Quick start — buy Energy

# 1. What will it cost?
curl -X POST https://www.gulfbullionstack.tech/v2/estimate-buy-resource \
  -H 'Content-Type: application/json' \
  -d '{"resourceAmount": 131000, "durationSec": 3600, "unitPrice": "MEDIUM"}'

# -> {"data": {"unitPrice": 36, "estimateCost": 4716000, "availableResource": 131000}}

# 2. Place the order
curl -X POST https://www.gulfbullionstack.tech/v2/buy-resource \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
        "receiver": "TYOUR_TRON_ADDRESS_HERE",
        "resourceAmount": 131000,
        "durationSec": 3600,
        "unitPrice": "MEDIUM",
        "orderType": "NORMAL",
        "options": {"allowPartialFill": true}
      }'

# 3. Check on it
curl https://www.gulfbullionstack.tech/v2/order/<orderId> -H 'apikey: YOUR_API_KEY'

Endpoints

Self-custody purchase (signed transaction)

Estimate the cost, sign a TRX transfer of that amount to the platform wallet, then submit the signed transaction with the order. Nothing is held on your behalf.

const est = await post('/v2/estimate-buy-resource', {
  resourceAmount: 131000, durationSec: 3600, unitPrice: 'MEDIUM',
});

// Sign a transfer of est.data.estimateCost SUN to the platform wallet
const tx = await tronWeb.transactionBuilder.sendTrx(
  'TPKWueqW3PYtRQywp8SuZbnuLJJ8Auq4Hy', est.data.estimateCost, myAddress,
);
const signedTx = await tronWeb.trx.sign(tx);

await post('/v2/buy-resource', {
  receiver: myAddress,
  resourceAmount: 131000,
  durationSec: 3600,
  unitPrice: est.data.unitPrice,
  signedTx,
});

Safe retries

A request that times out leaves you guessing whether the order was placed. Send an Idempotency-Key and a retry returns the original result instead of buying twice. Reusing a key with a different body is rejected with 409, so a key collision can never silently overwrite an order.

# Both calls return the same orderId; only one order exists.
curl -X POST https://www.gulfbullionstack.tech/v2/buy-resource   -H 'apikey: YOUR_API_KEY'   -H 'Idempotency-Key: order-2026-09-08-0001'   -H 'Content-Type: application/json'   -d '{"receiver":"TR7...","resourceAmount":131000,"durationSec":3600}'

Webhooks

Register an endpoint and stop polling. Events: order.created, order.filled, order.partially_filled, order.cancelled, order.expired, deposit.credited, pool.repriced. Events are queued in the same database transaction as the change they describe, so you never hear about something that was rolled back. Failures retry with exponential backoff over roughly six hours.

Every request is signed. Verify it before trusting the body:

# Header: X-GoldStack-Signature: t=<unix>,v1=<hex>
import hmac, hashlib, time

def verify(secret, body, header, tolerance=300):
    parts = dict(p.split('=', 1) for p in header.split(','))
    if abs(time.time() - int(parts['t'])) > tolerance:
        return False  # too old: someone is replaying it
    expected = hmac.new(
        secret.encode(), f"{parts['t']}.{body}".encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, parts['v1'])

Compare the signature over the raw request body, before any JSON parsing — re-serialising changes the bytes and the digest will not match.