> ## Documentation Index > Fetch the complete documentation index at: https://docs.qfex.com/llms.txt > Use this file to discover all available pages before exploring further. # User Positions > Return current positions for the authenticated user. ## OpenAPI ````yaml /api-reference/openapi.yaml get /user/positions openapi: 3.1.0 info: contact: email: support@qfex.com name: QFEX Support description: REST API for QFEX license: name: QFEX License url: https://qfex.com/license title: QFEX REST API version: 0.1.0 servers: - description: Production server url: https://api.qfex.com security: [] paths: /user/positions: get: tags: - user summary: User Positions description: Return current positions for the authenticated user. operationId: read-user-positions responses: '200': content: application/json: schema: $ref: '#/components/schemas/PositionsBalanceResponseBody' description: OK default: content: application/problem+json: schema: $ref: '#/components/schemas/ErrorModel' description: Error security: - HMACSignature: [] Nonce: [] PublicKey: [] Timestamp: [] components: schemas: PositionsBalanceResponseBody: additionalProperties: false properties: $schema: description: A URL to the JSON Schema for this object. examples: - https://api.qfex.com/schemas/PositionsBalanceResponseBody.json format: uri readOnly: true type: string balance: $ref: '#/components/schemas/BalancePublic' positions: items: $ref: '#/components/schemas/PositionPublic' type: - array - 'null' required: - positions - balance type: object ErrorModel: additionalProperties: false properties: $schema: description: A URL to the JSON Schema for this object. examples: - https://api.qfex.com/schemas/ErrorModel.json format: uri readOnly: true type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string type: object BalancePublic: additionalProperties: false properties: available_balance: format: double type: number deposit: format: double type: number net_funding: format: double type: number order_margin: format: double type: number position_margin: format: double type: number realised_pnl: format: double type: number unrealised_pnl: format: double type: number required: - deposit - realised_pnl - order_margin - position_margin - unrealised_pnl - net_funding - available_balance type: object PositionPublic: additionalProperties: false properties: average_price: format: double type: number initial_margin: format: double type: number leverage: format: double type: number maintenance_margin: format: double type: number net_funding: format: double type: number open_orders: format: int64 type: integer open_quantity: format: double type: number position: format: double type: number realised_pnl: format: double type: number symbol: type: string unrealised_pnl: format: double type: number required: - symbol - position - realised_pnl - unrealised_pnl - net_funding - open_orders - open_quantity - leverage - initial_margin - maintenance_margin - average_price type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object securitySchemes: HMACSignature: description: HMAC-SHA256 signature (hex-encoded). in: header name: x-qfex-hmac-signature type: apiKey x-stoplight: hideExamples: true Nonce: description: Unique request nonce (hex encoded, max 100 characters). in: header name: x-qfex-nonce type: apiKey x-stoplight: hideExamples: true PublicKey: description: >- QFEX API Authentication requires these headers: - **x-qfex-public-key**: Your public API key - **x-qfex-hmac-signature**: HMAC signature of the request (hex encoded) - **x-qfex-nonce**: Unique nonce for the request (hex encoded, max 100 characters) - **x-qfex-timestamp**: Unix timestamp of the request These four are required. Optionally send **x-qfex-requested-account-id** (UUID) to act as a subaccount; see Signature Generation below. **Signature Generation:** 1. Generate a cryptographically secure random nonce (hex encoded, max 100 characters) and capture the current Unix timestamp. 2. Build the string `${nonce}:${unix_ts}` and compute an HMAC-SHA256 using your secret key. 3. Hex-encode the HMAC result to get the signature. 4. Send the required auth headers below. The nonce must be unique within a 15 minute window. **Important:** The signature itself must be hex-encoded before being sent in the `x-qfex-hmac-signature` header. **Optional header:** `x-qfex-requested-account-id` (UUID) selects a subaccount; omit it to use the primary account. in: header name: x-qfex-public-key type: apiKey x-stoplight: hideExamples: true Timestamp: description: Unix timestamp (seconds since epoch). in: header name: x-qfex-timestamp type: apiKey x-stoplight: hideExamples: true ````