Skip to main content
POST
Deposit or withdraw cash from a portfolio

Authorizations

x-api-key
string
header
required

Raw API key shown once when created in the Allocait app (Settings > API keys). Send it verbatim in this header; the server stores and compares only its SHA-256 hash. Allocait generates every key: alc_ followed by 64 lowercase hex characters. Keys issued before 2026-10-10 are 64 hex characters with no prefix and keep working. A key may carry an expiry (90 days or 1 year, or never). A malformed, unknown, revoked or expired key gets 401 with no further detail, and a malformed one is refused before any lookup. Keys cannot be created through this API.

Path Parameters

id
string<uuid>
required

portfolio_id

Body

application/json
direction
enum<string>
required
Available options:
DEPOSIT,
WITHDRAW
amount
number
required

Must be positive.

comment
string
idempotency_key
string

A unique token identifying this exact request. Reusing it with the same direction/amount/comment returns the original result rather than applying it again; reusing it with a different body is refused (409). Optional. An omitted key gets no deduplication.

Maximum string length: 200

Response

The movement was recorded

success
boolean
action_id
string<uuid>
cash_balance
number

The portfolio's cash balance after the movement.

idempotent_replay
boolean

Present and true when this response is the original result of an earlier call with the same idempotency_key, not a fresh application of the movement. Absent on a normal (non-replayed) call.