Current positions, consolidated across accounts and by account
const url = 'https://api.tovarifinancial.com/investments/positions';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://api.tovarifinancial.com/investments/positions \ --header 'Authorization: Bearer <token>'Read-only: it parses no X-Idempotency-Key. While the INVESTMENTS_PHASE1_ENABLED rollout flag is off the body is { enabled: false }. Otherwise: one consolidated row per security (keyed CUSIP, then ISIN, then ticker, then Plaid security id; options never consolidate), a single synthetic cash row, and one “not itemized” row per account whose institution does not itemize holdings — so the consolidated values always sum to totalValueCents. costBasisCents is null unless every constituent reports a basis.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The positions view, or { enabled: false } while the rollout flag is off
object
object
object
Calendar date, ‘YYYY-MM-DD’
Integer minor units (cents)
object
Integer minor units (cents)
Integer minor units (cents)
Integer minor units (cents)
Integer basis points (1940 = 19.40%)
Integer minor units (cents)
object
Exact decimal quantity, as a string — never a float
Integer minor units (cents)
Calendar date, ‘YYYY-MM-DD’
Integer minor units (cents)
Integer basis points (1940 = 19.40%)
Integer minor units (cents)
Integer minor units (cents)
Integer basis points (1940 = 19.40%)
object
Exact decimal quantity, as a string — never a float
Integer minor units (cents)
Integer minor units (cents)
object
Integer minor units (cents)
Integer minor units (cents)
object
Exact decimal quantity, as a string — never a float
Integer minor units (cents)
Calendar date, ‘YYYY-MM-DD’
Integer minor units (cents)
Integer basis points (1940 = 19.40%)
Integer minor units (cents)
Integer minor units (cents)
Integer basis points (1940 = 19.40%)
object
Exact decimal quantity, as a string — never a float
Integer minor units (cents)
Integer minor units (cents)
Example
{ "data": { "enabled": false }}Missing, invalid, or expired bearer token
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Authenticated, but the tenant gate refuses the request until the caller resolves a precondition. errorCode is one of EMAIL_NOT_VERIFIED, POLICY_ACCEPTANCE_REQUIRED, or SUBSCRIPTION_REQUIRED, evaluated in exactly that order (contract term CCR-1: email verification first, then policy acceptance, then subscription — so a subscriber who has merely not re-accepted the current policies always sees POLICY_ACCEPTANCE_REQUIRED). A POLICY_ACCEPTANCE_REQUIRED body additionally carries details.outstanding (the policy versions still to accept) and details.firstAcceptance. The SUBSCRIPTION_REQUIRED arm is INERT unless the server-side BILLING_ENABLED flag is exactly the string true; while it is off, only the first two codes are reachable. Not retryable as sent — resolve the named condition, then resend. This operation is ALSO capability-fenced: after the three gate codes, an org whose plan does not include this feature is refused with errorCode CAPABILITY_REQUIRED and no details. The fence has its OWN switch and is unreachable while CAPABILITY_FENCE_ENABLED is not exactly true — that switch is independent of BILLING_ENABLED, so this code is reachable with the subscription paywall off. The errorCode enum on this operation’s response schema is the complete, machine-readable list.
object
Which condition refused the request, evaluated in this order (CCR-1). SUBSCRIPTION_REQUIRED is unreachable while BILLING_ENABLED is not exactly true; CAPABILITY_REQUIRED is unreachable while CAPABILITY_FENCE_ENABLED is not exactly true. The two switches are independent, so CAPABILITY_REQUIRED is reachable with the subscription paywall off. CAPABILITY_REQUIRED carries no details.
object
Active policy versions the user has not yet accepted.
object
True when the user has accepted no policy before — the client renders the new-signup screen rather than the re-acceptance one.
Example
{ "errorCode": "EMAIL_NOT_VERIFIED"}Internal error (no internal detail leaked)
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}Service temporarily unavailable — errorCode is SERVICE_UNAVAILABLE. A TRANSIENT, RETRYABLE condition rather than a defect in the request: a query that exceeded its time budget, a lost or refused database connection, a saturated connection pool, or an outage at an upstream provider the request depends on (the authentication provider, or the bank data provider on a bank-connection operation). The identical request may succeed on retry — back off briefly and, on a write, resend the same X-Idempotency-Key where the operation accepts one.
object
Machine-readable error code (AUTH_ERROR_CODES).
Optional field-level validation errors, keyed by field name.
object
Example
{ "errorCode": "INVALID_EMAIL_FORMAT"}