my-api.hata.io api.luno.com read-only · no credentials … upstream calls snapshot, see why

Work sample: Hata vs Luno liquidity benchmark

The Product Analyst posting asks for competitor benchmarking and for finding operational bottlenecks. This does both: every MYR pair Hata lists, measured against Luno at the same instant, plus what the platform's minimum order actually costs a user on each book. Built by Edward Tay for the Product Analyst application. Not affiliated with Hata or Luno.

Why this is a stamped snapshot rather than a live read

Three things, and together they are finding number three on the checks tab.

1. Hata's public API returns 403 to any request carrying an Origin header, and sends no Access-Control-Allow-Origin. A browser can never call it.

2. Both Hata hosts sit behind Cloudflare, so a Cloudflare Worker proxying them fails with Cloudflare error 1042. The usual edge workaround is unavailable.

3. Hata also returns 403 to a default scripted user-agent, so a client has to send a browser string.

So the only way to read this data is a plain server-side process spoofing a browser. That is refresh.py in the repo, run by hand and stamped. In production it would be a cron job writing to object storage. Saying that plainly is better than pretending the page is live.

Every Hata MYR pair against Luno, sorted by Hata volume

Pair	Hata bps	Luno bps	Hata 24h MYR	Luno 24h MYR	Relative volume	Px div bps	Levels
loading the snapshot…

Spread is top-of-book, in basis points of mid. Luno volume is converted from base units to MYR at Luno's own mid, so both columns are ringgit notional. Px div is Hata's mid against Luno's mid at the same instant; negative means Hata is quoting below Luno. Figures move with the market.

The finding. min_notional is a flat MYR 10 on every pair, whatever the spread. So the smallest order a user is permitted to place costs very different amounts depending on which pair they picked. This spends MYR 10 buying on each pair, then sells back the exact quantity acquired, and reports what fails to come back. Spread and slippage only, before any fee. It is the difference between a product decision and a complaint queue.

Pair	Spread bps	Min order	Round-trip cost	Cost of MYR 10 in and back out	Verdict

What I would recommend

Tier min_notional by realised spread rather than setting it flat, or leave the minimum alone and show an estimated round-trip cost at order entry whenever the spread crosses a threshold. The second is smaller, ships in a sprint, and removes the surprise that generates the ticket.

Why this is a product problem, not a market problem

A wide spread on a quiet pair is normal and not anyone's fault. Permitting a MYR 10 order into it without saying what that costs is a design choice. The user finds out after the fill, which is when it becomes support's problem and, on a regulated venue, potentially a complaints-handling record.

Hata runs two exchange stacks under two regulators, and you can only see it from the API. my-api.hata.io serves the SC-licensed Malaysian book in MYR. api.hata.io serves the Labuan global book in USD and USDT. The OpenAPI spec confirms the split at the auth layer with /auth/api/v2/my/ and /auth/api/v2/ww/ namespaces. Neither hostname is documented.

my-api.hata.io · SC-licensed · MYR

api.hata.io · Labuan · USD / USDT

The global book, pair by pair

Pair	Price	24h base	24h quote

The question I would take into the room: the Labuan venue carries a licence, a listing surface and a support surface. On this tape it carries almost no volume. Is it a beachhead being funded deliberately, or a cost nobody has revisited since launch? That is a strategy question, and it is worth someone asking it out loud.

Independent work sample built by Edward Tay for the Hata Product Analyst application. Not affiliated with Hata or Luno, and not their code. Read-only, unauthenticated, public endpoints only: my-api.hata.io, api.hata.io and api.luno.com. Figures are a stamped snapshot from refresh.py, because Hata 403s any request with an Origin header, 403s default user-agents, and sits behind Cloudflare so a Worker proxy hits error 1042. That constraint is finding three on the checks tab. Write-up: hata.edwardtay.com