🔑 Login Flow (fixed endpoints)

1) TOTP Login → returns viewToken + viewSid

curl -X POST "https://mis.kotaksecurities.com/login/1.0/tradeApiLogin" \
  -H "Authorization: <access_token>" \
  -H "neo-fin-key: neotradeapi" \
  -H "Content-Type: application/json" \
  -d '{
        "mobileNumber": "<+91XXXXXXXXXX>",
        "ucc": "<client_code>",
        "totp": "<6_digit_totp>"
      }'

2) MPIN Validate → returns session token (Auth) + session sid (Sid) + baseUrl

In your collection, viewSid and viewToken are sent as headers to this call.

curl -X POST "https://mis.kotaksecurities.com/login/1.0/tradeApiValidate" \
  -H "Authorization: <access_token>" \
  -H "neo-fin-key: neotradeapi" \
  -H "sid: <viewSid_from_previous_step>" \
  -H "Auth: <viewToken_from_previous_step>" \
  -H "Content-Type: application/json" \
  -d '{
        "mpin": "<mpin>"
      }'

📌 Response gives you:

• baseUrl (use it for all post-login APIs)
• Auth = session token
• Sid = session sid

🔁 Using baseUrl (important)

If MPIN validate returned:

"baseUrl": "https://neo-gw.kotaksecurities.com/xyz"

and the spec shows:

{{baseUrl}}/quick/order/cancel

then your final URL is:

https://neo-gw.kotaksecurities.com/xyz/quick/order/cancel

👉 Just replace {{baseUrl}} with the returned string. No braces in the final URL.