All endpoints are versioned under /api/v1 on https://api.openagent.to, return the standard envelope, and — apart from /health — require authentication.

​
Investors

Investor records and their holdings. GET /investors · GET /investors/{id} · GET /investors/{id}/securities

​
Securities

The security master. GET /securities · GET /securities/{id}

​
Issuers

The issuers behind each security. GET /issuers · GET /issuers/{id}

​
Transactions

Six read endpoints over the same underlying activity. /transactions, /registrar-journal and /transfers return an identical row shape, so one parser serves all three. GET /transactions · GET /transactions/holders · GET /transactions/ledger · GET /transactions/transfers · GET /transactions/registrar-journal · GET /transactions/item-classification
These are aggregations, so rows have no _id — key on uuid. Field names are flattened (fromAddress, not metadata.fromAddress).

​
Reports

Compliance reporting drawn from the registry. GET /reports/control-book · GET /reports/mshf · GET /reports/turnaround · GET /reports/turnaround/monthly

​
Apps and API keys

Provisioning for server-to-server integrations. An apiSecret is returned only once, by the endpoint that creates the key. GET|POST /admin/apps · GET|DELETE /admin/apps/{id} · GET|POST /admin/apps/{appId}/api-keys · PATCH /admin/api-keys/{keyId}/disable · POST /api-keys/validate

​
Auth

POST /auth/login · POST /auth/logout · POST /auth/refresh-token · GET /auth/me

​
Webhook

POST /webhook/sync — signed with an issuer API key. See Webhooks.

​
Health

GET /health — unauthenticated liveness check.