diff --git a/api/qmt_rest_new.py b/api/qmt_rest_new.py
index 78f0727..2180e2c 100644
--- a/api/qmt_rest_new.py
+++ b/api/qmt_rest_new.py
@@ -3,7 +3,7 @@ import json
 import locale
 import os
 import sys
-from pathlib import Path
+from urllib.request import Request, urlopen
 from tornado.web import Application, RequestHandler, HTTPError
 from tornado.ioloop import IOLoop
 import logging
@@ -13,6 +13,7 @@ ACCOUNT_ID = os.environ.get('QMT_ACCOUNT_ID', '')
 DATA_DIR = os.environ.get('QMT_DATA_DIR', r'D:\qmt_strategy_data')
 TOKEN="QMTbyYanweidong"
 PORT = 10086
+PASS_CODES_URL = "http://139.224.247.176:13499/a/pass_codes"
 
 # ===================================
 logging.basicConfig(level=logging.INFO)
@@ -32,6 +33,36 @@ def safe_call(func, *args, **kwargs):
         ) from e
 
 
+def get_pass_codes(account_id):
+    request = Request(
+        PASS_CODES_URL,
+        headers={"Accept": "application/json", "User-Agent": "big-qmt/1"},
+    )
+    with urlopen(request, timeout=10) as response:
+        payload = json.load(response)
+
+    remote_codes = payload.get("data")
+    if not isinstance(remote_codes, list):
+        raise ValueError("pass_codes response data must be an array")
+
+    positions = safe_call(
+        get_trade_detail_data, account_id, 'stock', 'position'
+    ) or []
+    position_codes = [
+        position.m_strInstrumentID + '.' + position.m_strExchangeID
+        for position in positions
+    ]
+
+    codes = []
+    seen = set()
+    for code in remote_codes + position_codes:
+        code = str(code).strip()
+        if code and code not in seen:
+            seen.add(code)
+            codes.append(code)
+    return codes
+
+
 # ============= BaseHandler =============
 
 AUTH_EXEMPT = set()
@@ -358,11 +389,9 @@ def init(ContextInfo):
     try:
         ContextInfo.accountID = ACCOUNT_ID
         ContextInfo.set_account(ACCOUNT_ID)
-        # Load the symbol universe only when configured.
-        pass_codes_path = Path(DATA_DIR) / "pass_codes.json"
-        with pass_codes_path.open("r", encoding="utf-8") as stream:
-            codes = json.load(stream)
-            ContextInfo.set_universe(list(codes))
+
+        codes = get_pass_codes(ContextInfo.accountID)
+        ContextInfo.set_universe(list(codes))
         
         # Api App
         app = make_app()