Skip to content

Partner API

The Partner API lets an outside party create end-client accounts and read accounts, transactions, and positions for a single brand — without ever signing in to the Backoffice.

A broker issues a partner a username and password for one of its brands and hands them to an affiliate, an introducing broker, or an external CRM. The partner exchanges those credentials for a short-lived bearer token and sends that token on every request. There is no interactive login and no session: the credentials identify the brand and the firm they belong to, and carry the scopes that decide what the caller may do.

Everything the token can reach is confined to that one brand. Filters and queries can only narrow what a token already sees — they can never widen it into another brand's or firm's data.

Video walkthrough

A three-minute, end-to-end tour: onboarding a partner in the Backoffice and setting its scope, the published seven-operation contract at /partner/docs with bearer authentication, and managing a partner's credentials over its lifetime.

Transcript
  • [00:00] The Partner API is the secure way a broker gives an affiliate or introducing broker scoped access to the CRM. It rebuilds the legacy Affiliate API, so a partner keeps its existing integration and simply re-points it here.
  • [00:17] Setup happens in the Backoffice. Under Security, open Partners. Each partner is one credential you hand to one affiliate, with its own scope and lead routing.
  • [00:28] First pick the brand the partner works under. The credential is scoped to that brand and its firm, so the partner only ever sees data inside it.
  • [00:37] Add a partner. You give it a label and a username, and a strong password is generated for you.
  • [00:44] On create, the password is shown only once. Copy it now and hand it to the partner — only a hash is stored, so it can never be shown again.
  • [00:53] Now set the partner's scope. Account visibility decides what it can read back. Own accounts means only the accounts that partner itself created; All brand accounts means every account under the brand. Own is scoped by the creating partner, so affiliates never see each other's accounts.
  • [01:12] Monetary transactions are graded exactly like the legacy API — none, first-time deposits only, or all transactions.
  • [01:21] Toggle trading positions, and grant creation permissions — Create lead, Create real account, or Registration with single sign-on — so the partner can inject new clients.
  • [01:33] Point the partner at a default lead owner, so every lead it sends lands with the right desk automatically. Switch to Business unit and the dropdown lists the firm's business units.
  • [01:46] Partners consume the API from its published contract, at /partner/docs. The surface is exactly seven operations — the read methods read plainly as Get accounts, Get transactions, and Get trading positions.
  • [02:07] Partners can try the calls right from the docs. Open a create method like Create a lead account. It shows a Bearer Authentication box, so the request carries an Authorization: Bearer token, and phone is a required field.
  • [02:25] Back in the Backoffice, credentials are managed per partner. Open Credentials. The username is masked; click reveal to show it, and copy it with one click.
  • [02:36] You can rename the partner's username right here. Active tokens keep working, because they key on the internal record — only the login name changes.
  • [02:45] And you can rotate the password. A new strong password is generated and shown once, and the old one stops working immediately.

Base path

The endpoints are served under a single base URL that your integration is given. Use a placeholder such as https://api.example.com in the examples throughout these pages and substitute the base URL for your integration.

Start here

  • Authentication — how you exchange your username and password for a 23-hour token, send it as a bearer, and work with scopes, the IP allow-list, and throttling.
  • Querying data — the bracketed filter, ordering, and pagination syntax used by the list endpoints.
  • Managing partners — the Backoffice how-to for brokers who issue, scope, and revoke partner credentials (an operator task, not a partner task).
  • Examples — end-to-end request and response walkthroughs for every endpoint.
  • Reference — the interactive OpenAPI reference for every endpoint.

The endpoints

Method Path What it does
POST /token Exchange your username and password for a bearer token
POST /accounts/lead Create a lead account
POST /accounts/real Create a real, tradeable account
POST /accounts/registrationwithsso Create an account and return a single sign-on autologin URL
GET /accounts List accounts under the brand
GET /transactions List monetary transactions
GET /positions List open and closed positions

A valid phone is required on every account- and lead-creation method.