Developers › API reference › Portfolio Center

GET `/api/v1/accounts/{id}/positions`

Positions with value and weight.

Scope portfolio:read
operationId portfolioPositions

An account's positions with quantity, price, value, cost basis, unrealized gain or loss and weight, valued at the latest closes (as_of). Use GET /accounts/{id}/lots for the tax lots and GET /accounts/{id}/drift for the comparison with the model.

The token needs the scope portfolio:read, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.

Request

GET /api/v1/accounts/{id}/positions

Path parameters

Name	Description	Example
`id`	The id of the account.	`12`

Headers

Header	Required	Value
`Authorization`	yes	`Bearer <token>`: an OAuth access token (`vat_…`) or a personal access token (`vpt_…`). Get a token

Examples

Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.

curl

curl "https://vestoris.com/api/v1/accounts/12/positions" \
  -H "Authorization: Bearer $VESTORIS_TOKEN"

Python (requests)

import os, requests

r = requests.get(
    "https://vestoris.com/api/v1/accounts/12/positions",
    headers={
        "Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
    },
    timeout=30,
)
r.raise_for_status()  # errors are application/problem+json with a stable "code"
print(r.json())

JavaScript (fetch)

const res = await fetch("https://vestoris.com/api/v1/accounts/12/positions", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
  },
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);

Response

200 OK, application/json: PositionList. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.

Response fields

Field	Type	Description
`account_id`	id (string)	The account's id.
`as_of`	date-time	The time the values were computed.
`value`	decimal string or null	Value at the latest (simulated) closes.
`cash`	decimal string or null	Cash, as a decimal string.
`data`	list of Position	The records of this page or list.
`data[].security_id`	id (string)	The security's id.
`data[].symbol`	string	Ticker symbol.
`data[].name`	string	The name.
`data[].sector`	string	Sector.
`data[].quantity`	decimal string or null	Shares, as a decimal string.
`data[].price`	decimal string or null	Price (simulated unless the firm uploaded it).
`data[].value`	decimal string or null	Value at the latest (simulated) closes.
`data[].cost_basis`	decimal string or null	Total cost of the open lots.
`data[].unrealized_pnl`	decimal string or null	Unrealized gain or loss.
`data[].weight_pct`	decimal string or null	Weight in the account, in percent.
`simulated`	boolean	Always true: simulated data, paper trading.

Example response

HTTP/1.1 200 OK
Content-Type: application/json

{
    "account_id": "12",
    "as_of": "2026-10-27T14:30:00Z",
    "value": "5240000.00",
    "cash": "162440.00",
    "data": [
        {
            "security_id": "3",
            "symbol": "AAPL",
            "name": "Apple Inc.",
            "sector": "Information Technology",
            "quantity": "1400",
            "price": "231.45",
            "value": "324030.00",
            "cost_basis": "257880.00",
            "unrealized_pnl": "66150.00",
            "weight_pct": "6.18"
        },
        {
            "security_id": "7",
            "symbol": "MSFT",
            "name": "Microsoft Corp.",
            "sector": "Information Technology",
            "quantity": "600",
            "price": "428.10",
            "value": "256860.00",
            "cost_basis": "231000.00",
            "unrealized_pnl": "25860.00",
            "weight_pct": "4.90"
        }
    ],
    "simulated": true
}

Example values. Your values depend on your firm's data; prices, orders and fills are simulated.

Status codes and errors

Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.

Status	When	Problem codes
200	Success
400	The request is malformed	`invalid_request`
401	No token, or it is invalid or expired	`invalid_token`
403	The token lacks the scope, or the person or service account behind it lacks the privilege or account permission	`insufficient_scope` `forbidden` `ip_not_allowed`
404	Not found, or not visible to you (the API never confirms what you may not see)	`not_found`
429	Rate limited: wait for Retry-After seconds	`rate_limited`

{
    "type": "https://vestoris.com/developers/errors#validation_failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "Quantity must be greater than zero.",
    "code": "validation_failed",
    "instance": "/api/v1/accounts/12/positions"
}

On the screens

The same thing in the app is explained in:

Portfolio Center: accounts, holdings, drift and risk