Xantos: Invest in US Stocks — API integration & OpenFinance services

Deliverables checklist

• API specification (OpenAPI / Swagger) for login, holdings, portfolio history, activities and statements
• Protocol & auth-flow report (token exchange, refresh chain, request signing, pagination cursors)
• Runnable source in Python and Node.js for the login + statement + holdings endpoints
• Exporters to JSON, CSV/Excel and PDF, plus a BigQuery / Snowflake / Postgres loader
• Automated tests, Postman collection and API documentation
• Compliance notes: consent capture, data minimization, retention windows, KYC field handling

How we work — at a glance

• Scope confirmation: which screens and records you need (holdings vs. activity vs. statements)
• Protocol analysis on authorized traffic; design endpoints that mirror the app's own calls
• Build, internal validation against a test account, then a review call
• Documentation, samples, test cases; optional hosted deployment with per-call metering
• Handover; you pay on satisfaction for source delivery, or per call for the hosted option

1 · Bookkeeping & reconciliation sync

Context: a finance team or accounting SaaS needs Xantos balances and trades to reconcile against its own ledger. Data/API: GET /holdings, GET /activities?type=fill,fee,dividend with date ranges. OpenFinance mapping: the same "investment transactions + holdings" contract Plaid and SnapTrade expose for brokerage accounts — read-only, consent-scoped, pulled on a schedule.

2 · Personal net-worth & wealth dashboard

Context: a money app wants the Xantos managed portfolio to appear next to bank and card accounts. Data/API: GET /accounts/{id}/balances plus GET /portfolio/history for the equity curve. OpenFinance mapping: classic account-aggregation use case — one OAuth-style consent, periodic balance/timeseries refresh, displayed as another linked account.

3 · Tax pack & fee transparency export

Context: an end user or their accountant needs a clean record of every dividend, sale and the monthly 1%-per-annum advisory fee. Data/API: GET /activities filtered by year, plus GET /documents for statement PDFs, written to CSV/Excel. OpenFinance mapping: data-portability — the user exercises a right to extract their own financial records in a portable format.

4 · Compliance archive & audit feed

Context: a RIA aggregator or auditor must retain statements and activity for the required period. Data/API: a webhook on order.filled / statement.ready events that drops records into immutable storage with a hash chain. OpenFinance mapping: event-driven OpenBanking-style notifications instead of polling, with logged consent and access trails.

5 · Embedded portfolio widget in a partner app

Context: a fintech wants to show a customer's Xantos holdings and performance inside its own UI. Data/API: token exchange via POST /auth/token, then GET /holdings and GET /portfolio/history server-side. OpenFinance mapping: delegated, scoped access — the partner never sees credentials, only short-lived tokens, mirroring OpenBanking's consent model.

1 · Authenticate & refresh (pseudocode)

POST /api/v1/xantos/auth/token
Content-Type: application/json

{
  "grant_type": "password",
  "username": "user@example.com",
  "password": "<SECRET>",
  "device_id": "ios-9F2A..."
}

200 OK
{
  "access_token": "eyJhbGci...",
  "refresh_token": "rt_8d1c...",
  "expires_in": 3600,
  "account_id": "acct_7c1e2f"
}

# refresh before expiry
POST /api/v1/xantos/auth/token
{ "grant_type": "refresh_token", "refresh_token": "rt_8d1c..." }

2 · Pull holdings & portfolio history

GET /api/v1/xantos/accounts/acct_7c1e2f/holdings
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{ "positions": [
  { "symbol": "AAPL", "qty": "1.4031",
    "avg_entry_price": "188.20", "market_value": "271.93",
    "unrealized_pl": "8.04", "unrealized_plpc": "0.0305" }
] }

GET /api/v1/xantos/accounts/acct_7c1e2f/portfolio/history
    ?period=1A&timeframe=1D
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{ "timestamp": [1704067200, 1704153600],
  "equity": [10250.11, 10311.42],
  "profit_loss": [12.30, 61.31],
  "profit_loss_pct": [0.0012, 0.0060] }

3 · Activity export with paging & errors

GET /api/v1/xantos/accounts/acct_7c1e2f/activities
    ?type=fill,dividend,fee&after=2025-01-01&page_size=100
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{ "items": [
   { "type": "fee", "description": "advisory fee 1%/yr",
     "amount": "-3.21", "date": "2025-01-31" },
   { "type": "dividend", "symbol": "VTI",
     "amount": "1.84", "date": "2025-01-15" } ],
  "next_page_token": "MjAyNS0wMS0xNQ==" }

429 Too Many Requests  -> honor Retry-After, exponential backoff
401 Unauthorized       -> refresh token, replay once, else re-auth

4 · Webhook receiver (Node.js sketch)

app.post("/webhooks/xantos", (req, res) => {
  const sig = req.header("X-Xantos-Signature");
  if (!verifyHmac(req.rawBody, sig, SECRET)) return res.sendStatus(401);
  const e = req.body;            // { type, account_id, data }
  switch (e.type) {
    case "order.filled":   ledger.appendTrade(e.data); break;
    case "statement.ready": archive.store(e.data.url); break;
    case "fee.charged":    ledger.appendFee(e.data);  break;
  }
  res.sendStatus(200);           // idempotent on e.data.id
});

Regulatory context

Xantos Labs LLC operates as an SEC-registered investment adviser (Form ADV on file), with brokerage and custody through Alpaca Securities LLC, a FINRA/SIPC member; client securities are protected up to $500,000 by SIPC. Any integration we build respects that framework: it touches only data the end user is entitled to, uses authorized access or documented public APIs, and aligns with the SEC's Investor Bulletin on robo-advisers and Investment Advisers Act recordkeeping expectations. Where end users are in the EU/UK we add GDPR handling, and we track the CFPB's Section 1033 personal-financial-data rule for US open-finance access.

Privacy controls we ship

• Explicit, scoped consent capture with revocation and a consent ledger
• Data minimization — only the fields a scenario needs; KYC fields tokenized at rest
• Encryption in transit and at rest; short-lived access tokens, rotated refresh tokens
• Full access logging and tamper-evident archives for audit
• Configurable retention windows and a hard-delete path on request
• NDAs and a written data-processing description on request

Robo-advisor & managed-investing peers

• Betterment — Goal-based managed portfolios of low-cost ETFs plus a cash account; users often want its holdings and transactions exported alongside Xantos for one tax pack.
• Wealthfront — Automated portfolios, direct indexing and self-directed stock investing; holdings, dividends and transfer data are common reconciliation inputs.
• SoFi Invest (Automated Investing) — Fee-free managed portfolios inside a broader money app; balance and activity feeds line up naturally with a Xantos sync.
• Acorns — Round-up micro-investing into managed portfolios; small, frequent transactions make a clean activity export especially useful.
• Fidelity Go — Low-cost managed accounts using zero-expense-ratio "flex funds"; positions and statement PDFs are typical archive targets.
• Schwab Intelligent Portfolios — No-advisory-fee automated investing with auto-rebalancing; performance timeseries pair well with a multi-account dashboard.
• Vanguard Digital Advisor — Low-minimum automated advice service; holdings and contribution history feed net-worth roll-ups.

Africa-to-US-stocks peers (same category as Xantos)

• Bamboo — Lets users in Nigeria and beyond buy US-listed stocks; holdings, order history and funding records are the usual integration surface.
• Chaka — Cross-border investing in US and local equities; transaction and balance data is commonly consolidated with other brokerage apps.
• Risevest — Dollar-denominated managed portfolios for users in Africa; performance timeseries and fee records map cleanly to OpenFinance exports.

For any of these, the integration story is the same as for Xantos: read-only, consent-scoped access to holdings, balances, transactions and statements, normalized so a finance tool, dashboard or compliance archive can treat every account the same way.

About us

We are an independent studio focused on fintech protocol analysis and OpenData / OpenFinance API integration. Our engineers have shipped work for banks, brokerages, payment gateways and cloud platforms, and we understand the expectations that sit around an SEC-registered adviser product and a FINRA/SIPC custodian. We hand over end-to-end financial APIs under clear security and compliance constraints — never detection-evasion work, only authorized or documented access.

• Brokerage, robo-advisory, digital banking and cross-border investing integrations
• Enterprise API gateways, webhook fan-out and security reviews
• Custom Python / Node.js / Go SDKs and test harnesses
• Full pipeline: protocol analysis → build → validation → compliance handover
• Source-code delivery from $300 — runnable API source plus full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — use our hosted endpoints and pay only per call, no upfront cost

Contact

For a quote, or to submit your target app and requirements (which Xantos screens and records you need, expected call volume, export format), open our contact page:

Contact page

Tell us whether you want a one-off source-code delivery or hosted pay-per-call access, and whether you need a webhook feed or scheduled batch exports.

Engagement workflow

1. Scope confirmation: target screens, data types (holdings / activity / statements) and call volume.
2. Protocol analysis and API design on authorized traffic (2–5 business days, complexity-dependent).
3. Build and internal validation against a test account (3–8 business days).
4. Documentation, samples and test cases (1–2 business days).
5. Handover; typical first delivery is 5–15 business days. Custodian or third-party approvals may extend it.

FAQ

What do you need from me to start a Xantos integration?

How long does delivery take?

How do you handle compliance for an SEC-registered adviser app?

Can you export Xantos data to Excel or a data warehouse?