List an Account's Grants

Returns the grants on an account the caller can reach.

GET/portfolio/accounts/{account_id}/grants

Authorization

UDX-Access-KeyAPI key · headerrequired

Opaque API key ID.

UDX-Access-TimestampAPI key · headerrequired

Unix time in milliseconds, within 30 seconds of server time.

UDX-Access-SignatureAPI key · headerrequired

Standard-base64 RSA-PSS/SHA-256 signature with a 32-byte salt.

AuthorizationBearer token (JWT) · headerrequired

Bearer token for an active signed-in UDX user.

Header parameters

UDX-Versionstring

Dated API version (YYYY-MM-DD).

min length 10 · max length 10

Path parameters

account_idEntityIdrequired

The public identifier of the account whose grants are managed.

min length 1

Query parameters

limitinteger

Maximum number of items to return in one page.

min 1 · max 100 · default: 10

pagestring

Opaque token identifying the requested page.

max length 512

sortstring

Field to sort grants by.

default: "created_at"

Allowed:created_at

orderstring

Sort direction. Applies to the default sort field when sort is omitted. Nulls sort last in both directions.

default: "desc"

Allowed:ascdesc

Responses

200One page of the account's grants.

grantsGrant[]required

One page of the account's grants.

max items 100

Show properties

Array of Grant

idEntityIdrequired

An exchange-assigned identifier. Treat it as an opaque, stable key with no internal structure.

min length 1

user_idstringrequired

The user this grant authorizes.

min length 1

statusstringrequired

Readiness of the granted access.

Allowed:pendingactivefailed

created_atstring<date-time>required

When access was granted.

max length 40

next_page_urlNextPageURL | nullrequired

Root-relative URL for the next page. Null when there are no more items.

max length 4096 · matches ^/[^/\s#][^\s#]*$

400The request doesn't conform to this spec.

typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048

titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40

statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500

instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100

401No valid credential was provided.

typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048

titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40

statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500

instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100

403The credential lacks the grants:manage scope or is restricted to one account.

typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048

titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40

statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500

instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100

404The account doesn't exist or the caller holds no grant on it.

typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048

titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40

statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500

instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100

429The member rate limit was exceeded.

typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048

titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40

statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500

instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100

500Something went wrong on UDX's side.

typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048

titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40

statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500

instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100

503Request admission is unavailable.

typestring<uri-reference>required

A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.

max length 2048

titlestringrequired

A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.

max length 40

statusintegerrequired

The HTTP status code, repeated from the response itself.

detailstring

A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.

max length 500

instancestring<uri-reference>

An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.

max length 100

Request

curl -X GET "https://api.underdogexchange.com/portfolio/accounts/6820943174116859281/grants" \
  -H "UDX-Access-Key: API_KEY_ID" \
  -H "UDX-Access-Timestamp: UNIX_MILLISECONDS" \
  -H "UDX-Access-Signature: BASE64_SIGNATURE"

Response

{
  "grants": [
    {
      "id": "4611688217447496062",
      "user_id": "7391077406361930804",
      "status": "active",
      "created_at": "2026-07-15T12:00:00.000000Z"
    },
    {
      "id": "5822799328558517173",
      "user_id": "1194626289313312742",
      "status": "pending",
      "created_at": "2026-08-20T09:30:00.000000Z"
    }
  ],
  "next_page_url": null
}

{
  "type": "urn:udx:problem:invalid-request-parameters",
  "title": "Bad Request",
  "status": 400,
  "detail": "invalid request parameters",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}

{
  "type": "urn:udx:problem:unknown-version",
  "title": "Bad Request",
  "status": 400,
  "detail": "unknown UDX-Version \"1999-01-01\"; supported versions: 2026-07-15",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}

{
  "type": "urn:udx:problem:invalid-authentication-credentials",
  "title": "Unauthorized",
  "status": 401,
  "detail": "invalid authentication credentials",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}

{
  "type": "urn:udx:problem:insufficient-permissions",
  "title": "Forbidden",
  "status": 403,
  "detail": "insufficient permissions",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}

{
  "type": "urn:udx:problem:member-rate-limit-exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "this member has temporarily exceeded its request rate",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}

{
  "type": "urn:udx:problem:request-admission-unavailable",
  "title": "Service Unavailable",
  "status": 503,
  "detail": "request admission is temporarily unavailable",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}