Legacy API keys: migration guide

The 1.2 data API keys (vst_..., made on Data › API tokens) still work, but they are deprecated:

They reach only the data, feed and bundle endpoints: POST /api/v1/data/{data set}, GET /api/v1/batches/{id}, POST /api/v1/feeds/bundles, GET /api/v1/feeds/bundles/{id} and POST /api/v1/feeds/{id}/files. Anything else answers 403 legacy_key_scope.
Every answer carries Deprecation, Sunset: Mon, 01 Nov 2027 00:00:00 GMT and Link: <https://vestoris.com/developers/legacy-keys>; rel="deprecation".
An Admin can turn legacy keys off for the firm on API clients and webhooks (then: 403 legacy_keys_disabled), and sees there when each key was last used.

Moving to OAuth

An Admin creates a service account client with the role Operations and the scopes data:read plus one data:load:<data set> per data set the key could load (for example data:load:prices data:load:holdings). Add data:write if the key applied clean files automatically.
Your job gets a token, then sends the same requests:

TOKEN=$(curl -s -X POST https://vestoris.com/oauth/token -u "$VESTORIS_CLIENT_ID:$VESTORIS_CLIENT_SECRET" \
  -d grant_type=client_credentials -d "scope=data:read data:load:prices data:write" | jq -r .access_token)
curl -X POST "https://vestoris.com/api/v1/data/prices?filename=eod_prices.csv&apply=auto" \
  -H "Authorization: Bearer $TOKEN" --data-binary @eod_prices.csv

The answers are the same as before ({"ok": true, "batch": {...}}). With OAuth, "apply automatically" is per request (apply=auto, which needs data:write) instead of a property of the key.
Revoke the old key, and when no legacy key is used any more, turn legacy keys off.

API reference All developer pages