Developers › API reference › Data

POST /api/v1/data/{dataset}

Load a file (CSV, TXT, XLSX or Vestoris XML) into a data set; the body is the file.

  • Scope data:load:<data set>
  • Legacy keys
  • operationId dataLoad

Loads one file into a data set. The request body is the file itself (CSV, TXT, XLSX or Vestoris XML, optionally gzip or zip, up to 50 MB); filename names it and its extension tells the format. The file is validated deterministically (identifiers' check digits, references, duplicates, dates, numbers) and staged as a batch with its diff. With apply=auto (OAuth tokens with data:write) a file with no rejected row is applied at once; otherwise a person reviews it, or you call POST /batches/{id}/apply. A rejected file answers 422 with the batch and its row codes. Uploads are deduplicated by content, so no Idempotency-Key is needed.

The token needs the scope data:load:<data set>, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.

Legacy keys. Also accepts the deprecated legacy data API keys (vst_…), with Deprecation and Sunset headers. Move to a service account.

Per data set. The scope names the data set, e.g. data:load:prices. A token may load only the data sets it was given.

Request

POST /api/v1/data/{dataset}

Path parameters

NameDescriptionExample
datasetThe data set to load (the token needs data:load:<data set>), e.g. prices, securities, positions.prices

Query parameters

NameRequiredDescription
filenameyesFile name with extension
modenoupsert (default) or full
business_datenoYYYY-MM-DD
applyno"auto": apply when nothing was rejected (OAuth tokens; needs data:write). Legacy keys use their own setting

Headers

HeaderRequiredValue
AuthorizationyesBearer <token>: an OAuth access token (vat_…) or a personal access token (vpt_…), or a legacy key (vst_…, deprecated). Get a token
Content-Typenoapplication/octet-stream (the file itself; CSV, TXT, XLSX or Vestoris XML, gzip or zip allowed)

Body

The file itself, sent as the raw request body (not a form). Name it with the filename query parameter; the extension tells Vestoris the format. See the Data Feed Reference for the XML formats and the loading center for CSV columns.

Examples

Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.

curl

curl -X POST "https://vestoris.com/api/v1/data/prices?filename=prices.csv&mode=upsert&business_date=2026-10-27" \
  -H "Authorization: Bearer $VESTORIS_TOKEN" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @prices.csv

Python (requests)

import os, requests

r = requests.post(
    "https://vestoris.com/api/v1/data/prices",
    headers={
        "Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
        "Content-Type": "application/octet-stream",
    },
    params={
        "filename": "prices.csv",
        "mode": "upsert",
        "business_date": "2026-10-27"
    },
    data=open("prices.csv", "rb"),
    timeout=30,
)
r.raise_for_status()  # errors are application/problem+json with a stable "code"
print(r.json())

JavaScript (fetch)

import { readFile } from "node:fs/promises";

const res = await fetch("https://vestoris.com/api/v1/data/prices?filename=prices.csv&mode=upsert&business_date=2026-10-27", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
    "Content-Type": "application/octet-stream",
  },
  body: await readFile("prices.csv"),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);

Response

201 Created, application/json: LegacyBatch. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.

Response fields
FieldTypeDescription
okbooleantrue when the file was accepted.
batchobjectThe batch the file became.
batch.idintegerThe record's id (a string of digits).
batch.datasetstringThe data set: securities, accounts, positions, lots, cash, prices, fx, corporate_actions, issuers, brokers, benchmarks…
batch.statusstringThe status.
batch.file_namestringThe file's name.
batch.sha256string or nullSHA-256 of the file.
batch.business_datestring or nullThe business date the data is for (YYYY-MM-DD).
batch.countsanyRows by outcome: new, changed, unchanged, rejected, deleted.
batch.messagestring or nullA message in plain words.
batch.hold_reasonstring or nullWhy the batch is held for review.
batch.created_atstring or nullWhen it was created.
batch.applied_atstring or nullWhen it was applied.
reviewstring or nullWhere a person reviews it.

Example response

HTTP/1.1 201 Created
Content-Type: application/json

{
    "ok": true,
    "batch": {
        "id": 1,
        "dataset": "prices",
        "status": "active",
        "file_name": "ACME_PRICE_20261027_001.xml",
        "sha256": "e3b0…",
        "business_date": "2026-10-27",
        "counts": {
            "new": 3,
            "changed": 12,
            "unchanged": 580,
            "rejected": 1
        },
        "message": "",
        "hold_reason": null,
        "created_at": "2026-10-27T14:30:00Z",
        "applied_at": "2026-10-27T14:30:00Z"
    },
    "review": null
}

Example values. Your values depend on your firm's data; prices, orders and fills are simulated.

Status codes and errors

Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.

StatusWhenProblem codes
201Created
400The request is malformedinvalid_request
401No token, or it is invalid or expiredinvalid_token
403The token lacks the scope, or the person or service account behind it lacks the privilege or account permissioninsufficient_scope forbidden ip_not_allowed legacy_keys_disabled
404Not found, or not visible to you (the API never confirms what you may not see)not_found
409Not possible in the current stateinvalid_transition conflict
413The file is too largepayload_too_large
415Unsupported file typeunsupported_media_type
422The file was rejected (the batch with its row codes is in the body) or failed validationvalidation_failed
429Rate limited: wait for Retry-After secondsrate_limited
{
    "type": "https://vestoris.com/developers/errors#validation_failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "Quantity must be greater than zero.",
    "code": "validation_failed",
    "instance": "/api/v1/data/prices"
}

On the screens

The same thing in the app is explained in: