Help center › Developers
The Vestoris API
Everything you do on these screens can also be done by your own systems and scripts through the Vestoris REST API, under exactly the same rules: your role, your privileges, the accounts you may see, four eyes, the compliance engine and the workflow rules. Paper trading: the API places simulated orders only.
For your own scripts
Open My API access (Oversight menu) and create a personal access token: give it a name, choose its scopes (only those your role can use) and an expiry. Copy it when it is shown: it is shown once. Revoke it there at any time.
For systems and apps (Admins)
On API clients and webhooks, an Admin adds:
- a service account for a system (client credentials): a role, scopes, an IP allow-list, a token lifetime and a rate limit;
- an app used by people (authorization code with PKCE): its exact HTTPS redirect addresses. People see a consent screen and grant only what their role allows; they can withdraw access on My API access;
- webhooks: signed notifications of orders, fills, violations, workflow items and SLA breaches, feeds and the start of day, and rule activations, sent to your HTTPS endpoint.
The older data API keys (Data › Legacy API keys) still work for loading files, but they are deprecated. Move them to a service account; the API page shows when each was last used, and an Admin can switch them off.
What a token can never do
Sign off a compliance or workflow rule without a person confirming the exact version, approve something its own person entered, reach accounts its person cannot see, or execute a natural-language plan without the confirmation of its preview.
Learn more
The developer docs explain each way to sign in with curl examples, the scopes, pagination, idempotency, errors and webhook signatures; the API reference lists every endpoint. In the demo, the API console lets you try calls against your own sandbox.