Added: 2026-Oct-1To Be Released: 2026-Oct-13The Transfer funds between profiles) REST endpoint now returns the transfer_id in a 200 successful response. Previously, we returned an empty 200 response.
Portfolio Isolation and Cross Portfolio Access for API Keys
Added: 2026-Sep-30To Be Released: TBDWe’re adding an opt-in portfolio isolation setting for API keys. When on, every key is limited to its own portfolio on all REST endpoints, including endpoints that return account-wide data today (GET /profiles, GET /orders?profile_id=, GET /transfers, GET /reports). Requests for another profile_id return 403 Forbidden. Order entry, FIX, and WebSocket don’t change.What to do: Nothing until you enable it. If you plan to enable it, note which integrations use the endpoints above so you can mark their keys for cross portfolio access during the enablement process.Enable it under Settings > Security. During enablement, the system asks you to pick the keys to enable for cross portfolio access. You can choose specific keys or all keys. Any key you don’t select is limited to its own portfolio. When you create a new key, you can also choose whether to enable it for cross portfolio access.See Portfolio Isolation and Cross Portfolio Access.
Adjusting fields returned in OrderCancelBatchReject (35=U5) FIX API messages
Updated: 2026-Sep-18To Be Released: 2026-Sep-25Please note that we are updating the behavior of the OrderCancelBatch (U4) message.Currently, when a batch cancel is submitted using ClOrdID (11) as the identifier and the referenced order does not exist, no response message is returned. Going forward, such requests will receive an explicit OrderCancelBatchReject (U5). In the reject message, OrigClOrdID (41) will be populated, while OrderID (37) will remain unpopulated.
Added: 2026-Sep-18We’ve added support for synthetic product orders, which let you submit a single order for an unlisted pair (e.g. QNT-DASH) that Coinbase decomposes into two legs sharing a hop currency and executes atomically in the matching engine. Synthetic product orders are supported in FIX 5.0 and the Create a new order REST API. See Synthetic Product Orders for details.
Synthetic product orders are currently available in the sandbox environment only. Production launch date is TBD.
Removing SenderSubID (50) from Execution Reports (8)
Updated: 2026-Mar-09To Be Released: 2026-Mar-12On March 12th at 18:00 UTC (2:00 PM EST) we will be deploying a change to our FIX engines to remove the SenderSubID (50) = TEST that is returned on every execution report from the exchange. TEST does not represent a value that should be used in anyway and SenderSubID (50) is marked as optional in the data dictionaries that can be downloaded in our documentation.Please note all the other tags and values for execution reports will not be changed and can be found here: https://docs.cdp.coinbase.com/exchange/fix-api/order-entry-messages/order-entry-messages5#executionreport-35=8
Updated: 2025-Dec-02To Be Released: 2025-Dec-04We are expanding OrderCancelReplaceRequest (35=G) to support additional order types. Currently, this message only supports limit orders. With this update, you will also be able to modify stop orders and TPSL (Take Profit/Stop Loss) orders using the cancel-replace workflow.
Deleting travel rule fields in POST /withdrawals/crypto REST API
Updated: 2025-Jan-13We are removing travel rule fields from POST /withdrawals/crypto REST API. Customers in travel rule jurisdictions can withdraw only to their allowlisted addresses.
Added: 2025-Jan-8We are introducing a new REST endpoint to edit an editing existing address book entry - useful for customers in travel rule jurisdictions.
This endpoint requires the API key to have MANAGE permissions.Non travel-rule jurisdictions can only edit the label of the address book entry.Example request PUT https://api.exchange.coinbase.com/address-book/{id}. Here {id} refers to uuid of the crypto address.
{ "label": "string", // label for crypto address "is_certified_self_send": bool // true if customer owns the address/ false if it is a third party address "vasp_id": "string" // optional - vasp name from supported list if the wallet address is a VASP address "is_verified_self_hosted_wallet": bool // optional - true if the wallet is verified self-hosted wallet "business_name": "lorem ipsum", // required for third-party address; ie is_certified_self_send is false "business_country_code": "DE" // ISO 3166-1 alpha-2 country code required for third-party address; ie is_certified_self_send is false}
