# Securitize Developers > Guides and API reference for integrating with Securitize. > ## Agent Instructions > SecId API: use the sandbox base URL https://partners-api.sandbox.securitize.io/investors/v1/onboarding-reliance unless the user explicitly provides production access. Authenticate with OAuth 2.0 client credentials: POST https://partners-api.sandbox.securitize.io/oauth2/token (form fields grant_type=client_credentials, client_id, client_secret, read from environment variables), cache the bearer token for its expires_in (7200 s) and send it as Authorization: Bearer on every call; never print or log the secret or the token. > Nothing is verified until POST /investors/{investorId}/verification/submit. An individual: create, upload one identity document, submit. A company: create, add its people as key parties (at least one with isBeneficialOwner: true), upload their documents, submit. > Branch on the HTTP status and the error `code`, never on `message`. A body without `code` comes from the gateway: on a 401 get a new token and send the request again; a 403 means the account is not enabled for this API. > SecId API addresses: send address.state only when that address's countryCode is US, as the 2-letter state code (NY); omit it for any other country, also when the user has a province or region. Otherwise the call answers 400 validation_error on address.state. > SecId API individuals in the US: taxId is the person's Social Security number, and it is checked against the name and residential address sent; send them as registered. A mismatch can move the investor to manual-review instead of verified. Sandbox does not run the check. > Creates are safe to repeat with the same body: after a timeout or a 502, send the identical create again. Document uploads are not: each call stores a new document, so only re-send a document after a 502. > Poll GET /investors/{investorId} about every 30 seconds, then back off; treat any status you do not recognise as not verified. In sandbox, the webhook investor.kyc.updated also announces every status change, and investor.suitability.updated / investor.dlt_test.updated every change of the suitability and DLT test verificationStatus: verify the signature, deduplicate on sourceEventId and confirm with the matching GET before acting. Token whitelisting is asynchronous too: poll GET /investors/{investorId}/wallets/whitelist until the status leaves processing. > SecId API tax forms: POST /investors/{investorId}/tax-forms takes multipart/form-data (parts file, formType, signatureDate); never base64 or JSON. Let the HTTP client set content-type with the boundary. At any point of the verification, before or after the investor is verified, only for investors you created (201), one PDF up to 10 MB per call; each upload replaces the form on file, so after a 502 send the same request again. A W-9 can instead go as JSON fields to POST /investors/{investorId}/tax-forms/w9 (TIN as 9 digits, SSN or EIN): it does not replace a form on file (409 tax_form_already_active, details.activeTaxForm), and it requires a certification object (certifiedAt, signatureName, subjectToBackupWithholding false, isUSPerson true, certificationTextVersion w9-sm-2026-10): the investor certifies in your flow on the text published at /secid-api/tax-forms#the-certification, shown without changes; subjectToBackupWithholding true answers 422 business_rule_violation (details.reason backup_withholding_not_supported). Unlike creates, a repeat after success answers 409 tax_form_already_active, not 201: when details.activeTaxForm.formType is W-9, treat it as on file. > Use synthetic test data in sandbox (@test.invalid emails, fresh ids each run). Never send more than one DLT test attempt per test investor unless the user asks: three failed attempts lock the test permanently. > The complete contract, with every field, response and error, is the OpenAPI file of the API reference; the Errors page says what to do for each code. > CET Underlying API: a WebSocket at wss://partners-rt-gw.sandbox.securitize.io/v1/market-maker/stream (TLS only; ws:// hangs with no answer). Sign hello, place_order, cancel_order and submit_crypto_funding with the user's Ed25519 key, read from an environment variable or secrets store; never print or log it. Sign timestamp + "." + type + "." + the exact payload string you send: serialise the payload once and embed that same string in the frame. > CET Underlying API: send a unique requestId of at most 32 characters (a UUID without hyphens) on every message and match replies on it; frames without a requestId are pushes. Every amount is a decimal string, never a JSON number; compare amounts as decimals. Branch on the error code, never on message. > CET Underlying API: an ack to place_order means taken, not filled. externalRef is the idempotency key; after an ack with status UNKNOWN or an UPSTREAM_UNAVAILABLE error, call get_order by externalRef before resending. Updates are delivered at most once: after any reconnect, read working orders back with get_order. Every order is placed by quantity. A buy must be a LIMIT order: quantity × limitPrice plus fees is held against your own available cash (get_cash_balance_v2), and a buy it does not cover, a MARKET buy or a notional order is refused (INVALID_ORDER). A sell must be placed by quantity, after its CETs reach the redemption wallet, or it is refused. mint_updated and burn_updated push mints and burns once they are on chain; after a gap, read them with get_mints and get_burns. The complete contract is the AsyncAPI file of the API reference. > Stocks API (Beta): documented ahead of its release through the partner gateway; paths, fields and errors can change. Base URL https://partners-api.sandbox.securitize.io/stocks/v1. Send x-api-key on every call and investorId on every call about an investor. Read the key from an environment variable; never print or log it, and never call the API from frontend code. > Stocks API: an investor can trade only once the SecId API shows them verified, with verified suitability (and a passed DLT test in the EEA), and once their wallet on the stock's chain is linked with their signature of the agreement message, signed verbatim. There is no whitelisting call: the first trade whitelists the wallet. > Stocks API: orders are fill or kill. GET /stocks/realtime-price, prepare within about 20 seconds (signedPrice), have the investor's wallet sign the returned transaction unchanged and sign-only (never send it), then submit it once with POST /stocks/execute-signed-transaction within 120 seconds. Amounts are raw base units as strings; USDC has 6 decimals. The outcome is on chain: follow transactionHash. > Stocks API: production access requires a UI audit by Securitize Compliance of the live screens: the disclosures and the market data shown, the NBBO included. > Corporate Actions API (Beta, 0.x): in development and subject to change; paths, fields, enumerations and event names can change before 1.0.0. Base URL https://partners-api.sandbox.securitize.io/corporate-actions/v1. Get a bearer token with OAuth 2.0 client credentials at POST https://partners-api.sandbox.securitize.io/oauth2/token (no scope, 2 hours), cache it, and send Authorization: Bearer on every call. Read the client id, secret and the webhook signing secret from environment variables; never print or log them, and never call the API from frontend code. > Corporate Actions API: webhooks arrive signed with the Standard Webhooks scheme under the svix-id, svix-timestamp and svix-signature headers (HMAC-SHA256 over id.timestamp.raw body, base64, v1 prefix; the secret is base64 after whsec_). Verify before parsing, reject a timestamp more than 5 minutes off, answer 2xx within 10 seconds. Delivery is at least once and can be out of order: deduplicate on sourceEventId, keep the highest version per object (objectId), order by sequence per stream.id, and replace the object with data (never merge). > Corporate Actions API: treat an unknown caType, reasonCode, eventType or enum value as informational, never as an error. A restriction ends only with ca.restriction.removed; expectedEnd is informational. marketStatus UNAVAILABLE means do not trade; the reason field carries a restriction reasonCode or a market reason such as PRE_MARKET. GET /tokens?status= filters by marketStatus (OPEN, CLOSED, UNAVAILABLE), not by the token's ACTIVE status. > Corporate Actions API: the event routes are at https://partners-api.sandbox.securitize.io/webhooks/v1 (not under /corporate-actions/v1) and cover every webhook family sent to the partner; filter with eventTypes=ca.* for corporate actions only. After an outage call POST /events/recover with since at the start of the outage (resends failed deliveries only), or page GET /events?since= (newest first, iterator paging, 90 days), then read state with GET /tokens/{tokenId}/status and GET /corporate-actions/{sourceCaId}. In sandbox, POST /sandbox/events with a scenario and one of your tokenIds publishes a scripted sequence at once; order the events by sequence, not by arrival. > Investor Activity API: base URL https://partners-api.sandbox.securitize.io/v1. Authentication is OAuth 2.0 client credentials only (no API key): POST https://partners-api.sandbox.securitize.io/oauth2/token (no scope, 2 hours), cache the token, and send Authorization: Bearer on every call. The token identifies the investor account; there is no investor id to pass. Read the client id, secret and the webhook signing secret from environment variables; never print or log them, and never call the API from frontend code. > Investor Activity API: every amount is an integer string in base units with a sibling decimals (human = amount / 10^decimals); parse with BigInt or a decimal type, never a float. Cash amounts (deposits, confirmations, payouts) are in the minor units of currencyId (1 = USD, decimals 2); token amounts (transactions, mintings, holdings) in the token's base units. Never add cash to tokens. > Investor Activity API: reconcile a subscription by grouping GET /deposits?tokenId= on tokenIssuanceId and matching the transaction in GET /transactions?tokenId= with the same tokenIssuanceId (null on a deposit means not issued yet; null on a transaction means not an issuance). Each issuance has a deposit movement (cash in) and a liquidation movement (that cash applied to the tokens) for the same amount: count the cash once, by direction=deposit, never by adding every movement. Page with offset and limit (max 100) until offset + meta.length reaches meta.total; there is no tokenIssuanceId filter. Reconcile a redemption by txHash (transfer, investor.redemption.pending, payout sourceTransaction) and by the redemption's data.id across pending, confirmed, payout.initiated and payout.completed. > Investor Activity API: webhooks arrive signed with the Standard Webhooks scheme under the svix-id, svix-timestamp and svix-signature headers (HMAC-SHA256 over id.timestamp.raw body, base64, v1 prefix; the secret is base64 after whsec_). Verify before parsing, reject a timestamp more than 5 minutes off, answer 2xx within 15 seconds. The body is {eventType, eventId, timestamp, data}: deduplicate on eventId (not svix-id), upsert by data.id, never move a record back to an earlier step, and treat an unknown eventType, processType or paymentMethod as informational. In webhooks a field with no value is absent; in endpoint answers it is null. After an outage page GET /webhook-events (newest first, iterator paging, optional eventType) back to the start of the outage. > SecId hosted onboarding: instead of the API, a partner can send an investor to https://stocks.securitize.io/partners?tokenId=&partnerUrl= (tokenAddress may replace tokenId; partnerUrl must be an absolute https URL, URL-encoded). Securitize runs identity verification, the investment profile and the wallet there. Nothing is appended to partnerUrl on return: check the wallet on chain before trading (Beta on Solana). - [Home](https://developers.securitize.io/index.md): Guides and API reference for integrating with Securitize. - [APIs](https://developers.securitize.io/apis.md): Every Securitize API: what it does, how it connects, its status, and where to start. - [Webhooks](https://developers.securitize.io/webhooks.md): How Securitize sends webhooks to your partner account: one endpoint for every API, signed deliveries, retries, and what your handler must do. - [Replay and recover](https://developers.securitize.io/webhook-events.md): Read the last 90 days of webhooks back, fetch one by id, and resend the deliveries that failed, for every Securitize API. - [SecId API](https://developers.securitize.io/secid-api/overview.md): Onboard investors you have already verified, and let Securitize rely on your KYC. - [Sandbox and authentication](https://developers.securitize.io/secid-api/sandbox-and-auth.md): Where to send requests, how to get a bearer token, and how sandbox behaves. - [Build with AI](https://developers.securitize.io/secid-api/build-with-ai-agents.md) - [Postman collection](https://developers.securitize.io/secid-api/postman-collection.md) - [Go-live checklist](https://developers.securitize.io/secid-api/go-live-checklist.md): What to check in sandbox before you ask Securitize for production access. - [Hosted onboarding](https://developers.securitize.io/secid-api/hosted-onboarding.md): Send investors to a page Securitize hosts with only the onboarding steps: identity, investment profile and wallet. They come back to your site when done. - [Onboard an individual](https://developers.securitize.io/secid-api/onboard-an-individual.md): Create a person, send their identity document, submit, and read the verdict. - [Onboard a company](https://developers.securitize.io/secid-api/onboard-a-company.md): Create a company, declare the people behind it, send their documents, submit, and read the verdict. - [Wallets](https://developers.securitize.io/secid-api/wallets.md): Register the blockchain addresses an investor holds, and list the ones you registered. - [Whitelist a wallet for a token](https://developers.securitize.io/secid-api/whitelist-a-wallet.md): Let an investor's wallet receive and hold a token, and follow the whitelisting until it is on-chain. - [Suitability and the DLT test](https://developers.securitize.io/secid-api/suitability-and-dlt-test.md): Send the investor's suitability profile and, in the European Economic Area, their DLT knowledge test. - [Send a tax form](https://developers.securitize.io/secid-api/tax-forms.md): Send an investor's tax form so Securitize has it on file for withholding: a signed W-9, W-8BEN or W-8BEN-E as a PDF, or the fields of a W-9 and the investor's certification as JSON. - [Webhooks](https://developers.securitize.io/webhooks.md): How Securitize sends webhooks to your partner account: one endpoint for every API, signed deliveries, retries, and what your handler must do. - [KYC webhooks](https://developers.securitize.io/secid-api/kyc-webhooks.md): Get notified when an investor's status changes, and apply each change exactly once. - [Suitability webhooks](https://developers.securitize.io/secid-api/suitability-webhooks.md): Get notified when an investor's suitability or DLT test verdict changes, whoever changed it. - [Replay and recover](https://developers.securitize.io/webhook-events.md): Read the last 90 days of webhooks back, fetch one by id, and resend the deliveries that failed, for every Securitize API. - [Statuses](https://developers.securitize.io/secid-api/statuses.md): Every status the API returns, how to poll for the verdict, and when data locks. - [Identifiers](https://developers.securitize.io/secid-api/identifiers.md): Your ids, Securitize's ids, and which one each path takes. - [Documents](https://developers.securitize.io/secid-api/documents.md): Which documents each investor needs, the file rules, the test files, and what each refusal means. - [Errors](https://developers.securitize.io/secid-api/errors.md): How errors look, what to do about each code, what is safe to retry, and what to send support. - [FAQ and troubleshooting](https://developers.securitize.io/secid-api/faq.md): Short answers to the questions integrations run into, each with the page that explains it. - [Glossary](https://developers.securitize.io/secid-api/glossary.md): The terms these docs use, in one place. - [Changelog](https://developers.securitize.io/secid-api/changelog.md): Changes to the SecId API and these docs, newest first. - [Get an access token](https://developers.securitize.io/api-reference/authentication/get-an-access-token.md): Exchanges the client id and secret Securitize issued you for a bearer token, with the OAuth 2.0 client credentials grant. Send the token in the `Authorization: Bearer` header of every other operation. - [Create an individual investor](https://developers.securitize.io/api-reference/individuals/create-an-individual-investor.md): Creates the person you are onboarding. Call it first; every other operation on the investor takes the `investorId` it returns, so **store it** against your own record. - [Correct an individual investor](https://developers.securitize.io/api-reference/individuals/correct-an-individual-investor.md): Replaces the person's record — a typo in a name, a moved address. Accepted any time before you submit the investor, also after its documents are uploaded. - [Create an entity investor](https://developers.securitize.io/api-reference/entities/create-an-entity-investor.md): Creates the company you are onboarding. Call it first; every other operation on the entity takes the `investorId` it returns, so **store it** against your own record. - [Correct an entity investor](https://developers.securitize.io/api-reference/entities/correct-an-entity-investor.md): Replaces the company's record — a typo in the name, a moved address. Use it before you submit. - [Add a person key party](https://developers.securitize.io/api-reference/key-parties/add-a-person-key-party.md): Declares a **natural person** the entity is verified through: a beneficial owner, a shareholder, a legal signer. Call it once per person, after the entity create. Returns `keyPartyId` — the document, correction and list paths take it, so **store it**. - [Correct a person key party](https://developers.securitize.io/api-reference/key-parties/correct-a-person-key-party.md): Replaces a person key party — a typo in a name, a moved address. Use it before you submit the entity. - [Add a company key party](https://developers.securitize.io/api-reference/key-parties/add-a-company-key-party.md): Declares a key party that is itself a **company** — a corporate shareholder or owner of the entity. Optional; call it once per corporate shareholder. Returns `keyPartyId`, so **store it**. - [Correct a company key party](https://developers.securitize.io/api-reference/key-parties/correct-a-company-key-party.md): Replaces a company key party. The correction is stored by Securitize and reaches verification with the entity's next submit. - [List an entity's key parties](https://developers.securitize.io/api-reference/key-parties/list-an-entitys-key-parties.md): Returns every key party of the entity, both kinds, **newest first**, each with its `documents`. Company key parties also carry their `verification` checklist, so you can see which still owe documents before you submit. Person key parties carry no `verification` here; their readiness is reported by t… - [Add a document to a key party](https://developers.securitize.io/api-reference/documents/add-a-document-to-a-key-party.md): Uploads **one document, with all of its files**, for one key party. Call it for each key party after creating it. The body shape follows the key party's kind, chosen by `type`: - [Add a document to an investor](https://developers.securitize.io/api-reference/documents/add-a-document-to-an-investor.md): Uploads **one document, with all of its files**, for the investor itself. The body shape follows the investor's type, chosen by `type`: - [Submit an investor for verification](https://developers.securitize.io/api-reference/verification/submit-an-investor-for-verification.md): Hands the investor to verification — an entity together with **all** of its key parties. No request body. **This is the only way a verification starts**, for individuals and entities alike: nothing else triggers it, not the create, the key parties or any document. Calling it is you asserting that wh… - [Get an investor](https://developers.securitize.io/api-reference/lookup/get-an-investor.md): Reads one investor by the `investorId` Securitize returned at create. To find an investor by your own `externalInvestorId`, filter the list: `GET /investors?externalInvestorId=…`. Use this call to poll for the verdict after you submit, and to read back what Securitize holds. - [List your investors](https://developers.securitize.io/api-reference/lookup/list-your-investors.md): Lists the investors you created, **newest first**, in pages. Use it to recover an `investorId` you no longer have: filter by the `externalInvestorId` you chose. - [List the investor's wallets you registered](https://developers.securitize.io/api-reference/wallets/list-the-investors-wallets-you-registered.md): Returns the wallets **you** registered for this investor, or attached by whitelisting them, newest first. Wallets the investor added elsewhere, or another partner registered, are not listed until you register them yourself. The list is complete as soon as a registration answers; there is no paging. - [Register a wallet](https://developers.securitize.io/api-reference/wallets/register-a-wallet.md): Associates a blockchain address with the investor and adds it to **your** list of that investor's wallets. You vouch that the investor controls the address: there is no signature or challenge. Any investor status works, individual or entity, and so does an investor you have limited access to. - [Read the investor's suitability](https://developers.securitize.io/api-reference/suitability-and-dlt-test/read-the-investors-suitability.md): Returns the suitability's `status` and `verificationStatus`, and the `answers` when **you** sent them. Answers sent by another partner, or completed by the investor on Securitize, are not returned. `declaresLawfulOriginOfFunds` always comes back, `false` when it was not declared. - [Send the investor's suitability](https://developers.securitize.io/api-reference/suitability-and-dlt-test/send-the-investors-suitability.md): Records the investor's suitability — Securitize's investor profile: experience, finances, risk profile, experience per asset class, and your attestation that the investor reviewed Securitize's documents — in one call, and answers the verdict in the same response. The same questionnaire serves indivi… - [Read the investor's compact suitability](https://developers.securitize.io/api-reference/suitability-and-dlt-test/read-the-investors-compact-suitability.md): Returns the suitability's `status` and `verificationStatus` — the same verdict `GET /investors/{investorId}/suitability` answers — and the `answers` in the compact shape when **you** sent the suitability, compact or full. Answers sent by another partner, or completed by the investor on Securitize, a… - [Send the investor's compact suitability](https://developers.securitize.io/api-reference/suitability-and-dlt-test/send-the-investors-compact-suitability.md): Records a shorter suitability for an individual — the part of Securitize's investor profile that a Securitize Markets brokerage account for stocks and '40 Act funds requires — in one call, and answers the verdict in the same response. Its fields have the same names and values as the full suitability… - [Read the investor's DLT test](https://developers.securitize.io/api-reference/suitability-and-dlt-test/read-the-investors-dlt-test.md): Returns the test's state, whether it applies (`required`), the attempts used and left, and the EU suitability verdict. It also returns the letters of the latest attempt when **you** sent that attempt. Works for every investor; outside the EEA it reads `required: false`. - [Send an attempt at the DLT test](https://developers.securitize.io/api-reference/suitability-and-dlt-test/send-an-attempt-at-the-dlt-test.md): Sends one attempt at the DLT (Distributed Ledger Technology) knowledge test: eight multiple-choice questions, each answered with the letter of the chosen option in the order the field lists them. **All eight must be correct to pass**; the response never says which were wrong. - [List the investor's whitelisted wallets](https://developers.securitize.io/api-reference/token-whitelisting/list-the-investors-whitelisted-wallets.md): Lists the investor's wallets whitelisted on the tokens enabled for your account, read live from the tokens' on-chain registries. Filter by token with `?tokenAddress=`. Poll it after `POST /investors/{investorId}/wallets/whitelist` until the status leaves `processing`. - [Whitelist a wallet on a token](https://developers.securitize.io/api-reference/token-whitelisting/whitelist-a-wallet-on-a-token.md): Registers an investor's EVM wallet on a token's on-chain registry, so the wallet can receive and hold that token. EVM only. The token must be one Securitize enabled for your account: you receive the token contract addresses from Securitize. - [Upload an investor's signed tax form](https://developers.securitize.io/api-reference/tax-forms/upload-an-investors-signed-tax-form.md): Sends Securitize the tax form the investor signed, as a PDF, so it is on file for the withholding on the investor's distributions. **One form per call, as `multipart/form-data`**: the PDF in the `file` part, and `formType` and `signatureDate` as text parts. A JSON body is refused. - [Send an investor's W-9 as data](https://developers.securitize.io/api-reference/tax-forms/send-an-investors-w-9-as-data.md): Sends Securitize the fields of the W-9 an investor completed with you, as JSON, instead of a signed PDF, together with the investor's certification. Securitize puts the form on file for the investor, recorded as sent by you, and generates its PDF from these fields. For a US person, individual or ent… - [An investors status changed](https://developers.securitize.io/api-reference/webhooks/an-investors-status-changed.md): Sent every time the `status` of one of your investors changes, with the new status. Delivery is at least once and can be out of order: deduplicate on `sourceEventId`, keep the latest `occurredAt` per investor, and confirm with `GET /investors/{investorId}` before acting on a status. The KYC webhooks… - [An investors suitability verdict changed](https://developers.securitize.io/api-reference/webhooks/an-investors-suitability-verdict-changed.md): Sent every time the `verificationStatus` of one of your investors' suitability changes, whoever changed it: Securitize's compliance team, the investor, another partner or your own call. It carries the new verdict, the value `GET /investors/{investorId}/suitability` answers. Delivery is at least once… - [An investors dlt test verdict changed](https://developers.securitize.io/api-reference/webhooks/an-investors-dlt-test-verdict-changed.md): Sent every time the `verificationStatus` of one of your investors' DLT test changes, whoever changed it: Securitize's compliance team, the investor, another partner or your own call. It carries the new verdict, the value `GET /investors/{investorId}/dlt-test` answers. Attempts and the lock send noth… - [Stocks API](https://developers.securitize.io/stocks-api/overview.md): Trade tokenized US-listed stocks, Issuer Sponsored Tokens and Convertible Entitlement Tokens, for the investors you onboard. - [Sandbox and authentication](https://developers.securitize.io/stocks-api/sandbox-and-auth.md): Where to send requests, how to authenticate, and how to name the investor a call is about. - [Go-live checklist](https://developers.securitize.io/stocks-api/go-live-checklist.md): What to check in sandbox, and the compliance UI audit, before you ask for production access. - [Prepare an investor to trade](https://developers.securitize.io/stocks-api/prepare-an-investor.md): Onboard and verify the investor with the SecId API, then link their wallet with a signature. - [Trade a stock](https://developers.securitize.io/stocks-api/trade.md): Get a real-time price, prepare the order, have the investor sign it, and submit it. - [Prices and market data](https://developers.securitize.io/stocks-api/prices-and-market-data.md): Delayed prices for browsing, real-time prices to trade against, and what you may show to whom. - [Market status](https://developers.securitize.io/stocks-api/market-status.md): When stocks can be traded, what each status means, and why the market can be unavailable. - [Amounts and assets](https://developers.securitize.io/stocks-api/amounts-and-assets.md): How a stock is identified, and how amounts and prices are written. - [Errors](https://developers.securitize.io/stocks-api/errors.md): How errors look, what to do about each code, what is safe to retry, and what to send support. - [Glossary](https://developers.securitize.io/stocks-api/glossary.md): The terms these docs use, in one place. - [Changelog](https://developers.securitize.io/stocks-api/changelog.md): Changes to the Stocks API and these docs, newest first. - [Get a delayed price](https://developers.securitize.io/stocks-api/api-reference/prices/get-a-delayed-price.md): Consolidated market data delayed by 15 minutes, for browsing and for any screen not tied to one eligible investor. Show it labelled as delayed. It carries no `signedPrice` and cannot be traded against: use `GET /stocks/realtime-price` for the order ticket. - [Get market statistics](https://developers.securitize.io/stocks-api/api-reference/prices/get-market-statistics.md): Volume, the day's open, close, high and low, and the 52-week range, for an asset's detail screen. Figures are numbers, not decimal strings, and are refreshed every few minutes. - [Get a real-time price to trade against](https://developers.securitize.io/stocks-api/api-reference/prices/get-a-real-time-price-to-trade-against.md): The real-time price for one investor, with the `signedPrice` an order needs. Call it for the order ticket and the confirmation screen, on a fixed cadence while the ticket is open rather than on every keystroke. - [Check whether a wallet can be linked](https://developers.securitize.io/stocks-api/api-reference/wallets/check-whether-a-wallet-can-be-linked.md): Whether this address is already linked to the investor, and if not, whether it can be. Call it before asking the investor to sign: it answers without asking anything of them. - [Get the agreement message to sign](https://developers.securitize.io/stocks-api/api-reference/wallets/get-the-agreement-message-to-sign.md): The exact text the investor's wallet signs to link this address. It is the investor's agreement to the Securitize wallet terms: show it and have it signed **verbatim**, never composed or altered on your side. - [Link a wallet with the investor's signature](https://developers.securitize.io/stocks-api/api-reference/wallets/link-a-wallet-with-the-investors-signature.md): Links the address to the investor, with the wallet's signature of the agreement message as proof that the investor controls it. The signature is kept as the record of that agreement. Once linked, the wallet can trade; the first trade whitelists it on the token, with nothing for the investor to sign… - [Prepare a buy](https://developers.securitize.io/stocks-api/api-reference/trading/prepare-a-buy.md): Builds the transaction that buys the stock with USDC, for the investor's linked wallet, at the price in `signedPrice`. Securitize checks the investor's eligibility, the market status, the order size and the price's freshness, then returns the transaction with the signed price and the swap already in… - [Prepare a sell](https://developers.securitize.io/stocks-api/api-reference/trading/prepare-a-sell.md): Builds the transaction that sells the stock token for USDC, from the investor's linked wallet. Everything said for a buy holds: the same checks, Securitize pays the network fee, sign without modifying, submit within 120 seconds. - [Submit the signed order](https://developers.securitize.io/stocks-api/api-reference/trading/submit-the-signed-order.md): Hands the transaction the investor signed back to Securitize, which broadcasts it. The investor's signature is the acceptance of the order; the broadcast is when it becomes firm. On chain, the price, its expiry and `minOutputAmount` are checked again and the swap and its settlement happen in the sam… - [CET Underlying API](https://developers.securitize.io/cet-underlying-api/overview.md): Buy and sell the shares underlying CETs over one WebSocket; Securitize mints and burns the CETs to match. - [Sandbox and authentication](https://developers.securitize.io/cet-underlying-api/sandbox-and-auth.md): Where to connect, how to sign, how to open a session, and how sandbox behaves. - [Go-live checklist](https://developers.securitize.io/cet-underlying-api/go-live-checklist.md): What to check in sandbox before you ask Securitize for production access. - [Sandbox funding](https://developers.securitize.io/cet-underlying-api/sandbox-funding.md): Sandbox only: move USD into and out of your own cash to test the cash flow end to end. - [Sandbox only](https://developers.securitize.io/cet-underlying-api/reference/sandbox.md): Sandbox only: fund and withdraw your own cash. Not part of the production API. - [Buy shares and receive CETs](https://developers.securitize.io/cet-underlying-api/buy-shares.md): Place a buy, follow it until it fills, and reconcile the CETs minted to your wallet. - [Sell shares and redeem CETs](https://developers.securitize.io/cet-underlying-api/sell-shares.md): Send CETs to the redemption wallet, place the sell, and reconcile the CETs burned. - [Track, cancel and reconcile orders](https://developers.securitize.io/cet-underlying-api/track-orders.md): Follow orders on the stream, recover after a disconnect, settle an UNKNOWN, cancel, and read executions and trades. - [Cash](https://developers.securitize.io/cet-underlying-api/positions-and-cash.md): Read your own cash and its movements, fund it with USDC, and what happens to a buy your cash cannot pay for. - [Messages](https://developers.securitize.io/cet-underlying-api/messages.md): The envelope every frame shares, the ids on it, and how amounts and times are written. - [Orders and statuses](https://developers.securitize.io/cet-underlying-api/orders-and-statuses.md): An order's identifiers and quantities, how orders in money become shares, the limits on an order, and every status. - [Mints and burns](https://developers.securitize.io/cet-underlying-api/mints-and-burns.md): How CETs are minted and burned as orders fill, the memo and its handle, the transaction hash, and when a mint's executions are final. - [Errors](https://developers.securitize.io/cet-underlying-api/errors.md): How errors look, what to do about each code, when the socket closes, and what is safe to retry. - [Glossary](https://developers.securitize.io/cet-underlying-api/glossary.md): The terms these docs use, in one place. - [Changelog](https://developers.securitize.io/cet-underlying-api/changelog.md): Changes to the CET Underlying API and these docs, newest first. - [Session](https://developers.securitize.io/cet-underlying-api/reference/session.md): Open the socket, sign hello, and keep the session alive with ping. - [Orders](https://developers.securitize.io/cet-underlying-api/reference/orders.md): List the symbols you can trade, place, cancel and look up orders, and receive order and trade updates. - [Mints and burns](https://developers.securitize.io/cet-underlying-api/reference/mints-and-burns.md): Read the CETs minted against your buys and burned against your sells. - [Cash](https://developers.securitize.io/cet-underlying-api/reference/positions-and-cash.md): Read your own cash and its movements, and fund it with USDC. - [Reads over HTTP](https://developers.securitize.io/cet-underlying-api/reference/http-reads.md): Read orders, mints, burns, cash, crypto funding and your redemption balance with a signed GET, without opening a session. - [Corporate Actions API](https://developers.securitize.io/corporate-actions-api/overview.md): Corporate actions on the CETs you list, and the trading status of each token: pushed to your webhook, replayable, and queryable. - [Sandbox and authentication](https://developers.securitize.io/corporate-actions-api/sandbox-and-auth.md): Where to send requests, how to get a bearer token, and the limits. - [Test in sandbox](https://developers.securitize.io/corporate-actions-api/test-in-sandbox.md): Trigger every corporate-action and restriction scenario on demand, and check what your handler did with it. - [Go-live checklist](https://developers.securitize.io/corporate-actions-api/go-live-checklist.md): What to confirm in sandbox before you ask for production access. - [Webhooks](https://developers.securitize.io/webhooks.md): How Securitize sends webhooks to your partner account: one endpoint for every API, signed deliveries, retries, and what your handler must do. - [Receive webhooks](https://developers.securitize.io/corporate-actions-api/receive-webhooks.md): Apply each corporate action event exactly once and in order, and react to the ones that matter. - [Replay and recover](https://developers.securitize.io/webhook-events.md): Read the last 90 days of webhooks back, fetch one by id, and resend the deliveries that failed, for every Securitize API. - [Track a corporate action](https://developers.securitize.io/corporate-actions-api/track-a-corporate-action.md): Follow a corporate action from announcement to completion: versions, corrections, postponements, cancellations and replacements. - [Track token status](https://developers.securitize.io/corporate-actions-api/track-token-status.md): Know whether a token can be traded now, which restrictions apply, and when each one starts and ends. - [Identifiers](https://developers.securitize.io/corporate-actions-api/identifiers.md): The ids the API uses, what each one is scoped to, and which ones to key on. - [Events](https://developers.securitize.io/corporate-actions-api/events.md): The envelope every webhook and replay item carries, and the eleven event types. - [Corporate actions](https://developers.securitize.io/corporate-actions-api/corporate-actions.md): The corporate action object: its fields, the types, the terms of each type, holder options, venue actions and settlement. - [Restrictions and market status](https://developers.securitize.io/corporate-actions-api/restrictions.md): The restriction object, its scopes, types and reason codes, and how the effective market status is computed. - [Errors](https://developers.securitize.io/corporate-actions-api/errors.md): How errors look, what each code means, and what is safe to retry. - [Versioning](https://developers.securitize.io/corporate-actions-api/versioning.md): How the API, its webhooks and these docs are versioned, what Beta means, and what to tolerate. - [Glossary](https://developers.securitize.io/corporate-actions-api/glossary.md): The terms these docs use, in one place. - [Changelog](https://developers.securitize.io/corporate-actions-api/changelog.md): Versions of the Corporate Actions API, its webhooks and these docs, newest first. - [Get an access token](https://developers.securitize.io/corporate-actions-api/api-reference/authentication/get-an-access-token.md): Exchanges the client id and secret Securitize issued you for a bearer token, with the OAuth 2.0 client credentials grant. Send the token in the `Authorization: Bearer` header of every other operation. - [List your assets](https://developers.securitize.io/corporate-actions-api/api-reference/assets/list-your-assets.md): Every CET you hold at least one token of, each with your deployments only. With `chainId`, only the deployments on that chain, and only the assets that have one there. - [Get an asset](https://developers.securitize.io/corporate-actions-api/api-reference/assets/get-an-asset.md): One CET, with your deployments only. With `chainId`, only the deployment on that chain; `404` when you hold none there. An asset none of your tokens belongs to answers `404`, the same as an unknown id. - [Get the restrictions on an asset](https://developers.securitize.io/corporate-actions-api/api-reference/assets/get-the-restrictions-on-an-asset.md): The asset-level restrictions in force: those with scope `ASSET` or `UNDERLYING_MARKET`. For the effective `marketStatus` of a token, which also counts the restrictions on the token itself and the underlying market's hours, use `GET /tokens/{tokenId}/status`. - [List your tokens](https://developers.securitize.io/corporate-actions-api/api-reference/tokens/list-your-tokens.md): Your CET tokens, one per chain deployment. `status` filters by the token's current `marketStatus` (`OPEN`, `CLOSED`, `UNAVAILABLE`), not by the `status` field of the token object: `status=ACTIVE` is refused with `400`. - [Get a token](https://developers.securitize.io/corporate-actions-api/api-reference/tokens/get-a-token.md): One of your CET tokens, with its asset's reference data. A token outside your account answers `404`, the same as an unknown id. - [Get the effective market status of a token](https://developers.securitize.io/corporate-actions-api/api-reference/tokens/get-the-effective-market-status-of-a-token.md): Whether the token can be traded now, and why not. `marketStatus` is `UNAVAILABLE` while any restriction that stops trading applies to the token, its asset or the underlying market, with `reason` set to the `reasonCode` of the most restrictive one; otherwise it is the underlying market's status, `OPE… - [List the corporate actions on a token](https://developers.securitize.io/corporate-actions-api/api-reference/tokens/list-the-corporate-actions-on-a-token.md): Every corporate action on the asset of the token, latest version of each, newest first. A corporate action is registered once per asset and applies to every chain, so the objects carry no `tokenId`. `from` and `to` keep a corporate action when any of its dates falls in the range; one with no dates n… - [Get a corporate action](https://developers.securitize.io/corporate-actions-api/api-reference/corporate-actions/get-a-corporate-action.md): The current state of a corporate action: its latest version. A corporate action on an asset none of your tokens belongs to answers `404`, the same as an unknown id. - [Get one version of a corporate action](https://developers.securitize.io/corporate-actions-api/api-reference/corporate-actions/get-one-version-of-a-corporate-action.md): The corporate action as it stood at `version`: the same object the event of that version carried in `data`, without the stream's `tokenId`. Versions start at 1 and never change once published. - [List the webhooks sent to you](https://developers.securitize.io/corporate-actions-api/api-reference/events/list-the-webhooks-sent-to-you.md): Every webhook sent to your endpoint in the last 90 days, of every family Securitize sends you, newest first, each with the body it carried. Page with `iterator`: pass the value of the previous page to get the next, older, page; `done` is `true` on the last one. `since` keeps only events sent after t… - [Get one webhook by its event id](https://developers.securitize.io/corporate-actions-api/api-reference/events/get-one-webhook-by-its-event-id.md): The event with this id, exactly as it was sent to your endpoint, whatever family it belongs to. The id is the `sourceEventId` of the body, not the `svix-id` header of the delivery. An id that is unknown, belongs to another account or is older than 90 days answers `404`. - [Resend the webhooks that failed in a time window](https://developers.securitize.io/corporate-actions-api/api-reference/events/resend-the-webhooks-that-failed-in-a-time-window.md): Resends, in the background, every delivery to your endpoint that failed between `since` and `until`, of every family it receives, each with its original body and `svix-id`. Deliveries that succeeded are not resent: to read those, list the events. `since` must be within the last 90 days and `until`,… - [Trigger a test scenario](https://developers.securitize.io/corporate-actions-api/api-reference/sandbox/trigger-a-test-scenario.md): Sandbox only; the route does not exist in production. Runs a scripted sequence of synthetic events on the asset of `tokenId`, every step at once and in order, so the whole sequence reaches your webhook endpoint and the event list within seconds. The events are published on every token stream of that… - [A corporate action was announced](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-corporate-action-was-announced.md): Version 1 of a new corporate action, published on every token stream of its asset you hold. Terms may be `PRELIMINARY`, with `null` where a value is not known yet. When the new corporate action replaces another, `data.supersedesCaId` names the one it replaces, and that one receives `ca.action.cancel… - [A corporate action was amended](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-corporate-action-was-amended.md): Terms completed or changed in the normal course, for example a rate confirmed or dates set after a postponement. `version` is one more than the previous event's and `changedFields` lists the paths that changed. - [A corporate action was corrected](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-corporate-action-was-corrected.md): Previously published data was wrong. `data.correctionReason` says why, `changedFields` what changed. Replace what you hold with `data`, as with any other version. - [A corporate action was postponed](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-corporate-action-was-postponed.md): Key dates moved. Either the new dates are already in `data.dates`, or they are `null` and `data.status` is `POSTPONED` until a later `ca.action.updated` sets them. - [A corporate action was cancelled](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-corporate-action-was-cancelled.md): Terminal. `data.status` is `CANCELLED` and `data.cancellationReason` says why. When the corporate action was replaced by another, `data.supersededByCaId` names the replacement. - [A corporate action moved to another lifecycle status](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-corporate-action-moved-to-another-lifecycle-status.md): The lifecycle progressed: `ELECTION_OPEN`, `ENTITLEMENTS_FIXED` or `SETTLING`. Nothing else in the object changed unless `changedFields` says so. - [A corporate action was completed](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-corporate-action-was-completed.md): Terminal. `data.status` is `COMPLETED` and `data.settlement` carries the distribution contracts, the transaction hashes and the aggregate totals for the asset. Never holder- or wallet-level data: individual payments are read on chain. - [A trading restriction started](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-trading-restriction-started.md): A halt, suspension, pause, wind-down or special restriction now applies to one token (`scope` `TOKEN`), to every token of an asset (`ASSET`) or to the underlying market of an asset (`UNDERLYING_MARKET`). `scopeId` is the token id for `TOKEN` and the asset id for the other two. Published on every tok… - [A trading restriction changed](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-trading-restriction-changed.md): Details of a restriction in force changed, for example `expectedEnd` or `reasonText`. The restriction still applies: only `ca.restriction.removed` ends it. - [A trading restriction ended](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/a-trading-restriction-ended.md): Terminal for that restriction, and the only way one ends: `expectedEnd` never ends a restriction by itself. `data.removedAt` is set and the object is the full restriction, as always. - [Token reference data changed](https://developers.securitize.io/corporate-actions-api/api-reference/webhooks/token-reference-data-changed.md): The token's reference data changed: its name, its asset's name or identifiers, its status. `data` is the token as `GET /tokens/{tokenId}` returned it at that moment. - [Investor Activity API](https://developers.securitize.io/investor-activity-api/overview.md): The activity of your investor account in tokenized funds, from cash and token movements to subscriptions, redemptions, reinvested distributions and holdings: pushed to your webhook and readable on request. - [Sandbox and authentication](https://developers.securitize.io/investor-activity-api/sandbox-and-auth.md): Where to send requests and how to get a bearer token. - [Go-live checklist](https://developers.securitize.io/investor-activity-api/go-live-checklist.md): What to confirm in sandbox before you ask for production access. - [Receive webhooks](https://developers.securitize.io/investor-activity-api/receive-webhooks.md): Verify each webhook's signature, acknowledge it, and apply it exactly once. - [Reconcile a subscription](https://developers.securitize.io/investor-activity-api/reconcile-a-subscription.md): Match the cash you sent to the deposits Securitize recorded, the deposits to the tokens issued, and the tokens to the chain. - [Reconcile a redemption](https://developers.securitize.io/investor-activity-api/reconcile-a-redemption.md): Follow a redemption from the token transfer that starts it to the cash that reaches you. - [Identifiers](https://developers.securitize.io/investor-activity-api/identifiers.md): The ids the API uses, what each one identifies, and which ones join a step to the next. - [Events](https://developers.securitize.io/investor-activity-api/events.md): The envelope every webhook carries, the event types, and the order they come in. - [Amounts](https://developers.securitize.io/investor-activity-api/amounts.md): Every amount is an integer string in base units, with the decimals that interpret it: cash in the currency's minor units, tokens in the token's base units. - [Errors](https://developers.securitize.io/investor-activity-api/errors.md): How errors look, what each code means, and what is safe to retry. - [Versioning](https://developers.securitize.io/investor-activity-api/versioning.md): How the API, its webhooks and these docs are versioned, and what your consumer must tolerate. - [Glossary](https://developers.securitize.io/investor-activity-api/glossary.md): The terms these docs use, in one place. - [Changelog](https://developers.securitize.io/investor-activity-api/changelog.md): Versions of the Investor Activity API, its webhooks and these docs, newest first. - [Get an access token](https://developers.securitize.io/investor-activity-api/api-reference/authentication/get-an-access-token.md): Exchanges the client id and secret Securitize issued you for a bearer token, with the OAuth 2.0 client credentials grant. Send the token in the `Authorization: Bearer` header of every other operation. - [List your holdings](https://developers.securitize.io/investor-activity-api/api-reference/assets/list-your-holdings.md): One entry per token you hold, with the total across every wallet and custody arrangement of your account, in base units. A token you held and fully redeemed can still appear, with `totalTokens` `"0"`. Not paginated. - [List your deposits for a token](https://developers.securitize.io/investor-activity-api/api-reference/deposits/list-your-deposits-for-a-token.md): The cash movements of your account for one token, one page at a time. A deposit carries `tokenIssuanceId` once tokens have been issued for it, and `null` until then: group the deposits by `tokenIssuanceId` and match each group with the transaction that carries the same value in `GET /transactions`.… - [Get a deposit](https://developers.securitize.io/investor-activity-api/api-reference/deposits/get-a-deposit.md): One deposit by its id: the `data.id` of an `investor.deposit.processed` webhook, or an id from `investor.minting.completed`'s `depositMovements`. A deposit outside your account answers `404`, the same as an id that does not exist. - [List your transactions for a token](https://developers.securitize.io/investor-activity-api/api-reference/transactions/list-your-transactions-for-a-token.md): The token movements on your account for one token, newest first by the time they were recorded, one page at a time. You appear as the receiver of an issuance and as the sender of a redemption transfer. An issuance for a subscription or a reinvested distribution carries `tokenIssuanceId`, the key tha… - [Get a transaction](https://developers.securitize.io/investor-activity-api/api-reference/transactions/get-a-transaction.md): One token transaction by its id: the `data.id` of an `investor.transaction.processed` webhook. A transaction you are neither the sender nor the receiver of answers `404`, the same as an id that does not exist. - [List the webhooks sent to you](https://developers.securitize.io/investor-activity-api/api-reference/webhook-events/list-the-webhooks-sent-to-you.md): Every webhook Securitize sent you, newest first, with its body exactly as delivered in `payload`. Page with `iterator`: pass the `meta.iterator` of a page to get the next one, until `meta.done` is `true`. Filter with `eventType` to read one type only. Before your webhook endpoint is set up, the list… - [Get one webhook by its event id](https://developers.securitize.io/investor-activity-api/api-reference/webhook-events/get-one-webhook-by-its-event-id.md): One webhook sent to you, by the `eventId` in its body or by the `svix-id` header of its delivery (`msg_…`). Use it to check whether a webhook you expect was sent, and what it carried. - [A cash movement was recorded](https://developers.securitize.io/investor-activity-api/api-reference/webhooks/a-cash-movement-was-recorded.md): Securitize recorded a cash movement on your account: a deposit received, its liquidation when the cash is applied to a token issuance, or a withdrawal or refund. `data.id` is the deposit's id in `GET /deposits/{depositId}`. This event fires before any token is issued, so it carries no `tokenIssuance… - [Tokens were issued to you](https://developers.securitize.io/investor-activity-api/api-reference/webhooks/tokens-were-issued-to-you.md): Tokens were minted to you on chain, for a subscription (`source` `subscription`) or for a distribution you reinvest (`source` `reinvest`). `data.id` is the `tokenIssuanceId`; `depositMovements` lists the cash movements behind this issuance, your `deposit` and the `liquidation` that applied it to the… - [A token transaction was recorded](https://developers.securitize.io/investor-activity-api/api-reference/webhooks/a-token-transaction-was-recorded.md): A token movement on your account was recorded on chain: the issuance of a subscription or a reinvestment (`type` `issuance`, with `tokenIssuanceId`), or the transfer that starts a redemption (`type` `transfer`). `data.id` is the transaction's id in `GET /transactions/{transactionId}`. - [A redemption request was recorded](https://developers.securitize.io/investor-activity-api/api-reference/webhooks/a-redemption-request-was-recorded.md): Your transfer was matched to the token's open redemption, within seconds and with no action on anyone's side: a request on record, not yet an approval, which comes with `investor.redemption.confirmed`. `data.id` is the redemption's id, the same in `investor.redemption.confirmed`, `investor.payout.in… - [A redemption was approved](https://developers.securitize.io/investor-activity-api/api-reference/webhooks/a-redemption-was-approved.md): Securitize approved the redemption and created its payment, so its cash amount is fixed: `amount` in the minor units of `currencyId`, to be paid with `paymentMethod`. The payment itself follows in `investor.payout.initiated` and `investor.payout.completed`. - [A redemption payout was sent](https://developers.securitize.io/investor-activity-api/api-reference/webhooks/a-redemption-payout-was-sent.md): The cash of a redemption left Securitize. Payment methods that complete in one step skip this event and send only `investor.payout.completed`. `sourceTransaction` is the token transfer that started the redemption, so the payout can be matched to it without another call. - [A payout was completed](https://developers.securitize.io/investor-activity-api/api-reference/webhooks/a-payout-was-completed.md): A payout reached you. For a redemption (`paymentMethod` other than `reinvest`), the same fields as `investor.payout.initiated` with `status` `completed`. For a distribution you reinvest (`paymentMethod` `reinvest`), the cash value of the distribution, with no `uetr` and no `sourceTransaction`: the t… - [Build with AI](https://developers.securitize.io/build-with-ai.md): Connect your coding agent to the Securitize docs. ## OpenAPI Specs - [openapi](/corporate-actions-api/openapi.yaml) - [openapi](/investor-activity-api/openapi.yaml) - [openapi](/secid-api/openapi.yaml) - [openapi](/stocks-api/openapi.yaml) ## AsyncAPI Specs - [asyncapi](/cet-underlying-api/asyncapi.yaml) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.