Developers › API reference › Data
POST /api/v1/data/{dataset}
Load a file (CSV, TXT, XLSX or Vestoris XML) into a data set; the body is the file.
- Scope
data:load:<data set> - Legacy keys
- operationId
dataLoad
Loads one file into a data set. The request body is the file itself (CSV, TXT, XLSX or Vestoris XML, optionally gzip or zip, up to 50 MB); filename names it and its extension tells the format. The file is validated deterministically (identifiers' check digits, references, duplicates, dates, numbers) and staged as a batch with its diff. With apply=auto (OAuth tokens with data:write) a file with no rejected row is applied at once; otherwise a person reviews it, or you call POST /batches/{id}/apply. A rejected file answers 422 with the batch and its row codes. Uploads are deduplicated by content, so no Idempotency-Key is needed.
The token needs the scope data:load:<data set>, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.
Legacy keys. Also accepts the deprecated legacy data API keys (vst_…), with Deprecation and Sunset headers. Move to a service account.
Per data set. The scope names the data set, e.g. data:load:prices. A token may load only the data sets it was given.
Request
POST /api/v1/data/{dataset}
Path parameters
| Name | Description | Example |
|---|---|---|
dataset | The data set to load (the token needs data:load:<data set>), e.g. prices, securities, positions. | prices |
Query parameters
| Name | Required | Description |
|---|---|---|
filename | yes | File name with extension |
mode | no | upsert (default) or full |
business_date | no | YYYY-MM-DD |
apply | no | "auto": apply when nothing was rejected (OAuth tokens; needs data:write). Legacy keys use their own setting |
Headers
| Header | Required | Value |
|---|---|---|
Authorization | yes | Bearer <token>: an OAuth access token (vat_…) or a personal access token (vpt_…), or a legacy key (vst_…, deprecated). Get a token |
Content-Type | no | application/octet-stream (the file itself; CSV, TXT, XLSX or Vestoris XML, gzip or zip allowed) |
Body
The file itself, sent as the raw request body (not a form). Name it with the filename query parameter; the extension tells Vestoris the format. See the Data Feed Reference for the XML formats and the loading center for CSV columns.
Examples
Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.
curl
curl -X POST "https://vestoris.com/api/v1/data/prices?filename=prices.csv&mode=upsert&business_date=2026-10-27" \
-H "Authorization: Bearer $VESTORIS_TOKEN" \
-H "Content-Type: application/octet-stream" \
--data-binary @prices.csv
Python (requests)
import os, requests
r = requests.post(
"https://vestoris.com/api/v1/data/prices",
headers={
"Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
"Content-Type": "application/octet-stream",
},
params={
"filename": "prices.csv",
"mode": "upsert",
"business_date": "2026-10-27"
},
data=open("prices.csv", "rb"),
timeout=30,
)
r.raise_for_status() # errors are application/problem+json with a stable "code"
print(r.json())
JavaScript (fetch)
import { readFile } from "node:fs/promises";
const res = await fetch("https://vestoris.com/api/v1/data/prices?filename=prices.csv&mode=upsert&business_date=2026-10-27", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
"Content-Type": "application/octet-stream",
},
body: await readFile("prices.csv"),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);
Response
201 Created, application/json: LegacyBatch. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.
Response fields
| Field | Type | Description |
|---|---|---|
ok | boolean | true when the file was accepted. |
batch | object | The batch the file became. |
batch.id | integer | The record's id (a string of digits). |
batch.dataset | string | The data set: securities, accounts, positions, lots, cash, prices, fx, corporate_actions, issuers, brokers, benchmarks… |
batch.status | string | The status. |
batch.file_name | string | The file's name. |
batch.sha256 | string or null | SHA-256 of the file. |
batch.business_date | string or null | The business date the data is for (YYYY-MM-DD). |
batch.counts | any | Rows by outcome: new, changed, unchanged, rejected, deleted. |
batch.message | string or null | A message in plain words. |
batch.hold_reason | string or null | Why the batch is held for review. |
batch.created_at | string or null | When it was created. |
batch.applied_at | string or null | When it was applied. |
review | string or null | Where a person reviews it. |
Example response
HTTP/1.1 201 Created
Content-Type: application/json
{
"ok": true,
"batch": {
"id": 1,
"dataset": "prices",
"status": "active",
"file_name": "ACME_PRICE_20261027_001.xml",
"sha256": "e3b0…",
"business_date": "2026-10-27",
"counts": {
"new": 3,
"changed": 12,
"unchanged": 580,
"rejected": 1
},
"message": "",
"hold_reason": null,
"created_at": "2026-10-27T14:30:00Z",
"applied_at": "2026-10-27T14:30:00Z"
},
"review": null
}
Example values. Your values depend on your firm's data; prices, orders and fills are simulated.
Status codes and errors
Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.
| Status | When | Problem codes |
|---|---|---|
| 201 | Created | |
| 400 | The request is malformed | invalid_request |
| 401 | No token, or it is invalid or expired | invalid_token |
| 403 | The token lacks the scope, or the person or service account behind it lacks the privilege or account permission | insufficient_scope forbidden ip_not_allowed legacy_keys_disabled |
| 404 | Not found, or not visible to you (the API never confirms what you may not see) | not_found |
| 409 | Not possible in the current state | invalid_transition conflict |
| 413 | The file is too large | payload_too_large |
| 415 | Unsupported file type | unsupported_media_type |
| 422 | The file was rejected (the batch with its row codes is in the body) or failed validation | validation_failed |
| 429 | Rate limited: wait for Retry-After seconds | rate_limited |
{
"type": "https://vestoris.com/developers/errors#validation_failed",
"title": "Validation failed",
"status": 422,
"detail": "Quantity must be greater than zero.",
"code": "validation_failed",
"instance": "/api/v1/data/prices"
}
On the screens
The same thing in the app is explained in: