Access & Authentication

Every request to the Addepar API must be authenticated. The API supports two authentication methods, and which one you use determines how your integration accesses data, how permissions are scoped, and how credentials are managed over time.

Choosing your authentication method

Decision rule: If your integration serves a single firm with a dedicated service account, use API Key authentication. If your integration serves multiple users, multiple firms, or is distributed as a product, use OAuth.

API Key authentication (Basic Auth)

How it works

Addepar uses HTTP Basic Authentication. You create an API key in Firm Administration, receive a key/secret pair, and include the pair (base64-encoded) in every request header.

Permission inheritance

The API key inherits the permissions of the user who created it. This is the critical design constraint: the key can access exactly what that user can access, nothing more.

If a request returns 403 Forbidden, the issue is in one of these three layers. If a request returns 404 Not Found for a resource that exists, the user behind the key likely lacks Portfolio Access to that specific entity.

Setup

1. Grant API Access to the user:

1. Navigate to Firm Administration > Users (under User Permissions).
2. Select the user who will own the API key.
3. Open the Permissions tab.
4. Set API Access to "Create, edit, and delete."

2. Create the API key:

1. Navigate to Firm Administration > Admin Tools > API Access Key.

2. Click the + button in the table header.
3. Enter a description (use the integration name for traceability).
4. Click Create.

5. Record the key and secret immediately. The secret is displayed only once.

3. Determine your firm subdomain and firm ID:

• Your firm subdomain is in your Addepar login URL: https://{subdomain}.addepar.com
• Your firm ID can be found in the application URL path when signed in, or by using the API URL generator in the Analysis Tool (Export > Generate API URL > addepar_firm= value).

Request format

GET and DELETE requests:

curl -X GET "https://{firm}.addepar.com/api/v1/entities/1234" \
  -H "Authorization: Basic {base64(key_id:key_secret)}" \
  -H "Addepar-Firm: 1" \
  -H "Accept: application/vnd.api+json"

POST and PATCH requests (include Content-Type):

curl -X POST "https://{firm}.addepar.com/api/v1/entities" \
  -H "Authorization: Basic {base64(key_id:key_secret)}" \
  -H "Addepar-Firm: 1" \
  -H "Content-Type: application/vnd.api+json" \
  -H "Accept: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "entities",
      "attributes": {
        "currency_factor": "USD",
        "model_type": "PERSON_NODE",
        "original_name": "New entity"
      }
    }
  }'

Key management

📘

Related

• OAuth - Token-based authentication for multi-user and multi-firm applications
• Rate Limiting - Request budget shared across all credentials at a firm
• Response Codes - 401 vs 403 diagnostic and troubleshooting