Developers

Getting started

The Vestoris API is a REST API over HTTPS at https://vestoris.com/api/v1. It reaches everything the site does: firm settings, users and entitlements, reference data, Portfolio Center, orders and the blotter, the intent pipeline, compliance and surveillance, the workflow monitor, data loads and feeds, the event log, the AI log, the copilot and natural-language commands, and webhooks.

The same rules as the screens

Every call is made as someone: a person (with an app they authorized, or their own personal access token) or a service account (a firm user of kind "service" with its own role, privileges and account permissions). A call needs its scope and the privileges and account permissions of that someone, checked by the same services as the screens. So the API can never do what the site would not let that identity do: four eyes applies, accounts you cannot see answer 404, and human steps (rule sign-off, large natural-language plans) need a person and a confirmation token.

Your first call

1. Sign in, open My API access (under the Oversight menu), and create a personal access token with the scopes reference:read and orders:read. Copy it: it is shown once.
2. Call the API:

export VESTORIS_TOKEN=vpt_...   # your token, kept out of scripts and logs
curl https://vestoris.com/api/v1/me -H "Authorization: Bearer $VESTORIS_TOKEN"
curl "https://vestoris.com/api/v1/accounts?limit=10" -H "Authorization: Bearer $VESTORIS_TOKEN"

1. Enter a (simulated) order. Every POST needs an Idempotency-Key:

curl -X POST https://vestoris.com/api/v1/orders \
  -H "Authorization: Bearer $VESTORIS_TOKEN" -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"symbol":"AAPL","side":"buy","order_type":"market","allocations":[{"account_id":"12","quantity":"100"}]}'

The answer is the order, already checked by the compliance engine and routed by the workflow rules, exactly like an order entered on the blotter.

Where next

• Authentication: client credentials, authorization code with PKCE, personal access tokens.
• Scopes and Conventions: pagination, filters, decimals, idempotency, ETags, rate limits, jobs.
• Errors, Confirmations and Webhooks.
• The API reference and the OpenAPI 3.1 document.
• In the demo, the API console tries calls against your own sandbox.

API referenceAll developer pages