curl --request GET \
--url https://allocait.app/api/v1/position-rules \
--header 'x-api-key: <api-key>'import requests
url = "https://allocait.app/api/v1/position-rules"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://allocait.app/api/v1/position-rules', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://allocait.app/api/v1/position-rules",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://allocait.app/api/v1/position-rules"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://allocait.app/api/v1/position-rules")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://allocait.app/api/v1/position-rules")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"position_rule_id": "4d1b5c1e-6f2a-4c3b-9d8e-1a2b3c4d5e6f",
"scenario_id": "7e8f9a0b-1c2d-4e3f-8a9b-0c1d2e3f4a5b",
"asset_class_id": "0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
"asset_class": "Equities",
"target_allocation_pct": 38,
"min_position_pct": 31,
"max_position_pct": 47,
"size_min_pct": 3,
"size_max_pct": 9,
"short_size_min_pct": 1,
"short_size_max_pct": 5,
"band_min_pct": 31,
"band_max_pct": 47,
"target_pct": 38,
"created_at": "2026-09-12T14:00:00Z",
"updated_at": "2026-09-12T14:00:00Z"
}
],
"has_more": true
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Internal error",
"error_code": "INTERNAL_ERROR",
"request_id": "5b1e7c52-3f4a-4d0e-9a55-2d5cbe6f0a11"
}List position rules (allocation band and position size per asset class)
One row per asset class per scenario. Each row carries the
allocation band on the asset class total (min_position_pct /
max_position_pct, optional target_allocation_pct) that
/compliance/check and /rebalance/preview evaluate against, and
an optional position size range (size_min_pct / size_max_pct)
for one holding in that class, which /compliance/check and
/validate check (size_violations) and /positions/size uses, and
an optional short size range (short_size_min_pct /
short_size_max_pct) for one short in that class, which the same
checks use for a short. Useful for an
agent that wants to explain why a position was flagged, not just
that it was.
curl --request GET \
--url https://allocait.app/api/v1/position-rules \
--header 'x-api-key: <api-key>'import requests
url = "https://allocait.app/api/v1/position-rules"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://allocait.app/api/v1/position-rules', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://allocait.app/api/v1/position-rules",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://allocait.app/api/v1/position-rules"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://allocait.app/api/v1/position-rules")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://allocait.app/api/v1/position-rules")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"position_rule_id": "4d1b5c1e-6f2a-4c3b-9d8e-1a2b3c4d5e6f",
"scenario_id": "7e8f9a0b-1c2d-4e3f-8a9b-0c1d2e3f4a5b",
"asset_class_id": "0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
"asset_class": "Equities",
"target_allocation_pct": 38,
"min_position_pct": 31,
"max_position_pct": 47,
"size_min_pct": 3,
"size_max_pct": 9,
"short_size_min_pct": 1,
"short_size_max_pct": 5,
"band_min_pct": 31,
"band_max_pct": 47,
"target_pct": 38,
"created_at": "2026-09-12T14:00:00Z",
"updated_at": "2026-09-12T14:00:00Z"
}
],
"has_more": true
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Portfolio not found or access denied",
"error_code": "NOT_FOUND"
}{
"error": "Internal error",
"error_code": "INTERNAL_ERROR",
"request_id": "5b1e7c52-3f4a-4d0e-9a55-2d5cbe6f0a11"
}Authorizations
Raw API key shown once when created in the Allocait app (Settings > API keys). Send it verbatim in this header; the server stores and compares only its SHA-256 hash. Allocait generates every key: alc_ followed by 64 lowercase hex characters. Keys issued before 2026-10-10 are 64 hex characters with no prefix and keep working. A key may carry an expiry (90 days or 1 year, or never). A malformed, unknown, revoked or expired key gets 401 with no further detail, and a malformed one is refused before any lookup. Keys cannot be created through this API.
Query Parameters
Max rows to return. Default 100, hard max 500 (enforced server-side).
1 <= x <= 500Row offset to start from. Default 0. Pass the previous cursor (or 0) plus limit to get the next page.
x >= 0Omit to list rules across every scenario