Working with Resource Endpoints¶
Alongside TransactAPI's original method-style endpoints (createParty, updateAccount, and similar), some resources also expose a resource-style pattern for single records: GET to fetch one record by ID, PATCH to update specific fields on it. This guide covers that pattern. For fetching multiple records, see Working with List Endpoints; for the difference between endpoint styles generally, see Endpoint Styles.
Request Pattern¶
Both require the Authorization header:
PATCH requests wrap the fields to change in an object keyed by the singular resource name, and should include only the fields you want to change — omitted fields are left as-is:
Responses¶
| Result | HTTP status | statusCode | Notes |
|---|---|---|---|
| Change applied | 200 | 101 | |
| Nothing to change | 304 | 101 | The request was well-formed and the resource exists, but every field sent already matched the stored value. The body still carries statusCode/statusDesc — it isn't empty just because the status is 304. |
| Malformed body or unknown field | 400 | 1400 | statusDesc names the offending field. |
| Scope not granted | 403 | 1403 | |
| Resource does not exist | 404 | 1404 |
See Error Codes for the full table.
Immutable Fields¶
Fields the API manages itself are silently ignored if included in a PATCH body — they are dropped, not rejected. This is different from an unknown field, which returns 1400.
For PATCH /v3/accounts/{accountId}, these fields cannot be set through PATCH (the resource ID also cannot be changed, though sending it in the body is not an error):
accountId, createdDate, updatedDate, accountstatus, accreditedStatus, accreditedInvestor, accreditedInvestorDate
Party resources do not currently support PATCH; use updateParty for full-row party updates.
Field Redaction by Scope¶
GET responses on parties and accounts (both the list and single-resource forms) redact fields based on the PII level granted to the calling API key, not just whether read access is granted at all. A caller with only base read access gets a response with most fields present as the literal string REDACTED.
Granted scopes come in four tiers, each including everything below it:
{resource}.read # base fields only
{resource}.read.pii_low # + pii_low fields
{resource}.read.pii_medium # + pii_medium fields
{resource}.read.pii_high # + pii_high fields — full access
The tables below enumerate every field currently returned by party and account. A field that isn't explicitly classified as base, pii_low, or pii_medium requires pii_high — that's the fallback, not an exception.
Party fields¶
| Tier | Fields |
|---|---|
| Base (always visible) | partyId, domicile, kycStatus, amlStatus, partystatus, createdDate, updatedDate |
pii_low | currentAnnIncome, avgAnnIncome, currentHouseholdIncome, avgHouseholdIncome, householdNetworth, primCity, primState, primZip, primCountry, empStatus, amlDate, documentKey, esignStatus |
pii_medium | firstName, middleInitial, lastName, primAddress1, primAddress2, emailAddress, emailAddress2, phone, phone2, occupation, associatedPerson, empName, empCountry, empAddress1, empAddress2, empCity, empState, empZip |
pii_high | socialSecurityNumber, dob, invest_to, tags, notes, field1, field2, field3 |
Account fields¶
| Tier | Fields |
|---|---|
| Base (always visible) | accountId, type, entityType, residentType, kycStatus, amlStatus, approvalStatus, accountstatus, createdDate, updatedDate |
pii_low | accountName, kycDate, amlDate, suitabilityScore, suitabilityDate, suitabilityApprover, accreditedStatus, accreditedInvestor, accreditedInvestorDate, 506cLimit, accountTotalLimit, singleInvestmentLimit, associatedAC, syndicate |
pii_medium | address1, address2, city, state, zip, country, phone, approvalPrincipal, approvalLastReview |
pii_high | socialSecurityNumber, taxID, tags, notes, field1, field2, field3 |
This scope can be assigned by system admins through the API or Transact Portal.
Reference¶
For the full field list, request/response examples, and query parameters for each endpoint, see: