Getting started

Upvest complies with the highest security standards both in communication with our customers and in the handling of any data. For this reason, we set the bar high when it comes to the technical structures for working with the Investments API.

In this tutorial, we will walk you through the necessary steps you need to take to set up access to the Investment API. After receiving the credentials from Upvest, you are all set to continue with the authentication process guide.

NOTE

This guide is valid for both the Sandbox and Live environments. If there are deviations in the implementation for Sandbox, we will explicitly point them out.

Step 1: Sign up for the Investment API

Start your Upvest journey by contacting us.

Sign up here

Next, our team of experts will reach out to you to check all technical and legal aspects. After completion, we will progress with granting you access to the Investment API.

Step 2: Share your data

To make sure you have the right access to the Investment API, we need to collect some basic information from you, such as for which environment (Sandbox or Live) or with which operating model (TOL or BYOL), etc. suits your needs.

For technical communication and urgent notifications about the state of our API, we require a fall-back email address from you. Other key contacts can be set up later (e.g., a technical contact or a contact for accounting).

We need the following information from you:

NOTE

The necessary information differs depending on the operating model and environment.

Operating model (TOL or BYOL)
Fall-back email address in case of failed webhook delivery
Public key component of your GPG key
Public key component of signing key pair
Cloud storage bucket credentials GPG encrypted using Upvest’s public GPG key. This is optional in the Sandbox environment.

Step 3: Prepare a secure API access

As a client, you need to exchange secrets with Upvest in order to access the Investment API and upload documents.

1. Share your public GPG key

In order to exchange the credentials securely, we ask you to provide us with a public GPG key so that Upvest's onboarding support team can encrypt the credentials and transfer them to you securely.

You will access the Investment API with credentials, consisting of client_id and a client_secret; this allows Upvest to recognise who is calling it. The client_secret is only used to create an access token which is used for further authentication.

2. Generate a key pair for signing HTTP calls

You can use ED25519 or ECDSA key pairs. We use HTTP signatures to ensure the call is actually coming from your client backend and has not been tampered with on the way. See key pair generation.

3. Collect the public key component of the key pair

After generating your key pair, collect the public key component. Together with other information you will need to share this with Upvest.

NOTE

Please note that you have to complete this process twice: for the Sandbox environment and as well for the Live environment. Secrets, signing keys, and document buckets should always be unique between the Sandbox and Live environment.

Step 4: Set up a cloud storage bucket

1. Set up a cloud storage bucket

To share documents securely, for example for user onboarding, we download them directly from a cloud bucket set up on your site. We currently support the following cloud storage providers:

Amazon AWS
Microsoft Azure
Google Cloud

To get progress with your integration work, we strongly recommend that you set up a download bucket on your site at an early stage.

NOTE

We offer you the possibility to use the default download bucket in the Sandbox environment. If you use our default bucket, you can skip document bucket setup. We got you covered to start your journey with some mocked data and you can integrate your documents bucket later.

2. Share your bucket credentials

For the secure exchange of bucket credentials, we use public-private GPG keys as for all other Upvest secret exchanges. For encryption, you can use Upvest's public GPG key and send the encrypted credentials to security@upvest.co.

To integrate your document bucket the following credentials are required:

Amazon AWS

{
  "bucket": "...",
  "region": "...",
  "access_key_id": "...",
  "secret_access_key": "...",
}

Microsoft Azure

{
  "query_sign": "..."
}

Google Cloud

{
  "bucket": "...",
  "json_key": "..."
}

The credentials will then be securely stored in Upvest’s secrets manager and you are all set to start uploading information securely via the Investment API.

3. Optional: Using the default download bucket

NOTE

The default download bucket is for the Sandbox environment only.

To access the Sandbox environment, we provide a quick start with some mocked data in a bucket managed on our side. The bucket is integrated into the Investment API by default and you are free to use the following files for the corresponding check calls:

NOTE

The links listed here are only to be used for API calls in the Sandbox environment.

Upvest public GPG key

Step 5 Optional: Install and set up a local HTTP signing proxy

Optionally, you can install and set up a local HTTP signing proxy to use tools such as Postman while testing and integrating the Investment API.

Installing the local HTTP signing proxy enables you to call the Investment API endpoints without having to implement signatures on your side. However, we recommend this only for testing in the Sandbox, not the Live environment.

Step 6: Accessing the Investment API

Congratulations! Now you are ready to access the Investment API and discover all the features.

Base URLs

Here you go, below you find the base URL of our servers:

Environment	Base URL
Sandbox	`https://sandbox.upvest.co`
Live	`https://api.upvest.co`

Go to the API references to find out more.

Was this page helpful?