Base URL
Every path in this documentation is relative to the first base URL:
GET /tokens is GET https://partners-api.sandbox.securitize.io/corporate-actions/v1/tokens. The three event routes (/events, /events/{eventId}, /events/recover) are the exception: they live at the second one, because they cover every webhook family Securitize sends you, not only this API (Replay and recover). Keep both in configuration. Production uses the same paths at a production base URL, arranged with Securitize once your integration passes the go-live checklist.
Get a token
Authentication is OAuth 2.0 client credentials. Exchange the client id and secret Securitize issued you for a bearer token, then send it on every request:- The token lasts 2 hours. Cache it and refresh it before it expires, or on the first
401. Do not request one per call. - No scope. Send none; one sent is ignored.
- The token identifies your account, and every answer is scoped to the tokens and chains linked to it. There is nothing to pass to name yourself.
- Note the token endpoint is at the host root, not under the base URL.
Keeping secrets safe
- The client secret and the webhook signing secret are secrets: keep them in a secrets manager, inject them at runtime, and ask Securitize to rotate them at once if either is exposed. Never put them in source control or in frontend code.
- Keep separate credentials for sandbox and production.
- Call the API from your backend only.
Limits
The event routes (
/webhooks/v1/events) and the rest of the API count against separate limits.
When the token is wrong
A missing, expired or unknown token is refused before the request reaches the API, with an OAuth-style body:
Every other error carries
error, message and statusCode. See Errors.