Skip to main content
Beta. These endpoints are being opened to partners through the partner gateway. Paths, fields and errors can change before release, and sandbox access is arranged with your Securitize contact.

Base URL

Every path in this documentation is relative to that base URL. Keep it in one configuration value. Production uses the same paths at a production base URL, arranged with Securitize once your integration passes the go-live checklist.

Authentication

Every request comes from your backend, with your API key in the x-api-key header:
  • Header only. A query parameter or another header name counts as no key.
  • The key identifies you, not the investor. There is no investor login, session or token. Securitize relies on your assertion that the investor is who you say, as it does in the SecId API.

Naming the investor

Every call about an investor carries investorId: Securitize’s id for the investor, as the SecId API’s create returned it. It goes in the query string on GET /stocks/realtime-price, and in the body of every POST.
Relying on you for identity does not mean relying on you for permission. On every priced request and every order, Securitize looks up the investor’s current state, and refuses the call if they cannot trade. See Prepare an investor to trade.
The investor’s IP address and location are recorded with every real-time price and every order. The fields that carry them from your backend are being defined, and will be added here.

Keeping keys safe

  • The key is a secret: keep it in a secrets manager, inject it at runtime, and rotate it at once if it is exposed. Never put it in source control or in frontend code.
  • Keep separate keys for sandbox and production.
  • Your frontend never calls Securitize. It relays what the investor’s wallet signs to your backend, which makes the call.

When the key is wrong

A missing or unknown key is refused before the request reaches the API. The answer is a bare {"message": "..."}: Every other error carries a statusCode and a code in message. See Errors.