Skip to main content
This page is the FIX session and message contract for the RFQ Network: which ports and dictionaries to use, how Logon authenticates, the four application messages you can send, the Kairos extension tags, and how rejections are reported. Read it if you connect over FIX; the same domain rules are described for HTTP clients in REST and streaming. Kairos exposes TLS-protected FIX endpoints for clients that require session sequencing, resend semantics, and low-latency RFQ commands.

Connectivity

Both listeners terminate TLS 1.2/1.3 at the network load balancer and are source-CIDR allowlisted; the regional RFQ listeners sit behind <region>.rfq.kairos.trade, and the unified Kairos FIX edge is fix.kairos.trade. Contact Kairos onboarding for connectivity, certificates, credentials, and the versioned dictionary bundle.
Gotcha: the unified edge has two extra requirements. Clients connecting through fix.kairos.trade are provisioned as static counterparty sessions with a mandatory per-session AllowedRemoteAddresses, and every application message on that edge must additionally carry KairosProduct(9200)=RFQ. That gateway loads a strict union dictionary covering RFQ, auction, order-entry, and drop-copy messages; the RFQ bundle below is the scoped client subset.
Download the current Kairos RFQ FIX v1 dictionary bundle. Each release contains both session variants, the application dictionary, the protocol README, and SHA256SUMS. Versioned archives are immutable; the v1 URL tracks the latest backwards-compatible v1 release.

Logon

Credentials

Credentials are the ordinary Kairos API credential pair, created and revoked through the admin API-key procedures; Kairos stores only hashes and returns the plaintext once.

Session parameters

Authorization

The credential’s scopes gate every application message, and its ipWhitelist is revalidated during authentication, so a Logon from an unlisted source is refused even on an allowlisted CIDR. Revoked credentials reject new Logons immediately; existing sessions reauthenticate when their five-minute relay token expires. Aegis checks bearer JWT revocation for HTTP/WebSocket clients and is not on the FIX Logon path.
Gotcha: scopes are enforced per message, not at Logon. A session logs on successfully and then has individual commands rejected. The one exception is a credential whose scopes entitle it to no product at all, which is refused at Logon.

Logon failures

A failed Logon is answered with a Logon reject and a disconnect.

Application messages

Session messages 0 Heartbeat, 1 TestRequest, 2 ResendRequest, 3 Reject, 4 SequenceReset, 5 Logout, and A Logon are also supported. Any other application MsgType is rejected as unsupported. Command identifiers double as idempotency keys: QuoteReqID(131) for R, QuoteID(117) for S, and QuoteRespID(693) for AJ.

QuoteRequest (35=R)

Creates a requester RFQ. Example — a two-sided RFQ, one tag per line for readability (a real message is SOH-delimited on the wire):
On fix.kairos.trade, add 9200=RFQ (KairosProduct) to this and every other application message.

Quote (35=S)

Creates or revises a market-maker quote. At least one complete price/size pair is required. Example — a two-sided quote against a venue-originated RFQ:
To revise it, resend 35=S with the same QuoteID(117) and 9006=<current + 1>.

QuoteResponse (35=AJ)

Accepts (hits or lifts) a quote. Acceptance binds the quote revision, side, quantity, expected price, and mapping snapshot. Example — lifting the offer for 25:

QuoteCancel (35=Z)

Withdraws a quote or cancels an RFQ, depending on which identifier you send. One of the three is required.
Gotcha: QuoteCancel derives its idempotency key from the resource ID, not from a client-supplied identifier — unlike every other command on this session.

QuoteStatusReport (35=AI)

Sent for every accepted command. Empty values are omitted rather than sent blank.

Kairos extension tags

Tags 9000–9011 are the version 1.0 Kairos extension range.

Data formats

The server loads these dictionaries with unknown messages, unknown fields, out-of-order fields, and invalid messages rejected. Rules that XML cannot express — such as requiring either an RFQ ID or request ID, or at least one complete bid/offer pair — are enforced by the same deterministic application validator used by REST.

Rejections

Session-layer: Reject(35=3)

Standard SessionRejectReason(373) values:

Application-layer: BusinessMessageReject(35=j)

BusinessRejectRefID(379) echoes QuoteReqID(131) or, failing that, QuoteID(117).
Gotcha: 380=5 is not a reliable discriminator. Nearly every business failure arrives under it, so branch on Text(58) rather than on the reason code.

On the unified edge (fix.kairos.trade)

RFQ commands are relayed to the RFQ service, and a rejection returns 380=0 with a stable machine-readable code in Text(58): An idempotent replay is acknowledged with QuoteStatusReport(AI) carrying KairosState(9009) of duplicate.

Machine-readable contract

The complete message-by-message field contract and business rules are included in spec/kairos/README.md beside the dictionary files.