# flow_cross

> Sent when a FLOW cross line fires: the order flow imbalance of SPX options near the money, summed since the open, had the calls' side cross the puts' (calls minus puts changed sign). An event, not a signal: FLOW describes pressure as it happens, and a cross is not a forecast.

Source: https://firmtape.com/docs/developers/live/events/flow_cross

Sent when a FLOW cross line fires: the order flow imbalance of SPX options near the money, summed since the open, had the calls' side cross the puts' (calls minus puts changed sign). An event, not a signal: FLOW describes pressure as it happens, and a cross is not a forecast.

`POST your https address` · `X-FirmTape-Event: flow_cross`

Plan LIVE · Payload version 1 · Signed HMAC-SHA256 · Schema flow_cross.schema.json

**This event serves:** [LIVE: Alert lines](https://firmtape.com/docs/live#alert-lines), [LIVE: Webhooks](https://firmtape.com/docs/live#webhooks). **Plan:** [LIVE](https://firmtape.com/features/live). LIVE: today's session every second, alerts, ASK, the levels API and the platform integrations, and 5 LAB credits a month. Every finished session is free in REPLAY. Turn it on: Right-click the CVD band with FLOW on (Layers, Indicators, CVD) and pick Alert when calls and puts flow cross; a webhook address on Account, Level alerts.

## When it is sent

- At the first second the net since the open reaches or passes zero, read every 5 seconds from the per-second tape.
- Armed again only once the net stands at least 20% of the day's largest net so far from zero, and never less than 1,000 contracts, so it does not chatter around zero.

## Payload

| Field | Meaning | Unit |
| --- | --- | --- |
| `version` (1) | Payload version, `1`. |  |
| `id` (string) | Event id, `evt_` and 24 hex digits. The same on every try and for every account the event goes to: drop one you have seen. |  |
| `type` ("flow_cross") | `flow_cross`. |  |
| `symbol` (string) | SPX, ES, NQ, RTY or a ticker. |  |
| `level` (object) | `kind` is `flow`; `value` is 0, the zero the net crossed. |  |
| `price` (number \| null) | The price at the event. Null on a `premarket` event (see `phase`). | index points |
| `book` (volume \| open_interest \| measured \| volume+open_interest) | The book the event was read in, as the account picked it for that card: `volume`, `open_interest`, `measured` (SPX, ES, NQ), or `volume+open_interest` (levels of interest only, as on the chart). A symbol without the book picked is read in `volume`. |  |
| `ts` (string) | When it was found, ISO 8601 in New York time. |  |
| `day` (string) | The ET trading day. |  |
| `levels` (object) | The flip and the walls of the book in `book` at the event (the volume book's for `volume+open_interest`). |  |
| `levels.flip` (number \| null) | Flip. | index points |
| `levels.call_wall` (number \| null) | Call wall. | index points |
| `levels.put_wall` (number \| null) | Put wall. | index points |
| `levels.put_support` (number \| null) deprecated | The put wall under its first name. Deprecated: read `put_wall`; removed after 2026-11-30. | index points |
| `text` (string) | The sentence Telegram and push show, ending in the time it fired, ET. |  |
| `direction` (above \| below) | `above`: the calls' flow crossed above the puts'; `below`: the reverse. |  |
| `threshold_points` (number) | Sized events (`flip_move`, `level_near`, `interest_near`, `level_touch`, `interest_touch`): the size the account picked, SPX points. | index points |
| `threshold_minutes` (number) | `level_beyond`, `interest_beyond`: the one-minute closes in a row the account picked. | minutes |
| `from` (string) | ES, NQ, RTY: the index whose book moved by the basis gives the levels. |  |
| `basis` (number \| null) | ES, NQ, RTY: the basis at the event. | index points |
| `levels_asof` (string \| null) | Symbols on a five-minute book: when that book was built. |  |
| `phase` (premarket) | Present only when a price line fired before the bell, from 04:00 ET to the open on a trading day: `premarket`. The line was crossed on the premarket's minute prices; `price` is then null, and `levels` are the previous session's closing levels. Absent on every event in the session. |  |
| `alert` (object) | The line that fired: `scope` (`z0` 0DTE, `nx` the next expiries, `all`), `mode`. |  |
| `joins` (array) | One event for several levels on one price (a wall and levels of interest): the types it stands for, e.g. `["wall_break", "interest_cross"]`. |  |
| `flow` (object) | `net` the calls' minus the puts' order flow since the open at the firing second, in contracts of quoted size; `at` that second, ET. |  |

## Delivery

- **Answer**: Any 2xx within 3 seconds. Redirects are not followed.
- **Retries**: No answer, a 429 or a 5xx: tried again after 1 s and 4 s, three tries in all, the same id each time.
- **Switched off**: After 10 failed events in a row; the account page shows why. Saving the address switches it on again.
- **Volume**: Up to 30 events a minute per account; past that they are dropped and counted on the account page.
- **Test**: `type: "test"`, from **Send test**
- **Log**: The last delivery (time, status, tries) on the account page.

## Request we send

```
POST https://your.server/firmtape
Content-Type: application/json
User-Agent: FirmTape-Webhooks/1
X-FirmTape-Event: flow_cross
X-FirmTape-Event-Id: evt_4c7d1e9a2b3f6a0d8e5c1b7a
X-FirmTape-Timestamp: 1760034725
X-FirmTape-Signature: sha256=9b1e...
```

## Body

```json
{
  "version": 1,
  "id": "evt_4c7d1e9a2b3f6a0d8e5c1b7a",
  "type": "flow_cross",
  "symbol": "SPX",
  "price": 6748.25,
  "book": "volume",
  "ts": "2026-11-06T10:52:46-05:00",
  "day": "2026-11-06",
  "levels": {
    "flip": 6731.08,
    "call_wall": 6750,
    "put_wall": 6700,
    "put_support": 6700
  },
  "level": {
    "kind": "flow",
    "value": 0
  },
  "direction": "above",
  "text": "SPX FLOW: calls crossed above puts (net +1,349 since the open, 0DTE), your FLOW cross line · 10:52:46 ET",
  "flow": {
    "net": 1349,
    "at": "10:52:46"
  },
  "alert": {
    "id": "al_7d8e9f0a1b2c",
    "kind": "flow",
    "scope": "z0",
    "mode": "repeat"
  }
}
```

## Verify

```js
const crypto = require("node:crypto");
// rawBody: the request body as received, a Buffer or a string, before any JSON parsing
function verify(rawBody, headers, secret) {
  const t = headers["x-firmtape-timestamp"];
  const got = String(headers["x-firmtape-signature"] || "");
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const want = "sha256=" + crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return got.length === want.length && crypto.timingSafeEqual(Buffer.from(got), Buffer.from(want));
}
```

```python
import hmac, hashlib, time

def verify(raw_body: bytes, headers, secret: str) -> bool:
    t = headers.get("X-FirmTape-Timestamp", "")
    got = headers.get("X-FirmTape-Signature", "")
    if not t or abs(time.time() - int(t)) > 300:
        return False
    want = "sha256=" + hmac.new(secret.encode(), t.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(got, want)
```