Skip to content

API Reference

Complete endpoint reference for the TransactAPI platform.

All API requests require authentication. Send your credentials in the Authorization: Bearer {clientID}:{apiKey} header; see Authorization Headers.

Some methods are billed

KYC/AML, accredited investor verification, Plaid bank linking, and ACH and credit card payments are billed in production. Sandbox calls are not billed. See the Fee Schedule.

Serverless endpoints are deprecated

The legacy serverless API host (tapi*.norcapsecurities.com) is deprecated. Use the v3 API on the primary host — https://api-sandboxdash.norcapsecurities.com/v3/… (sandbox) and https://api.norcapsecurities.com/v3/… (production). Note that the legacy serverless-only endpoints are not served on the v3 host — see Serverless APIs for those endpoints and their v3 replacements.

Endpoint Styles

TransactAPI has two styles of endpoint.

Method-style endpoints are the original design and still make up most of the API. The path names an operation, such as POST /v3/getTrade or PUT /v3/createParty. A 4xx or 5xx HTTP status means the call failed. Most errors come back as 404 whatever the cause, so read the statusCode in the response body for the specific reason. A 200 response does not prove success on its own. Confirm that statusCode is 101. Other codes are listed in Error Codes.

Resource-style endpoints were added from 2024 onward. The path names a resource, such as GET /v3/parties or GET /v3/custody/accounts/{id}/positions. They apply HTTP status codes consistently: 400 malformed request, 401 invalid credentials, 403 missing permission, 404 resource not found, 422 invalid request, and 500 server error. List endpoints support pagination, filtering, and sorting (see Working with List Endpoints). Responses also include statusCode and statusDesc.

Use a resource-style endpoint when one exists. Method-style endpoints remain supported. These list methods have resource-style replacements:

Method-style Resource-style
POST /v3/getAllAccounts GET /v3/accounts
POST /v3/getAllIssuers GET /v3/issuers
POST /v3/getAllLinks GET /v3/links
POST /v3/getAllOffers GET /v3/offerings
POST /v3/getAllParties GET /v3/parties
POST /v3/getAllTrades GET /v3/trades

Response fields can differ between the two versions of an endpoint, so check the reference entry before you switch.

Rate Limits

Limits apply per source IP address, across all clients and API keys that send requests from that address.

Scope Limit
All endpoints 300,000 requests per 5 minutes (about 1,000 requests per second)
Deprecated method-style list endpoints in the table above 10 requests per 10 minutes

A request over a limit is rejected with HTTP 429:

{"statusCode":"429","statusDesc":"Too many requests - reduce rate and retry later"}

Requests that receive a 429 count toward the IP address's rate limit. After a 429, lower the request rate and retry with exponential backoff, waiting 30 seconds, then 60, then 120. Requests are accepted again once the request count over the limit's time window drops below the limit, usually within 30 seconds of the drop. A rejected request is not processed, so it is safe to retry.

Resources

All Endpoints lists every endpoint on one page, grouped by topic.

Deprecated