Skip to main content
Beta. The Corporate Actions API and its webhooks are in development and subject to change. Paths, fields, enumerations and event names can change before 1.0.0; every change is recorded in the changelog. Sandbox access is arranged with your Securitize contact.

Base URL

Every path in this documentation is relative to the first base URL: GET /tokens is GET https://partners-api.sandbox.securitize.io/corporate-actions/v1/tokens. The three event routes (/events, /events/{eventId}, /events/recover) are the exception: they live at the second one, because they cover every webhook family Securitize sends you, not only this API (Replay and recover). Keep both in configuration. Production uses the same paths at a production base URL, arranged with Securitize once your integration passes the go-live checklist.

Get a token

To try the API from this portal, get a sandbox token here: run Get an access token in the API reference with your client id and secret, then paste the access_token into the authorization field of any other operation to try it.
Authentication is OAuth 2.0 client credentials. Exchange the client id and secret Securitize issued you for a bearer token, then send it on every request:
  • The token lasts 2 hours. Cache it and refresh it before it expires, or on the first 401. Do not request one per call.
  • No scope. Send none; one sent is ignored.
  • The token identifies your account, and every answer is scoped to the tokens and chains linked to it. There is nothing to pass to name yourself.
  • Note the token endpoint is at the host root, not under the base URL.

Keeping secrets safe

  • The client secret and the webhook signing secret are secrets: keep them in a secrets manager, inject them at runtime, and ask Securitize to rotate them at once if either is exposed. Never put them in source control or in frontend code.
  • Keep separate credentials for sandbox and production.
  • Call the API from your backend only.

Limits

The event routes (/webhooks/v1/events) and the rest of the API count against separate limits.

When the token is wrong

A missing, expired or unknown token is refused before the request reaches the API, with an OAuth-style body: Every other error carries error, message and statusCode. See Errors.