Skip to main content
External securities lending markets let you lend against ERC-3643 (T-REX) security tokens that were issued outside Trusset and imported into your instance. A borrower pledges security tokens, receives a settlement asset such as USDC, and repays with interest. Liquidity providers fund the pool and earn the supply rate. This differs from Stock Lending, which operates on stock tokens Trusset issued. Here the collateral is a third-party token you do not control, so the API exposes the compliance plumbing that makes such a token usable as collateral: adapter authorization, identity registry checks, and a named collateral agent recorded on every lock.

​
Base Path

Four resource groups sit under that path: Every request authenticates with an instance API key in the X-API-Key header. See Authentication. The instance bound to your key determines both the network and the data you can reach. Markets belonging to another instance return MARKET_NOT_FOUND.

​
Response Envelope

On failure, success is false, data is null, and error carries code and message. Schema failures use VALIDATION_ERROR with error.details listing each offending field. Always branch on success rather than on the HTTP status alone.

​
Writes

Every write endpoint returns unsigned transaction data for a wallet you control to sign and broadcast. Nothing is submitted on your behalf.
Some operations need more than one transaction. Those return SIGN_TRANSACTIONS with an ordered steps array that must be broadcast in sequence.
Once you have broadcast a transaction, call the same endpoint again with its hash in the body:
The API verifies the mined receipt, records the result against the market, and returns the values that only exist after execution, such as loanId, positionId, liquidationId, and auctionId. Verification checks that the transaction succeeded, targeted the market this endpoint operates on, and called the expected function on the entity you named. See Confirming a Transaction.
Positions, liquidity providers, and the transaction ledger are written on the confirm call. Broadcast without confirming and the loan is still live on-chain, but Trusset will not see it until the next reconciliation pass.

​
Collateral Modes

Every market is deployed in one of two modes, fixed at deployment. A single collateral token can back one market of each mode. FREEZE is the default. The adapter freezes the borrower’s tokens where they sit. The borrower keeps custody and no ERC-20 approval is needed to open a loan. This requires the market’s adapter to hold the agent role on the collateral token, granted by whoever controls that token’s agent administration. The token must implement the ERC-3643 freeze interface (isAgent and getFrozenTokens), which is checked at deployment and rejected with FREEZE_MODE_UNSUPPORTED_TOKEN if absent. CUSTODY escrows the tokens in the adapter. Borrowers must call approve on the collateral token before posting collateral, and the API returns that approval as an explicit step. This requires the adapter to be a verified holder on the token’s identity registry. If a return transfer is ever blocked by compliance, the borrower reclaims through Claim Escrowed Collateral. Both modes require the market’s liquidation router to be an eligible recipient of the collateral token, because a liquidation transfers seized tokens to it.

​
Pricing

There is no automatic price feed. Prices come from the issuer, as a net asset value the issuer publishes. Sync Oracle Price pushes a NAV on-chain. Sign Price returns an EIP-712 signed price that a borrower submits alongside their own transaction, updating the price atomically without a separate oracle write. Both require an explicit positive price, and both require the registered wallet to be an authorized signer on the market’s oracle. priceSource records how the market’s price is meant to be interpreted. NAV is the default. MARKET signals an observable market price and the contract responds by disallowing Dutch auctions and raising the auction floor premium. The backend applies no branching of its own on this field.

​
Units

Three separate decimal domains apply. Send and receive plain decimal strings in every case. Do not send base units. Both decimal values are on the market record from Get Market. Sending more decimal places than the target token supports returns VALIDATION_ERROR with the message Amount must be a number with at most N decimal places. Risk parameters are integers in basis points. 7500 is 75 percent. Health factor is a decimal string where 1.0 is the liquidation boundary: at or above is healthy, below is liquidatable.
The borrow asset is fixed at deployment. Any ERC-20 with 6 to 18 decimals is accepted, validated on-chain at deploy time. Omitting it selects USDC. See List Borrow Assets.

​
Market Lifecycle

1

Deploy

Deploy Market deploys the market, oracle, interest model, insurance fund, collateral adapter, and a liquidation router dedicated to this market, in one factory transaction.
2

Authorize

A new market cannot take loans until token-side authorizations are complete. Get Setup Steps returns the outstanding items with ready-to-sign calldata. These are executed by the token’s agent or identity registry operator, not by Trusset.
3

Configure

Update Market Config sets collateral factor, liquidation threshold, penalties, fees, caps, and auction behaviour. Defaults are seeded at deployment.
4

Price

Push an initial NAV with Sync Oracle Price. Loans revert against a stale price.
5

Fund

Liquidity providers deposit the borrow asset with Add Liquidity. The first deposit into an empty pool has a minimum.
6

Lend

Borrowers open positions with Open Loan.
Confirm readiness with Get Configuration Status before directing borrowers at a market.

​
Liquidations

A loan becomes liquidatable when its health factor falls below 1.0. What happens next depends on the market’s useDutchAuction setting. With Dutch auctions enabled, liquidation opens an auction whose price decays linearly from auctionStartPremium to auctionMinPremium over auctionDuration. Bidders buy collateral through Bid on Auction. Collateral unsold when the auction expires routes to the liquidation router through Settle Expired Auction. With Dutch auctions disabled, seized collateral transfers straight to the liquidation router and a pending liquidation is recorded. Once collateral reaches the router it does not sell itself. There is no auto-sell for external securities, because these instruments have no on-platform venue. The operator drives settlement explicitly:
1

Withdraw for sale

Withdraw Collateral for Sale moves collateral to a sale venue or custodian. The recipient must pass the token’s compliance checks.
2

Sell off-platform

Execute the sale through your own channel. Trusset is not involved.
3

Report proceeds

Report Partial Sale deposits interim proceeds into the router. Repeatable.
4

Settle

Settle Liquidation routes the cumulative proceeds to the market and closes the liquidation.
Proceeds above the debt plus liquidation penalty are returned to the borrower by the contract. If the settlement token blocks that transfer on compliance grounds, the surplus is escrowed on the market for the borrower to claim, rather than reverting the settlement. A liquidation left unsettled for 7 days can be written off with Handle Liquidation Timeout, which draws on the insurance fund to cover the bad debt. Write-off does not recover collateral from the router, so dispose of or return the collateral first.

​
Per-Market Liquidation Router

Each market gets its own SecurityLiquidationRouter, deployed by the factory in the same transaction. The market admin holds DEFAULT_ADMIN_ROLE on it and the liquidationOperator you nominate at deployment holds OPERATOR_ROLE. Trusset holds no role. Nominating the registered wallet as liquidationOperator is what allows settlement to be driven through this API. Every market payload carries liquidationRouterAddress. Endpoints that act on a liquidation resolve the correct router automatically. Markets deployed before per-market routers existed continue to use the shared legacy router, transparently.

​
Rate Limits

Read endpoints allow 100 requests per minute per API key. Write endpoints allow 10 per minute. Exceeding either returns 429 with code RATE_LIMIT_EXCEEDED. See Rate Limits.