Developers › API reference › Portfolio Center

PATCH `/api/v1/accounts/{id}`

Change an account, incl. its model (If-Match).

Scope reference:write
If-Match
operationId portfolioUpdateAccount

The token needs the scope reference:write, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.

If-Match. Send If-Match with the ETag of your latest GET. If someone changed the resource since, you get 412 precondition_failed and nothing changes: GET it again, re-apply your change and retry.

Request

PATCH /api/v1/accounts/{id}

Path parameters

Name	Description	Example
`id`	The id of the account.	`12`

Headers

Header	Required	Value
`Authorization`	yes	`Bearer <token>`: an OAuth access token (`vat_…`) or a personal access token (`vpt_…`). Get a token
`If-Match`	yes	The `ETag` of your latest GET of this resource. ETags
`Content-Type`	yes	`application/json`

Body: `AccountIn`

Field	Type	Required	Description
`code`	string	no	A unique code.
`name`	string	no	The account's name.
`strategy`	string	no	Strategy.
`tags`	any	no	Tags (list of strings).
`model_id`	any	no	A model id, or null to unassign.
`lot_method`	string	no	"tax_optimal" or "fifo".

Other fields of the resource are accepted too; unknown fields are reported by a validation problem, never ignored silently.

Decimals (money, prices, quantities, percentages) are sent as strings, ids as strings, times as ISO 8601 UTC.

Examples

Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.

curl

curl -X PATCH "https://vestoris.com/api/v1/accounts/12" \
  -H "Authorization: Bearer $VESTORIS_TOKEN" \
  -H 'If-Match: "3f1a9c0e5b7d2a4c8e6f0b1d3a5c7e9f"' \
  -H "Content-Type: application/json" \
  -d '{"code":"GRW-C","name":"Growth Fund C","strategy":"Growth","tags":["growth"],"model_id":"2","lot_method":"tax_optimal"}'

Python (requests)

import os, requests

r = requests.patch(
    "https://vestoris.com/api/v1/accounts/12",
    headers={
        "Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
        "If-Match": "\"3f1a9c0e5b7d2a4c8e6f0b1d3a5c7e9f\"",
    },
    json={
        "code": "GRW-C",
        "name": "Growth Fund C",
        "strategy": "Growth",
        "tags": [
            "growth"
        ],
        "model_id": "2",
        "lot_method": "tax_optimal"
    },
    timeout=30,
)
r.raise_for_status()  # errors are application/problem+json with a stable "code"
print(r.json())

JavaScript (fetch)

const res = await fetch("https://vestoris.com/api/v1/accounts/12", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
    "If-Match": "\"3f1a9c0e5b7d2a4c8e6f0b1d3a5c7e9f\"",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
      "code": "GRW-C",
      "name": "Growth Fund C",
      "strategy": "Growth",
      "tags": [
          "growth"
      ],
      "model_id": "2",
      "lot_method": "tax_optimal"
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);

Response

200 OK, application/json: Account. With an ETag header. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.

Response fields

Field	Type	Description
`id`	id (string)	The record's id (a string of digits).
`code`	string	A short code (unique within its kind).
`name`	string	The account's name.
`strategy`	string	The account's strategy.
`tags`	list of string	Tags used to pick accounts ("growth", "income"…).
`base_currency`	string	The account's currency (ISO 4217).
`model_id`	id (string) or null	The account's model portfolio (null: none).
`lot_method`	string	How lots are picked when selling: "tax_optimal" or "fifo".
`status`	string	"active" or "closed".
`value`	decimal string or null	Value at the latest (simulated) closes.
`cash`	decimal string or null	Cash, as a decimal string.
`cash_pct`	decimal string or null	Cash as a percent of the account's value.
`holdings`	integer	Number of positions.
`your_permissions`	list of string	Your permissions on the account.
`user_defined`	object	User-defined field values by field name.
`created_at`	date-time or null	When it was created.

Example response

HTTP/1.1 200 OK
Content-Type: application/json
ETag: "3f1a9c0e5b7d2a4c8e6f0b1d3a5c7e9f"

{
    "id": "1042",
    "code": "GRW-A",
    "name": "Growth Fund A",
    "strategy": "Growth",
    "tags": [
        "growth"
    ],
    "base_currency": "USD",
    "model_id": "2",
    "lot_method": "tax_optimal",
    "status": "active",
    "value": "5240000.00",
    "cash": "182340.55",
    "cash_pct": "3.10",
    "holdings": 24,
    "your_permissions": [
        "view",
        "propose",
        "trade"
    ],
    "user_defined": {
        "Internal rating": "A"
    },
    "created_at": "2026-10-27T14:30:00Z"
}

Example values. Your values depend on your firm's data; prices, orders and fills are simulated.

Status codes and errors

Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.

Status	When	Problem codes
200	Success
400	The request is malformed	`invalid_request` `invalid_json`
401	No token, or it is invalid or expired	`invalid_token`
403	The token lacks the scope, or the person or service account behind it lacks the privilege or account permission	`insufficient_scope` `forbidden` `ip_not_allowed`
404	Not found, or not visible to you (the API never confirms what you may not see)	`not_found`
409	Not possible in the current state	`invalid_transition` `conflict`
412	The resource changed since your GET: get it again and retry with the new ETag	`precondition_failed`
422	Validation failed (the detail says which field), or blocked	`validation_failed`
428	A required header is missing	`precondition_required`
429	Rate limited: wait for Retry-After seconds	`rate_limited`

{
    "type": "https://vestoris.com/developers/errors#validation_failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "Quantity must be greater than zero.",
    "code": "validation_failed",
    "instance": "/api/v1/accounts/12"
}

On the screens

The same thing in the app is explained in:

PATCH /api/v1/accounts/{id}