ -225,7 +225,7 @@ def build_request(
     if extra_path_params:
         raise ValueError(f"Unexpected path params: {', '.join(sorted(extra_path_params))}")
 
-    url = base_url.rstrip("/") + path
+    url = _endpoint_root(base_url, spec).rstrip("/") + path
     headers = {"User-Agent": user_agent, **auth_headers}
     params.update(
         {
@@ -241,6 +241,19 @@ def build_request(
     return Request(spec.method, url, headers, params, content)
 
 
+def _endpoint_root(base_url: str, spec: EndpointSpec[Any]) -> str:
+    """Return the URL root for *spec*: the host root for host-rooted specs, else *base_url*.
+
+    CIAPI serves its v2 session and account endpoints from ``/v2`` at the host root rather than
+    under the configured ``/TradingAPI`` base, so a host-rooted spec drops the base path while
+    preserving the scheme and host (including any non-default port).
+    """
+    if not spec.host_rooted:
+        return base_url
+    parsed = urlsplit(base_url)
+    return urlunsplit((parsed.scheme, parsed.netloc, "", "", ""))
+
+
 def _assert_supported_param_locations(spec: EndpointSpec[Any]) -> None:
     for param in spec.params:
         if param.location == "path":

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/client_preference.py

@@ -20,7 +20,7 @@ DELETE_CLIENT_PREFERENCE_SPEC: EndpointSpec[ApiUpdateDeleteClientPreferenceRespo
     EndpointSpec(
         name="DeleteClientPreference v2",
         method="DELETE",
-        path="/clientPreference/v2/clientPreference?clientAccountId={clientAccountId}&key={key}",
+        path="/v2/clientPreference?clientAccountId={clientAccountId}&key={key}",
         idempotent=True,
         auth_policy=AuthPolicy.SESSION,
         rate_limit_bucket="client_preference",
@@ -55,7 +55,7 @@ GET_CLIENT_PREFERENCES_KEY_LIST_SPEC: EndpointSpec[ApiGetKeyListClientPreference
     EndpointSpec(
         name="GetClientPreferencesKeyList v2",
         method="GET",
-        path="/clientPreference/v2/clientPreference/keyList?clientAccountId={clientAccountId}",
+        path="/v2/clientPreference/keyList?clientAccountId={clientAccountId}",
         idempotent=True,
         auth_policy=AuthPolicy.SESSION,
         rate_limit_bucket="client_preference",
@@ -86,7 +86,7 @@ async def aget_client_preferences_key_list(
 GET_CLIENT_PREFERENCES_LIST_SPEC: EndpointSpec[ApiGetClientPreferencesResponseDTO] = EndpointSpec(
     name="GetClientPreferencesList v2",
     method="GET",
-    path="/clientPreference/v2/clientPreference/list?keys={string}&clientAccountId={clientAccountId}",  # noqa: E501
+    path="/v2/clientPreference/list?keys={string}&clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="client_preference",
@@ -124,7 +124,7 @@ GET_CLIENT_PREFERENCE_OVERRIDDEN_SETTINGS_SPEC: EndpointSpec[
 ] = EndpointSpec(
     name="GetClientPreferenceOverriddenSettings v2",
     method="GET",
-    path="/clientPreference/v2/clientPreference/overriddenSettings?clientAccountId={clientAccountId}",  # noqa: E501
+    path="/v2/clientPreference/overriddenSettings?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="client_preference",
@@ -154,7 +154,7 @@ async def aget_client_preference_overridden_settings(
 GET_CLIENT_PREFERENCE_SPEC: EndpointSpec[ApiGetClientPreferenceResponseDTO] = EndpointSpec(
     name="GetClientPreference v2",
     method="GET",
-    path="/clientPreference/v2/clientPreference?clientAccountId={clientAccountId}&key={key}",
+    path="/v2/clientPreference?clientAccountId={clientAccountId}&key={key}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="client_preference",
@@ -189,7 +189,7 @@ SAVE_CLIENT_PREFERENCE_OVERRIDDEN_SETTINGS_SPEC: EndpointSpec[
 ] = EndpointSpec(
     name="SaveClientPreferenceOverriddenSettings v2",
     method="POST",
-    path="/clientPreference/v2/clientPreference/overriddenSettings/save",
+    path="/v2/clientPreference/overriddenSettings/save",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="client_preference",
@@ -235,7 +235,7 @@ SAVE_CLIENT_PREFERENCE_SPEC: EndpointSpec[ApiUpdateDeleteClientPreferenceRespons
     EndpointSpec(
         name="SaveClientPreference v2",
         method="POST",
-        path="/clientPreference/v2/clientPreference/Save",
+        path="/v2/clientPreference/Save",
         idempotent=False,
         auth_policy=AuthPolicy.SESSION,
         rate_limit_bucket="client_preference",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/margin.py

@@ -10,7 +10,7 @@ from stonepy.models import ApiManagedClientAccountsMarginResponseDTO, ClientAcco
 GET_CLIENT_ACCOUNT_MARGIN_SPEC: EndpointSpec[ClientAccountMarginResponseDTO] = EndpointSpec(
     name="GetClientAccountMargin v2",
     method="GET",
-    path="/margin/v2/margin/clientAccountMargin?clientAccountId={clientAccountId}",
+    path="/margin/ClientAccountMargin",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="margin",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/market.py

@@ -140,7 +140,7 @@ GET_FULL_SEARCH_WITH_TAGS_SPEC: EndpointSpec[FullMarketInformationSearchWithTags
     EndpointSpec(
         name="GetFullSearchWithTags v2",
         method="GET",
-        path="/market/v2/market/fullSearchWithTags",
+        path="/v2/market/fullSearchWithTags",
         idempotent=True,
         auth_policy=AuthPolicy.SESSION,
         rate_limit_bucket="market",
@@ -371,7 +371,7 @@ GET_MARKET_INFORMATION_EXTENDED_SPEC: EndpointSpec[ApiGetMarketInformationExtend
     EndpointSpec(
         name="GetMarketInformationExtended v2",
         method="GET",
-        path="/market/v2/market/{marketId}/informationExtended?clientAccountId={clientAccountId}",
+        path="/v2/market/{marketId}/informationExtended?clientAccountId={clientAccountId}",
         idempotent=True,
         auth_policy=AuthPolicy.SESSION,
         rate_limit_bucket="market",
@@ -409,7 +409,7 @@ async def aget_market_information_extended(
 GET_MARKET_INFORMATION_SPEC: EndpointSpec[GetMarketInformationResponseDTOv2] = EndpointSpec(
     name="GetMarketInformation v2",
     method="GET",
-    path="/market/v2/market/{marketId}/information?clientAccountId={clientAccountId}",
+    path="/v2/market/{marketId}/information?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="market",
@@ -446,7 +446,7 @@ async def aget_market_information(
 GET_MARKET_SPREAD_SPEC: EndpointSpec[MarketSpreadData] = EndpointSpec(
     name="GetMarketSpread v2",
     method="GET",
-    path="/market/v2/market/spread?clientAccountId={clientAccountId}&marketId={marketId}",
+    path="/v2/market/spread?clientAccountId={clientAccountId}&marketId={marketId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="market",
@@ -1102,7 +1102,7 @@ async def alist_market_information_search(
 LIST_MARKET_INFORMATION_SPEC: EndpointSpec[ListMarketInformationResponseDTO] = EndpointSpec(
     name="ListMarketInformation v2",
     method="POST",
-    path="/market/v2/market/information",
+    path="/v2/market/information",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="market",
@@ -1389,7 +1389,7 @@ async def asave_market_information(
 SAVE_PRODUCT_INFORMATION_SPEC: EndpointSpec[ListProductInformationResponseDTO] = EndpointSpec(
     name="SaveProductInformation v2",
     method="POST",
-    path="/market/v2/market/productInformation",
+    path="/v2/market/productInformation",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="market",
@@ -1529,7 +1529,7 @@ async def asearch_with_tags(
 TAG_LOOKUP_SPEC: EndpointSpec[MarketInformationTagLookupResponseDTO] = EndpointSpec(
     name="TagLookup v2",
     method="GET",
-    path="/market/v2/market/tagLookup?clientAccountId={clientAccountId}",
+    path="/v2/market/tagLookup?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="market",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/message.py

@@ -154,7 +154,7 @@ GET_CLIENT_COMMUNICATION_MESSAGES_SPEC: EndpointSpec[ApiClientCommunicationRespo
     EndpointSpec(
         name="GetClientCommunicationMessages v2",
         method="GET",
-        path="/message/v2/message/clientCommunicationMessages?clientAccountId={clientAccountId}",
+        path="/v2/message/clientCommunicationMessages?clientAccountId={clientAccountId}",
         idempotent=True,
         auth_policy=AuthPolicy.SESSION,
         rate_limit_bucket="message",
@@ -223,7 +223,7 @@ async def aget_message_popup(
 GET_SECURE_MESSAGES_SPEC: EndpointSpec[SecureMessageCount] = EndpointSpec(
     name="GetSecureMessages v2",
     method="GET",
-    path="/message/v2/message/SecureMessages?clientAccountId={clientAccountId}",
+    path="/v2/message/SecureMessages?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="message",
@@ -305,7 +305,7 @@ SAVE_CLIENT_COMMUNICATION_MESSAGE_RESPONSE_SPEC: EndpointSpec[
 ] = EndpointSpec(
     name="SaveClientCommunicationMessageResponse v2",
     method="POST",
-    path="/message/v2/message/clientCommunicationMessageResponse",
+    path="/v2/message/clientCommunicationMessageResponse",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="message",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/order.py

@@ -66,7 +66,7 @@ async def acancel_order(
 GET_ACTIVE_STOP_LIMIT_ORDER_SPEC: EndpointSpec[GetActiveStopLimitOrderResponseDTOv2] = EndpointSpec(
     name="GetActiveStopLimitOrder v2",
     method="GET",
-    path="/order/v2/{orderId}/activeStopLimitOrder?clientAccountId={clientAccountId}",
+    path="/order/{orderId}/activeStopLimitOrder?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order",
@@ -250,7 +250,7 @@ async def aget_markets_trades_wall(
 GET_OPEN_POSITION_SPEC: EndpointSpec[GetOpenPositionResponseDTOv2] = EndpointSpec(
     name="GetOpenPosition v2",
     method="GET",
-    path="/order/v2/{orderId}/openPosition?clientAccountId={clientAccountId}",
+    path="/v2/order/{orderId}/openPosition?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order",
@@ -299,7 +299,7 @@ async def aget_open_position(
 GET_ORDERS_BY_REFERENCE_SPEC: EndpointSpec[GetOrdersResponseDTOv2] = EndpointSpec(
     name="GetOrdersByReference v2",
     method="GET",
-    path="/order/v2/order/orders/{reference}?clientAccountId={clientAccountId}",
+    path="/v2/order/orders/{reference}?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order",
@@ -336,7 +336,7 @@ async def aget_orders_by_reference(
 GET_ORDERS_SPEC: EndpointSpec[EnrichedOrderDTO] = EndpointSpec(
     name="GetOrders v2",
     method="GET",
-    path="/order/v2/orders?clientAccountId={clientAccountId}",
+    path="/v2/orders?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order",
@@ -367,7 +367,7 @@ async def aget_orders(
 GET_ORDER_HISTORY_SPEC: EndpointSpec[OrderHistoryDTO] = EndpointSpec(
     name="GetOrderHistory v2",
     method="GET",
-    path="/order/v2/orderhistory?clientAccountId={clientAccountId}",
+    path="/v2/orderhistory?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order",
@@ -429,7 +429,7 @@ async def aget_order_history(
 GET_ORDER_SPEC: EndpointSpec[GetOrderResponseDTOv2] = EndpointSpec(
     name="GetOrder v2",
     method="GET",
-    path="/order/v2/order/{orderId}?clientAccountId={clientAccountId}",
+    path="/v2/order/{orderId}?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order",
@@ -746,7 +746,7 @@ async def aorder(
 SAVE_ORDER_SPEC: EndpointSpec[ExecutionResponseDTO] = EndpointSpec(
     name="SaveOrder v2",
     method="POST",
-    path="/order/v2/save",
+    path="/v2/order",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/order_including_closed.py

@@ -10,7 +10,7 @@ from stonepy.models import SingleActiveStopLimitOrderResponseDTO
 GET_ORDER_INCLUDING_CLOSED_SPEC: EndpointSpec[SingleActiveStopLimitOrderResponseDTO] = EndpointSpec(
     name="GetOrderIncludingClosed v2",
     method="GET",
-    path="/orderIncludingClosed/v2/orderIncludingClosed/{orderId}?clientAccountId={clientAccountId}",  # noqa: E501
+    path="/v2/orderIncludingClosed/{orderId}?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="order_including_closed",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/preference.py

@@ -11,7 +11,7 @@ from stonepy.models import ApiGetPreferencesResponseDTO, ApiSavePreferencesReque
 DELETE_USER_PREFERENCE_SPEC: EndpointSpec[ResponseModel] = EndpointSpec(
     name="DeleteUserPreference v2",
     method="DELETE",
-    path="/preference/v2/Preference",
+    path="/v2/Preference",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="preference",
@@ -37,7 +37,7 @@ async def adelete_user_preference(
 GET_USER_PREFERENCE_SPEC: EndpointSpec[ApiGetPreferencesResponseDTO] = EndpointSpec(
     name="GetUserPreference v2",
     method="GET",
-    path="/preference/v2/Preferences",
+    path="/v2/Preference",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="preference",
@@ -63,7 +63,7 @@ async def aget_user_preference(
 SAVE_USER_PREFERENCE_SPEC: EndpointSpec[ResponseModel] = EndpointSpec(
     name="SaveUserPreference v2",
     method="POST",
-    path="/preference/v2/Preference/save",
+    path="/v2/Preference/save",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="preference",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/price_alert.py

@@ -112,7 +112,7 @@ async def asave_pa(ctx: CallContext, request: SaveAlertRequestDTOv2) -> Response
 SAVE_PRICE_ALERT_SPEC: EndpointSpec[SaveAlertResponseDTOv2] = EndpointSpec(
     name="SavePriceAlert v2",
     method="POST",
-    path="/priceAlert/v2/priceAlert/save",
+    path="/v2/priceAlert/save",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="price_alert",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/session.py

@@ -76,7 +76,8 @@ async def adelete_session(ctx: CallContext, user_name: str, session: str) -> Api
 LOG_ON_SPEC: EndpointSpec[ApiLogOnResponseDTOv2] = EndpointSpec(
     name="LogOn v2",
     method="POST",
-    path="/session/v2/Session",
+    path="/v2/session",
+    host_rooted=True,
     idempotent=False,
     auth_policy=AuthPolicy.NONE,
     rate_limit_bucket="session",
@@ -99,7 +100,7 @@ async def alog_on(ctx: CallContext, request: ApiLogOnRequestDTO) -> ApiLogOnResp
 VALIDATE_SESSION_SPEC: EndpointSpec[ApiValidateSessionResponseDTO] = EndpointSpec(
     name="ValidateSession v2",
     method="POST",
-    path="/session/v2/Session/validate",
+    path="/v2/Session/validate",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="session",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/user_account.py

@@ -46,7 +46,8 @@ async def aget_charting_enabled(ctx: CallContext, id: str) -> ResponseModel:
 GET_CLIENT_AND_TRADING_ACCOUNT_SPEC: EndpointSpec[AccountInformationResponseDTOv2] = EndpointSpec(
     name="GetClientAndTradingAccount v2",
     method="GET",
-    path="/userAccount/v2/userAccount/ClientAndTradingAccount",
+    path="/v2/UserAccount/ClientAndTradingAccount",
+    host_rooted=True,
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="user_account",
@@ -406,7 +407,7 @@ async def alist_topholders_for_markets(
 SAVE_ACCOUNT_INFORMATION_SPEC: EndpointSpec[ApiAccountInformationSaveResponseDTO] = EndpointSpec(
     name="SaveAccountInformation v2",
     method="POST",
-    path="/useraccount/v2/userAccount/Save",
+    path="/v2/userAccount/Save",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="user_account",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_endpoints/watchlist.py

@@ -15,7 +15,7 @@ from stonepy.models import (
 DELETE_WATCHLIST_SPEC: EndpointSpec[DeleteWatchlistResponseDTO] = EndpointSpec(
     name="DeleteWatchlist v2",
     method="DELETE",
-    path="/watchlist/v2/watchlists",
+    path="/v2/watchlists",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="watchlist",
@@ -50,7 +50,7 @@ async def adelete_watchlist(
 GET_WATCHLISTS_LIST_SPEC: EndpointSpec[ListWatchlistResponseDTO] = EndpointSpec(
     name="GetWatchlistsList v2",
     method="GET",
-    path="/watchlist/v2/watchlists/list?clientAccountId={clientAccountId}&ids={ids}",
+    path="/v2/watchlists/list?clientAccountId={clientAccountId}&ids={ids}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="watchlist",
@@ -111,7 +111,7 @@ async def aget_watchlists_list(
 GET_WATCHLISTS_SPEC: EndpointSpec[ListWatchlistResponseDTO] = EndpointSpec(
     name="GetWatchlists v2",
     method="GET",
-    path="/watchlists/v2/watchlists?clientAccountId={clientAccountId}",
+    path="/v2/watchlists?clientAccountId={clientAccountId}",
     idempotent=True,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="watchlist",
@@ -133,7 +133,7 @@ async def aget_watchlists(ctx: CallContext, client_account_id: int) -> ListWatch
 SAVE_WATCHLIST_SPEC: EndpointSpec[SaveWatchlistResponseDTO] = EndpointSpec(
     name="SaveWatchlist v2",
     method="POST",
-    path="/watchlist/v2/watchlists/save",
+    path="/v2/watchlists/save",
     idempotent=False,
     auth_policy=AuthPolicy.SESSION,
     rate_limit_bucket="watchlist",

{stonepy-0.2.0 → stonepy-0.2.2}/src/stonepy/_generator/emit_endpoints.py

@@ -12,7 +12,14 @@ from typing import Any
 from stonepy._generator.catalog import Catalog, EndpointRecord, python_name, python_type
 from stonepy._generator.render import BANNER, field_name, format_python, render_docstring
 
-__all__ = ["emit_all", "endpoint_spec_name", "render_binding", "resolved_path", "target_module"]
+__all__ = [
+    "emit_all",
+    "endpoint_spec_name",
+    "is_host_rooted",
+    "render_binding",
+    "resolved_path",
+    "target_module",
+]
 
 _VERSION_SUFFIX_RE = re.compile(r"\s+v\d+\s*$", re.IGNORECASE)
 _DEFAULT_VALUE_RE = re.compile(r"\bdefault\s+([^\s,;]+)", re.IGNORECASE)
@@ -50,20 +57,51 @@ _OPTIONAL_PARAM_OVERRIDES: dict[tuple[str, str], frozenset[str]] = {
     ("cfd", "ListCfdMarkets"): frozenset({"marketName", "marketCode"}),
 }
 
-# Catalog gap: the upstream "GetActiveStopLimitOrder v2" doc page templates its URI as
-# "/v2{orderId}/activeStopLimitOrder" — missing the slash after "v2" that every sibling v2 order
-# endpoint carries (GetOpenPosition v2 = "/v2/{orderId}/openPosition", GetOrder v2 =
-# "/v2/order/{orderId}"). Verified against docs.labs.gaincapital.com as an upstream documentation
-# typo (the page's own example request is ".../order/123456/activeStopLimitOrder"), so without this
-# correction the generated client would request the non-existent "/order/v2{orderId}/..." path.
-# Keyed by (target_module, endpoint name); mirrors the other curated catalog-gap overrides.
+# Per-endpoint path corrections for catalog gaps the systematic v2 de-doubling in resolved_path()
+# cannot cover (the documented uri_template is itself wrong). Each value was verified against the
+# live CIAPI demo by matching the response to the endpoint's typed DTO shape. Keyed by
+# (target_module, endpoint name).
 _PATH_OVERRIDES: dict[tuple[str, str], str] = {
-    (
-        "order",
-        "GetActiveStopLimitOrder v2",
-    ): "/order/v2/{orderId}/activeStopLimitOrder?clientAccountId={clientAccountId}",
+    # CIAPI serves logon and account lookup from the host root ("https://host/v2/...", see
+    # _HOST_ROOTED_ENDPOINTS), not the catalog's best-effort "/{target}/v2/..." which doubles the
+    # target segment and 401s. Confirmed against the reference pygcapi client (BASE_URL_V2 =
+    # "https://host/v2"): logon at "/v2/session", account at "/v2/UserAccount/...".
+    ("session", "LogOn v2"): "/v2/session",
+    ("user_account", "GetClientAndTradingAccount v2"): "/v2/UserAccount/ClientAndTradingAccount",
+    # CIAPI never shipped a working v2 margin route; account margin is served by the v1 endpoint
+    # "/margin/ClientAccountMargin" under the /TradingAPI base (the catalog's doubled
+    # "/margin/v2/margin/..." path 404s). Stays base-rooted, so no _HOST_ROOTED_ENDPOINTS entry.
+    ("margin", "GetClientAccountMargin v2"): "/margin/ClientAccountMargin",
+    # The active-stop-limit query is a v1-style route "/order/{orderId}/activeStopLimitOrder" (it
+    # returns the typed ActiveStopLimitOrder DTO live; matches the doc page's own
+    # ".../order/123456/activeStopLimitOrder" example). The catalog's "/v2{orderId}/..." template
+    # and any "/v2/..."/"/order/v2/..." variant 404.
+    ("order", "GetActiveStopLimitOrder v2"): (
+        "/order/{orderId}/activeStopLimitOrder?clientAccountId={clientAccountId}"
+    ),
+    # Open-position query needs the "order" segment after "/v2/" that the catalog template omits
+    # ("/v2/{orderId}/openPosition" 404s; "/v2/order/{orderId}/openPosition" returns the DTO live).
+    ("order", "GetOpenPosition v2"): (
+        "/v2/order/{orderId}/openPosition?clientAccountId={clientAccountId}"
+    ),
+    # SaveOrder posts to "/v2/order" (live: validates ClientAccountId); the catalog's bare
+    # "/v2/save" 404s.
+    ("order", "SaveOrder v2"): "/v2/order",
+    # The user-preference route is the singular "/v2/Preference"; the catalog pluralises it to
+    # "/v2/Preferences", which 404s.
+    ("preference", "GetUserPreference v2"): "/v2/Preference",
 }
 
+# CIAPI serves a few v2 endpoints from the host root ("https://host/v2/...") rather than under the
+# configured "/TradingAPI" base; their path is resolved against the host root (see
+# transport.build_request). Keyed by (target_module, endpoint name).
+_HOST_ROOTED_ENDPOINTS: frozenset[tuple[str, str]] = frozenset(
+    {
+        ("session", "LogOn v2"),
+        ("user_account", "GetClientAndTradingAccount v2"),
+    }
+)
+
 
 def endpoint_summary(rec: EndpointRecord) -> str:
     """Return a one-paragraph summary of an endpoint for use as a wrapper docstring."""
@@ -76,16 +114,29 @@ def endpoint_summary(rec: EndpointRecord) -> str:
 
 
 def resolved_path(rec: EndpointRecord) -> str:
-    """Return the endpoint path, applying curated catalog path-typo corrections.
-
-    The catalog's ``path``/``uri_template`` is authoritative except for the declared upstream
-    doc typos in ``_PATH_OVERRIDES``; this single resolver keeps the generated endpoint spec and
-    the generated contract test in agreement on the corrected value.
+    """Return the endpoint path, applying curated catalog path corrections.
+
+    Resolution order: an explicit ``_PATH_OVERRIDES`` entry wins; otherwise a v2 endpoint
+    (``uri_template`` beginning ``/v2/``) uses that template directly, because the catalog
+    composes ``path`` as ``/{target}{uri_template}`` and so doubles the resource segment the v2
+    template already carries (e.g. ``/market/v2/market/...``), which 404s on the live API. All
+    other endpoints keep the catalog ``path``. This single resolver keeps the generated endpoint
+    spec and the generated contract test in agreement on the corrected value.
     """
 
-    return _PATH_OVERRIDES.get(
-        (target_module(rec.target), rec.name), rec.path or rec.uri_template or ""
-    )
+    override = _PATH_OVERRIDES.get((target_module(rec.target), rec.name))
+    if override is not None:
+        return override
+    uri = rec.uri_template or ""
+    if uri.startswith("/v2/"):
+        return uri
+    return rec.path or uri or ""
+
+
+def is_host_rooted(rec: EndpointRecord) -> bool:
+    """Return whether *rec* is served from the host root rather than the configured base URL."""
+
+    return (target_module(rec.target), rec.name) in _HOST_ROOTED_ENDPOINTS
 
 
 def target_module(name: str | None) -> str:
@@ -181,6 +232,7 @@ class _Binding:
         spec_name: str,
         method: str,
         path: str,
+        host_rooted: bool,
         rate_limit_bucket: str,
         auth_policy: str,
         idempotent: bool,
@@ -200,6 +252,7 @@ class _Binding:
         self.spec_name = spec_name
         self.method = method
         self.path = path
+        self.host_rooted = host_rooted
         self.rate_limit_bucket = rate_limit_bucket
         self.auth_policy = auth_policy
         self.idempotent = idempotent
@@ -263,6 +316,7 @@ def _binding(
         spec_name=endpoint_spec_name(rec),
         method=method,
         path=path,
+        host_rooted=is_host_rooted(rec),
         rate_limit_bucket=target_module(rec.target),
         auth_policy=_auth_policy(rec),
         idempotent=_is_idempotent(rec, method),
@@ -370,6 +424,10 @@ def _binding_lines(binding: _Binding) -> list[str]:
         f"    name={_string_literal(binding.rec.name)},\n",
         f"    method={_string_literal(binding.method)},\n",
         f"    path={_string_literal(binding.path)},\n",
+    ]
+    if binding.host_rooted:
+        lines.append("    host_rooted=True,\n")
+    lines += [
         f"    idempotent={binding.idempotent},\n",
         f"    auth_policy=AuthPolicy.{binding.auth_policy},\n",
         f"    rate_limit_bucket={_string_literal(binding.rate_limit_bucket)},\n",