Developers › API reference › Orders

POST /api/v1/orders/{id}/allocate

Confirm the allocation of executions (Operations).

  • Scope orders:write
  • Idempotency-Key
  • operationId ordersAllocate

The token needs the scope orders:write, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.

Idempotency-Key. Send a unique Idempotency-Key (up to 255 characters, e.g. a UUID) with every POST. Retrying with the same key and body replays the first answer for 24 hours, so a timeout never creates a second order; the same key with a different body is refused (idempotency_key_reused).

Request

POST /api/v1/orders/{id}/allocate

Path parameters

NameDescriptionExample
idThe id of the order.5301

Headers

HeaderRequiredValue
AuthorizationyesBearer <token>: an OAuth access token (vat_…) or a personal access token (vpt_…). Get a token
Idempotency-KeyyesA unique string up to 255 characters (a UUID). Idempotency

Examples

Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.

curl

curl -X POST "https://vestoris.com/api/v1/orders/5301/allocate" \
  -H "Authorization: Bearer $VESTORIS_TOKEN" \
  -H 'Idempotency-Key: 7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11'

Python (requests)

import os, requests

r = requests.post(
    "https://vestoris.com/api/v1/orders/5301/allocate",
    headers={
        "Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
        "Idempotency-Key": "7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11",
    },
    timeout=30,
)
r.raise_for_status()  # errors are application/problem+json with a stable "code"
print(r.json())

JavaScript (fetch)

const res = await fetch("https://vestoris.com/api/v1/orders/5301/allocate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
    "Idempotency-Key": "7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11",
  },
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);

Response

200 OK, application/json: Order. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.

Response fields
FieldTypeDescription
idid (string)The record's id (a string of digits).
security_idid (string)The security's id.
symbolstringTicker symbol.
sidestring"buy" or "sell".
order_typestring"market" or "limit".
limit_pricedecimal string or nullLimit price (null for a market order).
quantitydecimal stringTotal shares across the allocations.
filled_quantitydecimal string or nullShares filled so far (simulated).
avg_fill_pricedecimal string or nullAverage price of the simulated fills so far.
statestringproposed, pending_compliance, compliance_hold, pending_approval, approved, working, partially_filled, filled, cancelled or rejected.
compliance_statestringThe latest compliance result: "pass", "warn", "block" or "pending".
is_blockbooleanTrue for a block order across several accounts.
algostringThe simulated execution algorithm: "vwap", "twap" or "none" (all at once); "" before release.
slicesintegerHow many slices the simulator works the order in.
arrival_pricedecimal string or nullThe simulated price when the order was released (the benchmark for slippage).
approval_requiredbooleanWhether the order needs an approver (four eyes).
approval_reasonstringWhy the order needs an approver ("" when it does not).
status_reasonstringWhy the order is in its state.
notesstringNotes.
venuestringSimulated venue.
created_byid (string) or nullThe user who created it.
approved_byid (string) or nullThe user who approved the order.
trader_idid (string) or nullThe trader the order is assigned to.
pipeline_run_idid (string) or nullThe Intent Pipeline request it came from.
proposal_idid (string) or nullThe rebalance proposal it came from.
allocationslist of AllocationHow the order is split between accounts.
allocations[].account_idid (string)The account's id.
allocations[].quantitydecimal string or nullShares for the account.
allocations[].filled_quantitydecimal string or nullShares filled for the account.
hidden_allocationsintegerAllocations on accounts you may not see (counted, never shown).
allocated_atdate-time or nullWhen Operations confirmed the allocation.
created_atdate-time or nullWhen it was created.
submitted_atdate-time or nullWhen the order was submitted.
approved_atdate-time or nullWhen the order was approved.
working_atdate-time or nullWhen the order started working in the simulator.
done_atdate-time or nullWhen the order reached a final state.
simulatedbooleanAlways true: simulated data, paper trading.
resultobjectThe outcome.
result.statestringproposed, pending_compliance, compliance_hold, pending_approval, approved, working, partially_filled, filled, cancelled or rejected.
result.compliancelistThe results of the compliance checks (rule, outcome, measured value, limit).
result.approvals_neededlistWho still has to approve.
result.needs_overridebooleanTrue when a soft warning waits for an override reason.
result.overrideanyThe override request, if any.
historylist of OrderHistoryEvery state change, oldest first.
history[].fromstringState before.
history[].tostringState after.
history[].byid (string) or nullThe user who made the change.
history[].reasonstringWhy.
history[].atdate-time or nullWhen it happened.

Example response

HTTP/1.1 200 OK
Content-Type: application/json

{
    "id": "1042",
    "security_id": "3",
    "symbol": "AAPL",
    "side": "buy",
    "order_type": "limit",
    "limit_price": "232.00",
    "quantity": "1800",
    "filled_quantity": "0",
    "avg_fill_price": "231.52",
    "state": "pending_approval",
    "compliance_state": "pass",
    "is_block": false,
    "algo": "vwap",
    "slices": 4,
    "arrival_price": "231.45",
    "approval_required": true,
    "approval_reason": "Order value $1.25M is above the firm threshold of $1M",
    "status_reason": "Order value above the approval threshold",
    "notes": "Rebalance, Growth accounts",
    "venue": "SIM",
    "created_by": "7",
    "approved_by": null,
    "trader_id": null,
    "pipeline_run_id": null,
    "proposal_id": null,
    "allocations": [
        {
            "account_id": "12",
            "quantity": "1200",
            "filled_quantity": "0"
        }
    ],
    "hidden_allocations": 0,
    "allocated_at": null,
    "created_at": "2026-10-27T14:30:00Z",
    "submitted_at": "2026-10-27T14:30:00Z",
    "approved_at": null,
    "working_at": null,
    "done_at": null,
    "simulated": true,
    "result": {
        "state": "pending_approval",
        "compliance": [],
        "approvals_needed": [
            "portfolio_manager"
        ],
        "needs_override": false,
        "override": null
    },
    "history": [
        {
            "from": "pending_compliance",
            "to": "pending_approval",
            "by": "7",
            "reason": "Above the firm approval threshold",
            "at": "2026-10-27T14:30:00Z"
        }
    ]
}

Example values. Your values depend on your firm's data; prices, orders and fills are simulated.

Status codes and errors

Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.

StatusWhenProblem codes
200Success
200 / 201The same Idempotency-Key again: the first answer is replayed (24 hours)
400The request is malformedinvalid_request
401No token, or it is invalid or expiredinvalid_token
403The token lacks the scope, or the person or service account behind it lacks the privilege or account permissioninsufficient_scope forbidden ip_not_allowed
404Not found, or not visible to you (the API never confirms what you may not see)not_found
409Not possible in the current stateinvalid_transition conflict idempotency_in_progress
422Validation failed (the detail says which field), or blockedvalidation_failed idempotency_key_reused
428A required header is missingidempotency_key_required
429Rate limited: wait for Retry-After secondsrate_limited
{
    "type": "https://vestoris.com/developers/errors#validation_failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "Quantity must be greater than zero.",
    "code": "validation_failed",
    "instance": "/api/v1/orders/5301/allocate"
}

On the screens

The same thing in the app is explained in: