Developers › API reference › Orders
GET /api/v1/orders
Orders on the accounts you can see.
- Scope
orders:read - operationId
ordersList
The token needs the scope orders:read, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.
Paginated. Cursor pagination: limit (1 to 200, default 50); pass next_cursor as cursor until has_more is false. fields= returns only the named fields.
Request
GET /api/v1/orders
Query parameters
| Name | Required | Description |
|---|---|---|
limit | no | Page size, 1 to 200 (default 50) |
cursor | no | The next_cursor of the previous page |
sort | no | "-id" (newest first, default) or "id" |
fields | no | Sparse fieldset: comma-separated field names |
state | no | Comma-separated states |
side | no | buy or sell |
symbol | no | Symbol |
account | no | Account id |
created_from | no | ISO 8601 |
created_to | no | ISO 8601 |
Headers
| Header | Required | Value |
|---|---|---|
Authorization | yes | Bearer <token>: an OAuth access token (vat_…) or a personal access token (vpt_…). Get a token |
Examples
Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.
curl
curl "https://vestoris.com/api/v1/orders?limit=20&state=working%2Cpartially_filled&side=buy" \
-H "Authorization: Bearer $VESTORIS_TOKEN"
Python (requests)
import os, requests
r = requests.get(
"https://vestoris.com/api/v1/orders",
headers={
"Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
},
params={
"limit": "20",
"state": "working,partially_filled",
"side": "buy"
},
timeout=30,
)
r.raise_for_status() # errors are application/problem+json with a stable "code"
print(r.json())
JavaScript (fetch)
const res = await fetch("https://vestoris.com/api/v1/orders?limit=20&state=working%2Cpartially_filled&side=buy", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
},
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);
Response
200 OK, application/json: a page of OrderSummary. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.
Response fields
| Field | Type | Description |
|---|---|---|
data | list of OrderSummary | The records of this page. |
data[].id | id (string) | The record's id (a string of digits). |
data[].symbol | string | Ticker symbol. |
data[].side | string | "buy" or "sell". |
data[].order_type | string | "market" or "limit". |
data[].quantity | decimal string | Shares, as a decimal string. |
data[].filled_quantity | decimal string or null | Shares filled so far (simulated). |
data[].limit_price | decimal string or null | Limit price (null for a market order). |
data[].avg_fill_price | decimal string or null | Average price of the simulated fills so far. |
data[].state | string | The order's state (see the order life cycle). |
data[].compliance_state | string | The latest compliance result: "pass", "warn", "block" or "pending". |
data[].is_block | boolean | True for a block order across several accounts. |
data[].algo | string | The simulated execution algorithm: "vwap", "twap" or "none" (all at once); "" before release. |
data[].created_by | id (string) or null | The user who created it. |
data[].created_at | date-time or null | When it was created. |
next_cursor | string or null | Pass as ?cursor= for the next page; null on the last page. |
has_more | boolean | True when another page follows. |
Example response
HTTP/1.1 200 OK
Content-Type: application/json
{
"data": [
{
"id": "5301",
"symbol": "AAPL",
"side": "buy",
"order_type": "limit",
"quantity": "1800",
"filled_quantity": "900",
"limit_price": "232.00",
"avg_fill_price": "231.52",
"state": "partially_filled",
"compliance_state": "pass",
"is_block": true,
"algo": "vwap",
"created_by": "9",
"created_at": "2026-10-27T14:30:00Z"
}
],
"next_cursor": "eyJpZCI6NTI5OX0",
"has_more": true
}
Example values. Your values depend on your firm's data; prices, orders and fills are simulated.
Status codes and errors
Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.
| Status | When | Problem codes |
|---|---|---|
| 200 | Success | |
| 400 | The request is malformed | invalid_request |
| 401 | No token, or it is invalid or expired | invalid_token |
| 403 | The token lacks the scope, or the person or service account behind it lacks the privilege or account permission | insufficient_scope forbidden ip_not_allowed |
| 429 | Rate limited: wait for Retry-After seconds | rate_limited |
{
"type": "https://vestoris.com/developers/errors#validation_failed",
"title": "Validation failed",
"status": 422,
"detail": "Quantity must be greater than zero.",
"code": "validation_failed",
"instance": "/api/v1/orders"
}
On the screens
The same thing in the app is explained in: