Export the filtered register as an .xlsx workbook
const url = 'https://api.tovarifinancial.com/transactions/export?accountId=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&sort=asc&status=all&uncategorized=1&transferState=matched';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.tovarifinancial.com/transactions/export?accountId=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&sort=asc&status=all&uncategorized=1&transferState=matched' \ --header 'Authorization: Bearer <token>'Serializes the register to an Excel workbook. It takes the same filters as GET /transactions, parsed by the same code, so the workbook holds exactly the rows the register shows. It exports ONE account: accountIds is refused with 400 (fieldErrors.accountIds), the all token included, with or without accountId. There is no cursor or limit: the export is the whole filtered set, truncated at the server’s row cap (the workbook says so when it is). The request MUST send Accept: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet. API Gateway matches that header against the API’s binary media types to decide whether to base64-decode the body. Without it the client receives base64 text instead of the file. This is a read: it accepts no X-Idempotency-Key, and every successful call is recorded in the household’s audit trail as a data export.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”Account id
Calendar date, ‘YYYY-MM-DD’
Start date ‘YYYY-MM-DD’. A malformed value is 400. With accountIds the server raises it to the lookback floor (lookbackFrom on the response) when it is earlier or absent; it can never widen it.
Calendar date, ‘YYYY-MM-DD’
End date ‘YYYY-MM-DD’. A malformed value is 400.
Sort direction by transaction date. Anything other than asc sorts descending.
Filter by settlement status. uncleared is manually-entered rows not yet cleared. pending is the register’s Pending section: rows Plaid reports as pending. unsettled is both together (uncleared and pending). all, absent, or an unrecognised value applies no narrowing and is never a 400.
Search over the bank description, payee name and memo, and the notes on a split transaction’s lines (a split row appears once however many of its lines match). When the term contains a digit it ALSO matches the amount, sign-agnostically, after $, ,, whitespace, - and − (U+2212) are stripped — so −$1,234.56, -1234.56 and 1,234.56 all find a ±$1,234.56 row. An over-long term is clamped, never rejected.
1 or true returns uncategorized rows only. Any other value applies no narrowing and is never a 400.
Narrow to rows in one transfer state: matched, settled, or needs_review (derived, never stored). An unrecognised value applies no narrowing and is never a 400.
Narrow to rows entered by one household member (their user id). A value that is not a uuid applies no narrowing and is never a 400.
Responses
Section titled “Responses”The workbook file.
Headers
Section titled “Headers”attachment; filename="…" — the suggested .xlsx file name. Exposed to browser code through Access-Control-Expose-Headers.
Validation failed — see errorCode / fieldErrors. A missing or malformed accountId, a malformed from/to, accountIds sent at all (fieldErrors.accountIds — the export supports a single account), or fieldErrors.dateRange when the workbook would be too large (narrow the range).
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Missing, invalid, or expired bearer token
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Authenticated, but the tenant gate refuses the request until the caller resolves a precondition. errorCode is one of EMAIL_NOT_VERIFIED, POLICY_ACCEPTANCE_REQUIRED, or SUBSCRIPTION_REQUIRED, evaluated in exactly that order (contract term CCR-1: email verification first, then policy acceptance, then subscription — so a subscriber who has merely not re-accepted the current policies always sees POLICY_ACCEPTANCE_REQUIRED). A POLICY_ACCEPTANCE_REQUIRED body additionally carries details.outstanding (the policy versions still to accept) and details.firstAcceptance. The SUBSCRIPTION_REQUIRED arm is INERT unless the server-side BILLING_ENABLED flag is exactly the string true; while it is off, only the first two codes are reachable. Not retryable as sent — resolve the named condition, then resend.
object
Which precondition refused the request. Evaluated in this order (CCR-1); SUBSCRIPTION_REQUIRED is unreachable while BILLING_ENABLED is not exactly true.
object
Active policy versions the user has not yet accepted.
object
True when the user has accepted no policy before — the client renders the new-signup screen rather than the re-acceptance one.
Example
{ "errorCode": "EMAIL_NOT_VERIFIED"}Resource not found or not owned by the caller org
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Internal error (no internal detail leaked)
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Service temporarily unavailable — errorCode is SERVICE_UNAVAILABLE. A TRANSIENT, RETRYABLE condition rather than a defect in the request: a query that exceeded its time budget, a lost or refused database connection, a saturated connection pool, or an outage at an upstream provider the request depends on (the authentication provider, or the bank data provider on a bank-connection operation). The identical request may succeed on retry — back off briefly and, on a write, resend the same X-Idempotency-Key where the operation accepts one.
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}