GET
Control book

Authorizations

Authorization
string
header
required

Staff access token. Sent as Authorization: Bearer <token>, or — when that header is absent — read from the accessToken cookie, which is how the admin app authenticates. Tokens carry a tokenVersion; logout and password reset bump it, revoking every outstanding token for that account.

Query Parameters

securityId
string

Narrow the report to one security. Omit for every security in scope.

Pattern: ^[a-f\d]{24}$
page
integer

1-based page number. Defaults to 1.

Required range: x <= 9007199254740991
limit
integer

Records per page, 1-100. Defaults to 20.

Required range: x <= 100
sort
string

Field names separated by spaces (or commas, which are normalized to spaces), - prefix for descending. Defaults to -createdAt.

Pattern: ^-?[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*(?:[\s,]+-?[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)*$

Case-insensitive substring matched against name, cusip, isin, ticker, tokenAddress, chain, issuer.legalName.

fields
string

Comma-separated subset of name, cusip, isin, ticker, tokenAddress, chain, issuer.legalName to match search against. Names outside that list are ignored, and an empty intersection falls back to all of them.

Response

A page of rows, or — when securityId is given — the single row unwrapped, which is null if nothing matched.

Standard success envelope. The endpoint payload is in data.

data
object
required
message
string
required
Example:

"Success"

meta
object
required
statusCode
integer
required
Example:

200

success
boolean
required
Example:

true