Getting balances, positions and deal history out of a funded FxPro account

Open the Trade tab on a funded FxPro account and the app shows balance, equity, margin, free margin and margin level moving in real time, next to every open position and pending order. That same login can front a MetaTrader 4 book, a MetaTrader 5 book, or — through the companion cTrader build with its single cTID sign-in — a cTrader account. Three different backends, one trader. The localized name here, Giao dịch vàng, is Vietnamese for “gold trading,” and gold (XAUUSD) is usually the first instrument a buyer of this data wants reconciled. Pulling a current, single view of that account into your own systems is the job this page is about.

The dependable basis for reading any of this is the access the trader already holds. For MT4 and MT5 books that is a read-only investor password; for cTrader it is cTID OAuth consent. Both surface balances, positions and the full deal history without ever granting permission to place or change a trade. We build to that read-only boundary and fold the three platforms into one schema, so a mixed portfolio reads as a single account record.

No bank open-banking regime governs a CFD trading account, so we don't pretend one does. The account holder's own authorization is the route, and it is a clean one.

What an FxPro account actually exposes

Each row below is something the app or its platforms genuinely surface to the account holder, mapped to where it comes from and what an integrator does with it.

Routes into a funded account

Read-only credential access (MT4 / MT5 investor password)

The trader issues a MetaTrader investor (read-only) password from the platform's password settings. We connect with it and read open trades plus the complete account history; the login carries no trading permission at all, which is exactly the boundary we want. Low effort, durable, and the trader can revoke it by changing the password. This is the route most FxPro accounts come in on.

cTID OAuth consent (cTrader Open API)

For accounts on cTrader, authorization runs on OAuth 2.0: the trader consents through cTID and picks which linked accounts to share, we exchange the authorization code for an access token, authenticate the application, then authenticate each account. Messages travel as Protocol Buffers or JSON against the cTrader backend. Reachable here: current positions and orders via reconcile, and closed deals with realized P&L. Durable, because it rides a published protocol rather than a screen.

Authorized protocol analysis of the app session

When a client needs the live quote and order-event stream the read-only logins don't carry, we document the trading session the FxPro app runs against its servers, working from a consenting account. Higher effort, and it tracks the app version, so we plan re-validation when the app updates.

Native statement export

From an MT4 terminal, Account History right-clicks to Save as Report and writes an HTML or Excel file. It is point-in-time rather than live, but it is a clean independent cross-check on whatever the sync produces.

What I'd actually do on a mixed book: take the read-only investor password for the MT4 and MT5 accounts, add cTID OAuth for anything on cTrader, and reconcile both into one record. Keep the Account History export as an independent check on the numbers. Reach for full protocol analysis only when someone needs the live tick and order stream the read-only logins leave out.

What lands in your repository

• OpenAPI / Swagger spec for the normalized endpoints — accounts, positions, deals, wallet transfers — so the FxPro data has a clean contract on your side regardless of which platform it came from.
• Protocol & auth-flow report: the cTID OAuth exchange (authorization code → access token → application auth → account auth) and the MetaTrader read-only login chain, documented field by field with the error and retry cases.
• Runnable source in Python and Node.js: the cTrader reconcile and deal-list pull, plus the MT4/MT5 read-only reader, with symbol mapping and UTC normalization built in.
• Automated tests run against a consenting demo account, covering token refresh, an empty book, and a multi-position reconcile.
• Interface documentation and compliance notes — read-only scoping, consent logging, retention and data-minimization guidance.

A reconcile, end to end

The cTrader path is the most worth showing, because the OAuth and message sequence is where most of the work sits. Message names below are verified against cTrader's Open API docs during the build.

# cTrader Open API — read-only account pull (illustrative)

# 1. OAuth 2.0: trader consents via cTID; we receive a short-lived code.
#    Per cTrader's auth docs the authorization code expires ~one minute
#    after issue, so the exchange has to happen inside that window.
token = exchange_code_for_token(auth_code)        # long-lived access token

# 2. Authenticate the application, then each consented account.
send(ProtoOAApplicationAuthReq(clientId=CID, clientSecret=SECRET))
send(ProtoOAAccountAuthReq(ctidTraderAccountId=ACC,
                           accessToken=token.access))

# 3. Current state: open positions + pending orders.
res = send(ProtoOAReconcileReq(ctidTraderAccountId=ACC))
#   -> ProtoOAReconcileRes.position[], .order[]

# 4. Closed history: deals carrying realized P&L.
deals = send(ProtoOADealListReq(ctidTraderAccountId=ACC,
                                fromTimestamp=since, toTimestamp=now))
#   -> ProtoOADeal[].closePositionDetail (entry, close, swap, commission)

# transport is Protobuf or JSON over the cTrader backend

MT4 and MT5 books come in through the read-only login instead, returning the same shape of data — open positions and the account-history ledger — which we then map onto the schema below.

One schema across MT4, MT5 and cTrader

The point of the build is that the platform stops mattering downstream. Whatever the source, an account resolves to one record:

{
  "broker": "FxPro",
  "account_id": "<masked>",
  "platform": "mt5",                  // mt4 | mt5 | ctrader
  "currency": "USD",
  "balance": 10250.40,
  "equity": 10180.12,
  "margin": 412.50,
  "free_margin": 9767.62,
  "margin_level_pct": 2467.3,
  "positions": [
    { "symbol": "XAUUSD", "side": "buy", "volume": 0.10,
      "open_price": 2338.55, "sl": 2310.00, "tp": 2390.00,
      "swap": -1.20, "unrealized_pnl": 64.00 }
  ],
  "deals": [
    { "symbol": "XAUUSD", "type": "sell", "volume": 0.20,
      "open_price": 2351.10, "close_price": 2362.40,
      "open_time": "2026-06-18T08:14:02Z",
      "close_time": "2026-06-18T11:02:55Z",
      "swap": -2.40, "profit": 226.00 }
  ]
}

Things we plan around on this build

A few specifics about FxPro shape the work, and we handle each as part of the engagement rather than handing it back as a requirement:

• One FxPro login can mix MT4, MT5 and cTrader accounts. We detect which platform each account lives on and route it to the right protocol, so a portfolio split across platforms still reconciles into the single record above.
• A cTrader access token is long-lived but the authorization code that mints it lasts about a minute. We build the OAuth exchange to capture and persist the token inside that window and refresh ahead of expiry, so the sync never quietly stalls.
• MetaTrader server time and instrument-symbol suffixes vary by server and account type. We normalize every timestamp to UTC and map symbol variants, so gold reads consistently whether the server names it XAUUSD or a suffixed variant.
• The whole integration is scoped to read. Because the investor password and the OAuth scope we request carry no trade permission, no part of the delivery can place or modify an order — a property we keep, not a limit we hit.

Authorization and the regulators behind the account

FxPro runs through several entities, and which one holds an account depends on residency. Per FxPro's own licences disclosure, FxPro Global Markets Ltd is authorized by the Securities Commission of The Bahamas (SIA-F184) — the entity the app's listing names — while other clients sit under FxPro UK Ltd (FCA), FxPro Financial Services Ltd (CySEC) and the FSCA-registered South African entity. Personal data for EU-facing clients falls under GDPR. None of that changes the protocol; it changes whose consent record and data-handling rules we log against.

Access is arranged with the account holder during onboarding — a read-only investor password, or cTID OAuth consent scoped to the accounts they choose to share. We log the consent, keep records data-minimized to the fields a project needs, and work under NDA where a client asks for one. Consent is revocable: change the investor password, or withdraw the cTID grant, and the access ends.

Screens we worked from

Store screenshots of the FxPro app — the surfaces the data integration maps against. Tap to enlarge.

Other brokers in the same integration shape

Same problem, different broker: each of these holds per-account trading records a unified integration would normalize the same way.

• IG — forex, indices and shares CFDs with a large instrument range and its own account portal.
• Pepperstone — MT4, MT5 and cTrader accounts, so the same three-platform reconcile applies.
• OANDA — forex and CFD accounts with detailed transaction histories.
• eToro — CFDs plus direct shares and crypto, with copy-trading portfolios on top.
• Plus500 — CFD-only accounts on a proprietary platform.
• XTB — forex and CFD accounts on the xStation platform.
• IC Markets — MetaTrader and cTrader books aimed at high-volume traders.
• AvaTrade — MetaTrader and proprietary accounts across forex, metals and indices.
• CMC Markets — a broad CFD and spread-betting range with rich account statements.

Questions integrators ask about FxPro

Can you reconcile MT4, MT5 and cTrader accounts that sit under one FxPro login into a single record?

Yes. We detect which platform each account lives on, read MT4 and MT5 books over the MetaTrader read-only login and cTrader accounts over cTID OAuth, then map all three into one normalized schema with consistent symbols and UTC timestamps.

Do you need my master password to read balances and positions?

No. A MetaTrader investor (read-only) password is enough to view open positions, balances and account history on MT4 and MT5, and cTrader uses cTID OAuth consent. Neither grants permission to place or change a trade, and we scope the whole build to read only.

Which FxPro entity and regulator covers the account, and does it change the work?

It depends on residency: FxPro Global Markets Ltd is regulated by the SCB in The Bahamas (SIA-F184) per FxPro's own disclosure, while other clients fall under the FCA, CySEC or FSCA entities. The protocol stays the same; what changes is whose consent record and data-handling rules we log against.

How current is the position and equity data, and what does the export route give instead?

Over the read-only login and cTrader's reconcile call, balances, equity and open positions are live to the account. The Account History report exported as HTML or Excel is a point-in-time snapshot, which we keep as an independent check on the synced numbers.

How this was put together

Mapping done against FxPro's own help and licences pages and cTrader's Open API documentation in June 2026: where the app shows balance and trade history on MT4/MT5, how the investor (read-only) password works, FxPro's regulated entities, and the cTrader OAuth and message flow used for the reconcile. Primary sources opened:

• FxPro help — account balance & trade history on MT4/MT5
• FxPro help — creating an MT4/MT5 investor (read-only) password
• cTrader Open API — app & account authentication
• FxPro — licences, regulation & memberships

Reviewed 2026-06-23 by the OpenBanking Studio integration desk.

Working together

Source code lands in your repository from $300, paid only after delivery once you've checked the pull against a real account — that covers the first model. The other is a hosted API you call per request for FxPro account data, with no upfront fee; you pay only for the calls you make. Either way the build runs on a one-to-two-week cycle. Tell us the account setup and what you want out of it through the contact page, and we'll take it from there. You bring the account name and the requirement; access and compliance get arranged with you.