curl --request POST \
--url https://allocait.app/api/v1/validate \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"portfolio_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"allocations": {
"ALFA": 38,
"BRAV": 19,
"ECHO": 27,
"GOLF": 16
},
"scenario_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_classes": {
"GOLF": "Commodities"
}
}
'import requests
url = "https://allocait.app/api/v1/validate"
payload = {
"portfolio_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"allocations": {
"ALFA": 38,
"BRAV": 19,
"ECHO": 27,
"GOLF": 16
},
"scenario_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_classes": { "GOLF": "Commodities" }
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
portfolio_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
allocations: {ALFA: 38, BRAV: 19, ECHO: 27, GOLF: 16},
scenario_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
asset_classes: {GOLF: 'Commodities'}
})
};
fetch('https://allocait.app/api/v1/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://allocait.app/api/v1/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'portfolio_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'allocations' => [
'ALFA' => 38,
'BRAV' => 19,
'ECHO' => 27,
'GOLF' => 16
],
'scenario_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'asset_classes' => [
'GOLF' => 'Commodities'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://allocait.app/api/v1/validate"
payload := strings.NewReader("{\n \"portfolio_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"allocations\": {\n \"ALFA\": 38,\n \"BRAV\": 19,\n \"ECHO\": 27,\n \"GOLF\": 16\n },\n \"scenario_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"asset_classes\": {\n \"GOLF\": \"Commodities\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://allocait.app/api/v1/validate")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"portfolio_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"allocations\": {\n \"ALFA\": 38,\n \"BRAV\": 19,\n \"ECHO\": 27,\n \"GOLF\": 16\n },\n \"scenario_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"asset_classes\": {\n \"GOLF\": \"Commodities\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://allocait.app/api/v1/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"portfolio_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"allocations\": {\n \"ALFA\": 38,\n \"BRAV\": 19,\n \"ECHO\": 27,\n \"GOLF\": 16\n },\n \"scenario_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"asset_classes\": {\n \"GOLF\": \"Commodities\"\n }\n}"
response = http.request(request)
puts response.read_body{
"portfolio_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scenario_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"sum_pct": 123,
"sum_ok": true,
"unknown_symbols": [
"<string>"
],
"violation_count": 123,
"violations": [
{
"asset_class_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_class": "<string>",
"proposed_pct": 123,
"min_pct": 123,
"max_pct": 123,
"status": "BELOW_MIN"
}
],
"size_violation_count": 123,
"size_violations": [
{
"symbol": "<string>",
"asset_class_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_class": "<string>",
"side": "long",
"proposed_pct": 123,
"size_min_pct": 123,
"size_max_pct": 123,
"status": "BELOW_MIN"
}
],
"is_valid": true
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Internal error",
"error_code": "INTERNAL_ERROR",
"request_id": "5b1e7c52-3f4a-4d0e-9a55-2d5cbe6f0a11"
}Pre-flight check of a proposed allocation plan
Given a proposed {symbol: target_pct} map, returns whether each
asset-class rollup satisfies its allocation band and each proposed
holding satisfies its class’s position size range.
Also reports sum_ok (allocations must sum to 100) and
unknown_symbols (symbols not held and not given a class).
To check an exit, propose 0 for the symbol. To check a first buy,
name its class in asset_classes: the symbol is then rolled into
that class’s band and judged against its size range like a held
one (ADR-067).
A percentage can be negative or above 100, within plus or minus
1,000,000. A negative entry is a short: it subtracts from its
class, whose total is floored at 0 for the band, and it is judged by
its size without the minus sign against the class’s short size
range (ADR-144). A long can pass 100 when shorts fund it. Two
entries are refused with a 400: CASH (or $CASH) below 0,
because cash is never held below zero, and any entry beyond plus or
minus 1,000,000. This call does not check that
the portfolio can record a short. Recording one needs allow_shorts
on and never an Options holding, so a plan that is valid here can
still be refused when it is applied.
Every class with a band is judged, including one the plan leaves
empty: it sits at 0%, the verdict /compliance/check gives once the
plan is applied (ADR-069). So exiting a class’s last holding breaks
a band with a minimum above 0, and a first buy short of the minimum
is still BELOW_MIN, though closer than 0.
Use this before committing to a rebalance plan: it is the agent’s self-verification tool. Nothing is written.
curl --request POST \
--url https://allocait.app/api/v1/validate \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"portfolio_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"allocations": {
"ALFA": 38,
"BRAV": 19,
"ECHO": 27,
"GOLF": 16
},
"scenario_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_classes": {
"GOLF": "Commodities"
}
}
'import requests
url = "https://allocait.app/api/v1/validate"
payload = {
"portfolio_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"allocations": {
"ALFA": 38,
"BRAV": 19,
"ECHO": 27,
"GOLF": 16
},
"scenario_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_classes": { "GOLF": "Commodities" }
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
portfolio_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
allocations: {ALFA: 38, BRAV: 19, ECHO: 27, GOLF: 16},
scenario_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
asset_classes: {GOLF: 'Commodities'}
})
};
fetch('https://allocait.app/api/v1/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://allocait.app/api/v1/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'portfolio_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'allocations' => [
'ALFA' => 38,
'BRAV' => 19,
'ECHO' => 27,
'GOLF' => 16
],
'scenario_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'asset_classes' => [
'GOLF' => 'Commodities'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://allocait.app/api/v1/validate"
payload := strings.NewReader("{\n \"portfolio_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"allocations\": {\n \"ALFA\": 38,\n \"BRAV\": 19,\n \"ECHO\": 27,\n \"GOLF\": 16\n },\n \"scenario_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"asset_classes\": {\n \"GOLF\": \"Commodities\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://allocait.app/api/v1/validate")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"portfolio_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"allocations\": {\n \"ALFA\": 38,\n \"BRAV\": 19,\n \"ECHO\": 27,\n \"GOLF\": 16\n },\n \"scenario_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"asset_classes\": {\n \"GOLF\": \"Commodities\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://allocait.app/api/v1/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"portfolio_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"allocations\": {\n \"ALFA\": 38,\n \"BRAV\": 19,\n \"ECHO\": 27,\n \"GOLF\": 16\n },\n \"scenario_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"asset_classes\": {\n \"GOLF\": \"Commodities\"\n }\n}"
response = http.request(request)
puts response.read_body{
"portfolio_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scenario_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"sum_pct": 123,
"sum_ok": true,
"unknown_symbols": [
"<string>"
],
"violation_count": 123,
"violations": [
{
"asset_class_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_class": "<string>",
"proposed_pct": 123,
"min_pct": 123,
"max_pct": 123,
"status": "BELOW_MIN"
}
],
"size_violation_count": 123,
"size_violations": [
{
"symbol": "<string>",
"asset_class_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"asset_class": "<string>",
"side": "long",
"proposed_pct": 123,
"size_min_pct": 123,
"size_max_pct": 123,
"status": "BELOW_MIN"
}
],
"is_valid": true
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Internal error",
"error_code": "INTERNAL_ERROR",
"request_id": "5b1e7c52-3f4a-4d0e-9a55-2d5cbe6f0a11"
}Authorizations
Raw API key shown once when created in the Allocait app (Settings > API keys). Send it verbatim in this header; the server stores and compares only its SHA-256 hash. Allocait generates every key: alc_ followed by 64 lowercase hex characters. Keys issued before 2026-10-10 are 64 hex characters with no prefix and keep working. A key may carry an expiry (90 days or 1 year, or never). A malformed, unknown, revoked or expired key gets 401 with no further detail, and a malformed one is refused before any lookup. Keys cannot be created through this API.
Body
Symbol-to-percentage map. Should sum to 100. An entry can
be negative (a short) or above 100, between -1000000 and
1000000. A CASH or $CASH entry cannot be negative
(CASH cannot be negative. Cash is never held below zero.), and an entry beyond the bound is refused
({symbol} must be between -1000000 and 1000000.); each
is a 400 INVALID_INPUT with the field name in front
(allocations.CASH ...). At most 500
keys; a portfolio holds far fewer real positions than
that; a larger map is rejected with 400 rather than
processed and echoed back in unknown_symbols.
Show child attributes
Show child attributes
{
"ALFA": 38,
"BRAV": 19,
"ECHO": 27,
"GOLF": 16
}
Default is the portfolio's active scenario, and only that (ADR-187, ADR-232).
Optional symbol-to-asset-class map. Files a symbol the
portfolio does not hold yet under a class, or a held
symbol under a different one (the class
positions/apply would write). Each value is an asset
class name, a rules text alias or an id, resolved your own
class first; one that matches nothing is a 404 with
error_code NOT_FOUND and the names in valid_values.
Symbols are read as positions stores them: upper case,
and CASH is the cash row.
Show child attributes
Show child attributes
{ "GOLF": "Commodities" }
Response
Validation result
Pre-flight check of a proposed allocation plan.
is_valid is true only when sum_ok AND violation_count=0 AND
size_violation_count=0 AND unknown_symbols is empty.
Sum of proposed allocation percentages; should be ~100
True when sum_pct is within 0.01 of 100
Symbols in the proposal that this portfolio does not hold and
that asset_classes does not file under a class. No rule judges
them.
One entry per asset class whose proposed total is outside its allocation band. Every class with a band is judged; a class with nothing proposed above 0 sits at 0% (ADR-069).
Show child attributes
Show child attributes
One entry per proposed non-cash symbol outside its class's range for the side it is on. A positive entry is a long, judged against the position size range; a negative entry is a short, judged by its size without the minus sign against the short size range (ADR-144). A class with no range for that side sets no limit. A symbol proposed at 0 is an exit (or no buy) and is never judged here; it still counts as 0 toward its class band. A short subtracts from its class (ADR-153).
Show child attributes
Show child attributes
Overall verdict. Safe to proceed if true