Developers › API reference › Portfolio Center

POST `/api/v1/what-ifs`

A what-if: sector changes for accounts, as a pipeline proposal.

Scope portfolio:write
Idempotency-Key
operationId portfolioWhatIf

The token needs the scope portfolio:write, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.

Idempotency-Key. Send a unique Idempotency-Key (up to 255 characters, e.g. a UUID) with every POST. Retrying with the same key and body replays the first answer for 24 hours, so a timeout never creates a second order; the same key with a different body is refused (idempotency_key_reused).

Request

POST /api/v1/what-ifs

Headers

Header	Required	Value
`Authorization`	yes	`Bearer <token>`: an OAuth access token (`vat_…`) or a personal access token (`vpt_…`). Get a token
`Idempotency-Key`	yes	A unique string up to 255 characters (a UUID). Idempotency
`Content-Type`	yes	`application/json`

Body: `WhatIfIn`

Field	Type	Required	Description
`account_ids`	list	yes	Account ids.
`params`	object	yes	The change: sector_adjustments [{sector, change_pct}] (negative trims) or cash_target_pct, plus the rebalance constraints.

Decimals (money, prices, quantities, percentages) are sent as strings, ids as strings, times as ISO 8601 UTC.

Examples

Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.

curl

curl -X POST "https://vestoris.com/api/v1/what-ifs" \
  -H "Authorization: Bearer $VESTORIS_TOKEN" \
  -H 'Idempotency-Key: 7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11' \
  -H "Content-Type: application/json" \
  -d '{"account_ids":["12"],"params":{"sector_adjustments":[{"sector":"Technology","change_pct":-3}],"max_realized_gain":25000}}'

Python (requests)

import os, requests

r = requests.post(
    "https://vestoris.com/api/v1/what-ifs",
    headers={
        "Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
        "Idempotency-Key": "7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11",
    },
    json={
        "account_ids": [
            "12"
        ],
        "params": {
            "sector_adjustments": [
                {
                    "sector": "Technology",
                    "change_pct": -3
                }
            ],
            "max_realized_gain": 25000
        }
    },
    timeout=30,
)
r.raise_for_status()  # errors are application/problem+json with a stable "code"
print(r.json())

JavaScript (fetch)

const res = await fetch("https://vestoris.com/api/v1/what-ifs", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
    "Idempotency-Key": "7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
      "account_ids": [
          "12"
      ],
      "params": {
          "sector_adjustments": [
              {
                  "sector": "Technology",
                  "change_pct": -3
              }
          ],
          "max_realized_gain": 25000
      }
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);

Response

201 Created, application/json: PipelineRun. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.

Response fields

Field	Type	Description
`id`	id (string)	The record's id (a string of digits).
`request`	string	The request in the user's words.
`status`	string	interpreted, checked, orders_created, failed or cancelled.
`interpreted_by_ai`	boolean	True when the AI interpreted the text; false when the built-in parser did.
`intent`	any	The structured intent the request was interpreted as (accounts, changes, constraints).
`stages`	any	Each stage (interpret, entitlements, proposal, compliance, orders) with its outcome.
`created_at`	date-time or null	When it was created.
`updated_at`	date-time or null	When it last changed.
`note`	string	A reminder that nothing is executed by the pipeline.

Example response

HTTP/1.1 201 Created
Content-Type: application/json

{
    "id": "1042",
    "request": "Rebalance growth accounts, no gains over $25k",
    "status": "checked",
    "interpreted_by_ai": true,
    "intent": {
        "action": "rebalance",
        "accounts": [
            "tag:growth"
        ],
        "constraints": {
            "max_realized_gain": "25000"
        }
    },
    "stages": [
        {
            "stage": "entitlements",
            "ok": true,
            "accounts": [
                "12",
                "14"
            ]
        },
        {
            "stage": "compliance",
            "ok": true,
            "warnings": 1
        }
    ],
    "created_at": "2026-10-27T14:30:00Z",
    "updated_at": "2026-10-27T14:30:00Z",
    "note": "Nothing is executed: create orders, then release them."
}

Example values. Your values depend on your firm's data; prices, orders and fills are simulated.

Status codes and errors

Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.

Status	When	Problem codes
201	Created
200 / 201	The same Idempotency-Key again: the first answer is replayed (24 hours)
400	The request is malformed	`invalid_request` `invalid_json`
401	No token, or it is invalid or expired	`invalid_token`
403	The token lacks the scope, or the person or service account behind it lacks the privilege or account permission	`insufficient_scope` `forbidden` `ip_not_allowed`
409	Not possible in the current state	`invalid_transition` `conflict` `idempotency_in_progress`
422	Validation failed (the detail says which field), or blocked	`validation_failed` `idempotency_key_reused`
428	A required header is missing	`idempotency_key_required`
429	Rate limited: wait for Retry-After seconds	`rate_limited`

{
    "type": "https://vestoris.com/developers/errors#validation_failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "Quantity must be greater than zero.",
    "code": "validation_failed",
    "instance": "/api/v1/what-ifs"
}

On the screens

The same thing in the app is explained in:

Rebalancing and what-ifs

POST /api/v1/what-ifs