curl --request GET \
--url https://api.openagent.to/api/v1/securities \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.openagent.to/api/v1/securities"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.openagent.to/api/v1/securities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openagent.to/api/v1/securities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.openagent.to/api/v1/securities"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.openagent.to/api/v1/securities")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openagent.to/api/v1/securities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": {
"docs": [
{
"_id": "ccc000000000000000000001",
"authorizationSource": "board_resolution",
"authorizedShares": "1000000",
"canceledShares": {
"$numberDecimal": "0"
},
"chain": "ethereum-sepolia",
"cusip": "CUSIP-SEED-001",
"ercStandard": "ERC-20",
"externalId": "ext-seed-security",
"issuedShares": {
"$numberDecimal": "45000"
},
"issuerId": "aaa000000000000000000001",
"issuerName": "Acme Tokenization LLC",
"name": "Seed Preferred Equity",
"onChainTotalSupply": {
"$numberDecimal": "45000"
},
"outstandingShares": {
"$numberDecimal": "45000"
},
"parValue": {
"$numberDecimal": "1.25"
},
"reconciliationStatus": "matched",
"reservedShares": {
"$numberDecimal": "10000"
},
"securityType": "equity",
"status": "active",
"ticker": "SEEDTICK",
"tokenAddress": "0x000000000000000000000000000000000000abcd",
"treasuryShares": {
"$numberDecimal": "0"
},
"uuid": "1ebab7be-bfec-4888-85ef-dfddb135b922"
}
],
"hasNextPage": true,
"hasPrevPage": true,
"limit": 0,
"nextPage": 0,
"page": 0,
"pagingCounter": 0,
"prevPage": 0,
"totalDocs": 0,
"totalPages": 0
},
"message": "Success",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 200,
"success": true
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}List securities
Returns a page of securities, each with the issuer’s issuerName resolved. Scoped to the caller’s issuer by a pipeline $match applied before pagination, so the counts are scoped with the page. There is no filter parameter beyond pagination. Every share figure is BSON extended JSON: parValue, issuedShares, outstandingShares, treasuryShares, canceledShares, reservedShares and onChainTotalSupply all arrive as {"$numberDecimal": "…"}. Read the inner string and parse it with a decimal library. authorizedShares is the exception — a plain string. The /transactions endpoints return plain decimal strings and /reports returns JSON numbers, so do not share a parser across them. Rows come from an aggregation, so a field the document never stored is absent rather than null; the detail endpoint materializes those same fields. Defaults: page 1, 20 per page, newest first. search matches uuid, externalId, name, cusip, isin, ticker, tokenAddress and chain. Requires the security:read permission, held by every staff role.
curl --request GET \
--url https://api.openagent.to/api/v1/securities \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.openagent.to/api/v1/securities"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.openagent.to/api/v1/securities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openagent.to/api/v1/securities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.openagent.to/api/v1/securities"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.openagent.to/api/v1/securities")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openagent.to/api/v1/securities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": {
"docs": [
{
"_id": "ccc000000000000000000001",
"authorizationSource": "board_resolution",
"authorizedShares": "1000000",
"canceledShares": {
"$numberDecimal": "0"
},
"chain": "ethereum-sepolia",
"cusip": "CUSIP-SEED-001",
"ercStandard": "ERC-20",
"externalId": "ext-seed-security",
"issuedShares": {
"$numberDecimal": "45000"
},
"issuerId": "aaa000000000000000000001",
"issuerName": "Acme Tokenization LLC",
"name": "Seed Preferred Equity",
"onChainTotalSupply": {
"$numberDecimal": "45000"
},
"outstandingShares": {
"$numberDecimal": "45000"
},
"parValue": {
"$numberDecimal": "1.25"
},
"reconciliationStatus": "matched",
"reservedShares": {
"$numberDecimal": "10000"
},
"securityType": "equity",
"status": "active",
"ticker": "SEEDTICK",
"tokenAddress": "0x000000000000000000000000000000000000abcd",
"treasuryShares": {
"$numberDecimal": "0"
},
"uuid": "1ebab7be-bfec-4888-85ef-dfddb135b922"
}
],
"hasNextPage": true,
"hasPrevPage": true,
"limit": 0,
"nextPage": 0,
"page": 0,
"pagingCounter": 0,
"prevPage": 0,
"totalDocs": 0,
"totalPages": 0
},
"message": "Success",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 200,
"success": true
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}{
"error": {
"code": "Validation error",
"details": [
{
"field": "email",
"message": "Invalid email format",
"allowedValues": [
"<string>"
]
}
]
},
"message": "Validation error",
"meta": {
"timestamp": "2026-09-01T09:15:32.104Z",
"requestId": "3f1c9d2e-6b7a-4f18-9c53-0a2b6d4e8f10"
},
"statusCode": 422,
"success": false
}Authorizations
Staff access token. Sent as Authorization: Bearer <token>, or — when that header is absent — read from the accessToken cookie, which is how the admin app authenticates. Tokens carry a tokenVersion; logout and password reset bump it, revoking every outstanding token for that account.
Query Parameters
1-based page number. Defaults to 1.
x <= 9007199254740991Records per page, 1-100. Defaults to 20.
x <= 100Field names separated by spaces (or commas, which are normalized to spaces), - prefix for descending. Defaults to -createdAt.
^-?[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*(?:[\s,]+-?[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)*$Case-insensitive substring matched against uuid, externalId, name, cusip, isin, ticker, tokenAddress, chain.
Comma-separated subset of uuid, externalId, name, cusip, isin, ticker, tokenAddress, chain to match search against. Names outside that list are ignored, and an empty intersection falls back to all of them.

