Schwab API
19 endpoints in this group.
GET /api/schwab/account-activity
Schwab Account Activity
Persisted account activity for Portfolio widgets.
Reads the streamer-backed schwab_activity_events table plus stored
schwab_transactions so the feed still works after market close and for
after-hours events, when the websocket may be quiet or disconnected.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
days | query | integer | optional | |
limit | query | integer | optional |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/accounts
Schwab Accounts
Return linked account numbers (display only — not the encrypted hashes).
Responses
| Code | Description |
|---|---|
200 | Successful Response |
GET /api/schwab/auth-url
Schwab Auth Url
Return the Schwab OAuth authorisation URL and CSRF state nonce for the connect flow.
Responses
| Code | Description |
|---|---|
200 | Successful Response |
GET /api/schwab/balance
Schwab Balance
Return account balance / margin data from Schwab (currentBalances + projectedBalances).
Responses
| Code | Description |
|---|---|
200 | Successful Response |
POST /api/schwab/connect
Schwab Connect
Exchange a one-time Schwab authorization code for tokens.
The auth code is obtained by redirecting the user to the auth_url
and capturing the code query parameter on the callback URL.
Pentest C4: this endpoint REQUIRES the state returned from
/auth-url. Without it (or with a mismatched/expired state) the
request is rejected — otherwise an attacker can CSRF-bind their
own Schwab account to the victim's BlitzPulse tenant.
Responses
| Code | Description |
|---|---|
200 | Successful Response |
POST /api/schwab/disconnect
Schwab Disconnect
Remove stored Schwab tokens.
Responses
| Code | Description |
|---|---|
200 | Successful Response |
GET /api/schwab/instrument
Schwab Instrument
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
symbol | query | string | required | Ticker symbol or CUSIP |
projection | query | string | optional |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/market-hours
Schwab Market Hours
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
markets | query | string | optional | |
date | query | — | optional | YYYY-MM-DD (defaults to today) |
persist | query | boolean | optional |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/movers
Schwab Movers
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
index | query | string | optional | Index: $SPX |
sort | query | string | optional | |
frequency | query | integer | optional | 0=all |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/open-orders
Schwab Open Orders
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
account_hash | query | — | optional | hashValue from /accounts. Omit for all linked accounts. |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/option-chain
Schwab Option Chain
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
symbol | query | string | required | Underlying ticker |
contract_type | query | string | optional | ALL |
strike_count | query | — | optional | |
strategy | query | string | optional | |
from_date | query | — | optional | YYYY-MM-DD |
to_date | query | — | optional | YYYY-MM-DD |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/positions
Schwab Positions
Fetch current positions from the Schwab broker API.
Wraps the fetch in sync_orchestrator.sync_attempt (Phase C )
so each user-initiated read writes a row to broker_sync_log. The
sync_kind is "manual" — this is a foreground request, not a
scheduled background sync.
Responses
| Code | Description |
|---|---|
200 | Successful Response |
GET /api/schwab/price-history
Schwab Price History
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
symbol | query | string | required | Ticker symbol |
period_type | query | string | optional | |
period | query | integer | optional | |
frequency_type | query | string | optional | |
frequency | query | integer | optional | |
need_extended_hours | query | boolean | optional |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/purchasing-power
Schwab Purchasing Power
Aggregate buying power across all Schwab accounts for the Funds widget.
BP-016 (was BP-005 regression): widget called this endpoint and got 404
because only /balance existed. This is a thin summation over /balance
that degrades gracefully on Schwab API failure instead of 502-ing.
Returns zeros with degraded=true on failure so the widget can still render.
Responses
| Code | Description |
|---|---|
200 | Successful Response |
GET /api/schwab/quotes
Schwab Quotes
Real-time quotes from Schwab Market Data API. Falls back to yfinance (15-min delayed) if Schwab API is unavailable.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
symbols | query | string | required | Comma-separated ticker symbols, e.g. AAPL,MSFT |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
POST /api/schwab/refresh
Schwab Refresh
Force-refresh the Schwab access token using the stored refresh token.
Responses
| Code | Description |
|---|---|
200 | Successful Response |
GET /api/schwab/status
Schwab Status
Return whether Schwab is connected and when it was last synced.
Responses
| Code | Description |
|---|---|
200 | Successful Response |
GET /api/schwab/transactions
Schwab Transactions
Fetch TRADE transactions for a full tax year. account_hash must be the encrypted hashValue, NOT the plain account number.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
account_hash | query | string | required | Encrypted account hashValue from /accounts |
year | query | string | required | Tax year, e.g. 2025 |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |
GET /api/schwab/transactions-auto
Schwab Transactions Auto
Fetch transactions for ALL linked Schwab accounts automatically. Resolves account hashes internally — no account_hash param needed. Flattens each transaction's transferItems into individual rows.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
year | query | string | required | Tax year, e.g. 2025 |
types | query | string | optional | Comma-separated transaction types, e.g. TRADE,DIVIDEND |
Responses
| Code | Description |
|---|---|
200 | Successful Response |
422 | Validation Error |