API reference
The Masttro REST API is read-only for the capabilities documented here. Every data endpoint is a GET scoped to a client. Selected REST capabilities are also available through the Masttro MCP Server. The MCP tool catalog is maintained separately and may be narrower than the REST API.
Base URL
Send Authorization: Bearer <token> on every request except POST /Auth/Token. See Authentication.
Endpoints
| Endpoint | Description | Core license |
|---|---|---|
POST /Auth/Token | Issue a bearer token | Yes |
GET /Tenants | Tenants you can access | Yes |
GET /Clients | Clients you can access | Yes |
GET /Holdings/{id} | Month-end positions | Yes |
GET /Transactions/{id} | Transactions for a period | Yes |
GET /Transactions/log/{id} | Transactions by posting date, including deletions | Yes |
GET /Performance/{id} | Performance by asset and account | No |
GET /Performance/Grouped/{id} | IRR, TWR or XIRR by grouping | No |
GET /cef/{id} | Closed-end fund metrics | No |
GET /TaxLot/UnrealizedGL/{id} | Unrealized gains and losses by lot | No |
GET /TaxLot/RealizedGL/{id} | Realized gains and losses by lot | No |
GET /GWM/{id} | Global Wealth Map nodes | No |
GET /DataFeedUpdates/{id} | Last position date per account | No |
GET /PublishedReports/{id} | Reports published to the client portal | No |
GET /Documents/{documentId} | Download a document as base64 | No |
GET /DAI/Valuation/{id} | Document AI valuation extractions | No |
GET /DAI/CashFlow/{id} | Document AI cash-flow extractions | No |
Conventions
- Paths. Use the casing shown above. Query parameter names are case-insensitive.
- Client id.
{id}is the numericidfrom/Clients.0means all clients on most endpoints. See Core concepts. - Tenant. Every
GETendpoint accepts an optionaltenantIdquery parameter from/Tenants. Without it, requests use your user's main tenant. See Core concepts. - Dates.
yearMonthisYYYYMM. Day-level dates areYYYYMMDD. - Responses. JSON arrays of flat objects with camelCase fields. Empty results may be the JSON string
"[]". - Errors. See Errors for every status and message.
A machine-readable OpenAPI description is served alongside the API at {{BASE_URL}}/swagger/v1/swagger.json.