These answers cover common technical questions about integrating with the Currency Data API. For every endpoint and parameter, see the API documentation. For an overview of our rates, see How does the Currency Data API work?

In this article

• Which endpoint should I use for each type of rate?
• How do I get the full list of currencies?
• Which currency pairs does the bid and ask endpoint cover?
• How does the API handle obsolete currencies?
• How do I get bid and ask rates from a central bank?
• Why does a central bank rate look like it's from the day before?
• Can I cache rates from the API?
• How do I get a past day's rate at my lock-in time?
• How do I find the SSL certificate for the API?
• Why am I getting timeouts or 500 errors?
• Do I need to allow-list IP addresses?
• Why am I getting 401 or 403 errors?

Which endpoint should I use for each type of rate?

Cryptocurrency rates come from our mid-market rates, so you request them through the mid-market endpoints. Add crypto=true to your request to include them.

How do I get the full list of currencies?

Use the /v2/currencies endpoint. For each currency, it shows:

• whether it's an ISO 4217 code
• the date it was introduced and, if it's obsolete, the date it was withdrawn
• the dates our rates for it start and end
• the currency that replaced it, and any peg

By default, the list includes active and obsolete currencies. To change this:

• add obsolete=true to show only obsolete currencies we have historical data for
• add obsolete=false to replace obsolete currencies with the currency that replaced them

Which currency pairs does the bid and ask endpoint cover?

The /v1/bid_ask endpoint covers AUD, BRL, CAD, CHF, CNH, DKK, EUR, GBP, JPY, NOK, NZD, PLN, SEK, and USD.

You can request any pair in either direction, except these pairs with CNH (offshore Chinese yuan):

• CNH isn't available with BRL, DKK, or PLN, in either direction.
• CNH is only available as the target currency with NOK and SEK. For example, you can request from=NOK&to=CNH but not from=CNH&to=NOK.

How does the API handle obsolete currencies?

Currencies are sometimes renamed, redenominated, or withdrawn. By default, the API answers in the currency used today, so if you request a withdrawn code, you get rates for the currency that replaced it. To get rates for the withdrawn code itself, add obsolete=true to your request.

We calculate rates for an obsolete currency after its withdrawal date from its fixed peg to the currency that replaced it. This keeps long histories consistent, but these aren't market rates.

For more detail, including how we calculate averages and statistics across a currency change, see Historic Rates & Obsolete Currencies in the API documentation.

How do I get bid and ask rates from a central bank?

Add fields=mid,bid,ask to your /v1/central_bank_rate request. Without it, you'll only get the mid rate.

• You'll only get bid and ask rates from central banks that publish them. 37 of the 100 central banks do, including the Bank of Japan, the Hong Kong Monetary Authority, the Central Bank of Brazil, and the Bank of Thailand. The European Central Bank, the Bank of England, and the Federal Reserve Bank of New York publish reference rates only. The Bid/Ask column in the API documentation shows which banks publish them.
• Bid and ask rates are for current rates only. If you add a date to your request, you'll get mid rates only.
• These are the rates each central bank publishes. They're different from Xe's own bid and ask rates from the /v1/bid_ask endpoint.

Why does a central bank rate look like it's from the day before?

If you don't give a date, /v1/central_bank_rate returns a timestamp in UTC. When you convert it to your local time, the rate can look like it's from the day before.

To get the bank's own local date instead, add use_bank_date=true to your request. For example, for the European Central Bank you'd get 2026-08-17 instead of 2026-08-16T22:00:00Z. This works for JSON, XML, and CSV responses.

Can I cache rates from the API?

Yes, for a limited time. Caching helps your integration run faster and reduces the number of requests you make. Remove cached rates once they're out of date. Caching means keeping rates temporarily. It doesn't mean storing them permanently.

How do I get a past day's rate at my lock-in time?

Call /v1/historic_rate with date=YYYY-MM-DD and use_lock_in_time=true. You'll get the rate as it stood at your account's daily lock-in time on that day. For example, you can use this to get Friday's rate during the following week.

Your lock-in time doesn't affect central bank rates. They follow each bank's own publishing schedule.

How do I find the SSL certificate for the API?

You can download the certificate from your browser, using Chrome or Edge.

In Chrome

1. Open Chrome and go to https://dfs.xe.com/dfs or https://xecdapi.xe.com/v1.

2. Select the site information icon on the left of the address bar.

   

3. Select Connection is secure, then select Certificate is valid.

   

4. In the certificate details window, go to the Details tab.

   

5. Select Export to download the certificate to your system.

   

In Edge

1. Go to https://dfs.xe.com/dfs or https://xecdapi.xe.com/v1.

2. Select the padlock icon in the address bar.

   

3. Select Connection is secure.
4. Select the certificate icon in the top right of the pop-up.

5. In the certificate window, open the Details tab.

   

6. Select Export to download the certificate.
   
   

Why am I getting timeouts or 500 errors?

Most intermittent timeouts and 5xx errors start in the network or gateway between your system and ours. Before you contact us, check your:

• Gateways and middleware: if you call the API through an integration platform or API gateway, check its logs first. Errors it creates itself can look like errors from our API.
• DNS: don't hard-code or cache our IP address. Resolve xecdapi.xe.com normally and respect DNS TTLs, because the IP address behind it can change.
• Timeouts and connection pools: make sure your client's settings allow for your request volume. Spread large batches out instead of sending them all at once.
• TLS: your client must support TLS 1.2 or later with modern (GCM) cipher suites. Older stacks, such as Java 7 or legacy .NET, may only offer CBC ciphers, which we're retiring. You can test your client against https://xecd-rates-api-test.xe.com/, which only accepts TLS 1.3, and TLS 1.2 with GCM.

If the errors continue, email us at data@xe.com with your account ID, the endpoint and parameters, the UTC times of the failures, and the full error response.

Do I need to allow-list IP addresses?

No. The Currency Data API doesn't restrict callers by IP address. You can call https://xecdapi.xe.com from any public IP, and you don't need to register yours with us.

If your firewall only allows outbound traffic to fixed IP addresses, use our static IP endpoint, xecd-proxy.xe.com, and add its IP address to your allow-list. for the current IP. We email everyone using this endpoint before its IP changes and before planned maintenance.

• Only use xecd-proxy.xe.com if you need a fixed IP. Otherwise, call xecdapi.xe.com directly.
• If requests start failing after a network change on your side, check your firewall's allow-list still includes our static IP.

If you use the legacy Datafeed (DFS)

DFS only accepts requests from allow-listed IPs. If your office or server IPs change, send us the new ones. If you move to the API, you won't need to allow-list IPs.

Why am I getting 401 or 403 errors?

• 401 Invalid credentials: check the account ID and API key your integration sends. Both are case-sensitive.
• 403 "exceeded max number of access attempts": after 3 failed authentication attempts, we block the account for up to 5 minutes. The block applies to every integration on the account, including ones using the correct credentials. It usually means another system, such as an old server or a test script, is still sending an out-of-date key.

To fix a 403 error:

1. Find the system sending the old key, and update it or switch it off.
2. Wait 5 minutes, then try again.