openapi: 3.0.0
info:
  title: Arch Client Accounts User Roles API
  version: 0.1.0
  description: "# Arch Client API Documentation\n\n## Getting Started\n\nTo get started, you need to request credentials from us at [api-support@arch.co](mailto:api-support@arch.co).\n\nWe'll send you a secret link with the following information\n- a Client ID\n- a Client Secret\n\n<table>\n\n<tr>\n<td>\n\n### Authentication\n\nTo authenticate, you'll need to make a POST request to the\n[`/client-api/auth/token`](#/Authentication/post_client_api_v0_auth_token) endpoint. Include your Client ID and Client Secret\nin the appropriate fields in the request body.\n\nUsing [curl](https://curl.se/), that request might look like this:\n\n**You should store and reuse this token for as long as it's valid.**\n\nYou can find the expiration time by decoding the [JWT](https://jwt.io/introduction), and checking the `exp` field, which is the expiration time represented as seconds since the Unix Epoch.\n\n</td>\n<td>\n\n```\nCLIENT_ID='<your client id>'\nCLIENT_SECRET='<your client secret>'\ncurl \\ \n  -X 'POST' \\\n  -H 'accept: application/json' \\\n  -H 'Content-Type: application/json' \\\n  -d \"{ \\\n    \\\"clientId\\\": \\\"$CLIENT_ID\\\", \\\n    \\\"clientSecret\\\": \\\"$CLIENT_SECRET\\\" \\\n  }\" \\\n  'https://arch.co/client-api/v0/auth/token'\n```\n\n</td>\n</tr>\n\n</table>\n\n\n<table>\n<tr>\n\n<td>\n\n### Querying\n\nOnce you have an access token, you can query the API as described below. The\nauthorization header should include your Access Token, prefixed by the word\n\"Bearer\". (e.g. `authorization: Bearer tokendata...`)\n\nHere's an example with curl.\n</td>\n\n<td>\n\n```\nACCESS_TOKEN='<access token from the previous step>'\ncurl -X 'GET' \\\n  'https://arch.co/client-api/v0/holdings' \\\n  -H 'accept: application/json' \\\n  -H \"authorization: Bearer $ACCESS_TOKEN\"\n```\n\n</td>\n\n</tr>\n</table>\n\n<table>\n<tr>\n<td>\n\n### Rate Limit\n\nThe Arch Client API is rate limited, measured in requests per minute. If you hit this limit, you will get an error 429 - Too Many Requests.\nTo address this, consider spacing out your requests.\n\nTo check your API user's rate limit status, view the response headers on an API request. The headers are as follows:\n\n* #### RateLimit-Policy\n  The max number of requests allowed over a specified window of time. Format: [number of requests];w=[window of time in seconds]\n\n* #### RateLimit-Limit\n  The max number of requests allowed over the current window of time. Format: [number of requests]\n\n* #### RateLimit-Remaining\n  The remaining number of requests that the user is allowed to make over the current window of time. Format: [number of requests]\n\n* #### RateLimit-Reset\n  The number of seconds remaining until the window of time resets. Format: [number of seconds]\n\n</tr>\n</td>\n</table>\n\n## Pages\n\nMany Arch objects can be returned in lists called Pages. By default, a Page\ncontains up to 25 objects. Some endpoints allow the user to increase the\nnumber of requested objects up to 1000.\n\n## Concepts\n\n<table>\n\n<tr>\n<td>\n\n### Users\nAn individual's personal access to Arch.\n\n### Accounts\nRepresents a collection of investments, which users are assigned to.\n\n### Holdings\n\nHoldings are investments, or any other piece of property (real estate, real assets, bank accounts, etc.). Each holding represents a\nrelationship between an Investing Entity and an Issuing Entity, where the\nInvesting Entity has invested in one of the Offerings that the Issuing Entity\noffers.\n\n  * #### Edge Cases\n    Sometimes, a holding may not directly represent one of your investments. For example, there might be a holding that contains tax documents related to a charitable contribution. Holdings aren't always direct investments as well, it's not uncommon to see a holding representing a Fund -> Fund investment.\n\n### Investing Entities\n\nThese are the entities that own holdings. Arch receives and processes investments on behalf of the Investing Entity.\n\n</td>\n<td>\n<img src=\"../static/images/user.png\" />\n</td>\n</tr>\n\n\n<tr>\n\n</tr>\n\n\n\n<tr>\n<td>\n\n### Issuing Entities\n\nThese are the entities that issue holdings, which you are investing in. They issue documents and updates that Arch receives and processes. Typically, an issuing entity is PE fund, Hedge Fund, etc. We also consider banks to be issuing entities who issue bank account holdings.\n\n  * #### Insights\n    Insights are third party data about issuing entites powered by our partner <a href=\"https://www.preqin.com\">Preqin</a>. Insights are accessible through the corresponding issuing entity.\n### Offerings\n\nThese represent the different investing opportunities that an Issuing Entity offers. For example, Uber might offer both a Seed round, and a later Series A round of investments. That would be a singular issuing entity (Uber), with two separate offerings (Seed, Series A).\n\n</td>\n<td>\n  <img src=\"../static/images/issuing.png\" />\n</td>\n</tr>\n\n<tr>\n\n<td>\n\n### Activities\n\nArch processes many types of documents and updates to your investments.\nCollectively, these updates are known as an \"Activity.\" Examples of activities\ninclude events like:\n- Account Statement Received\n- Capital Call Requested/Paid\n- Distribution Notice/Paid\n- Investor Letter\n\nWe process these activities and extract various finanicial facts about your activities. Examples of these finanical facts are:\n\n- Total Value (Capital Account)\n- Total Contribution\n- Total Distribution\n\n### Cash Flows\n\nThese represent money flowing into or out of your investments. For example, capital calls or distributions. One cash flow can be related to one or more activities.\nOne cashflow can also be related to one or more \"allocations.\" \n\nEach cash flow is also linked to one or more \"allocations,\" which represent the specific movement of money. An allocation has a specific type and describes an event initiated by the LP or GP. Each allocation has a direction: -1 (indicating cash flowing into the investment), 1 (indicating cash flowing out), or infrequently, 0 (no cash movement). The sum of the products of each allocation times its direction equals the total cash flow between the LP and the investment. These allocations can impact an investment's total value, contribution, remaining commitment, and distribution.\n\nTypes of allocations include:\n\n- Capital Calls\n- Expenses\n- Cash Distributions\n- Expenses\n\n#### Point in Time Valuation vs. Estimated Value\n\nPoint in time valuation and estimated value report the value of an investment at different times. Point in time valuation returns the value of an investment exactly as reported on the most recent statement, while estimated value starts with the most recent statement value and adjusts according to the capital calls that have occurred since the date of the most recent statement.\n\n### Tasks\n\nA specific investment related action that the user must complete. For example, confirming a new investment or verifying wire instructions.\n\n</td>\n<td>\n  <img src=\"../static/images/cashflow.png\" />\n</td>\n\n</tr>\n</table>\n\n<table>\n\n<td>\n\n### Lookthroughs\n\n**Premium Feature:** Arch can track and display the <u title=\"An SOI returns a list of your investments, including metrics such as number of shares, fair value, and liquidity.\">schedule of investments (SOI)</u> for any holdings you\nown. This allows you to \"look through\" the holdings you own to the\ninvestments that your holding made. This can make it easier to track your\n\"true\" exposure.\n\n### User Roles\n\nYou grant access to accounts, investing entities, and holdings with user roles. Each role grants a specific set of permissions.\n\n**Available role types for POST and DELETE requests:**\n- Full Access\n- Tax Only\n- Restricted Tax Only\n- View Only\n- File Only\n- Informed Tax Only\n- View Only with Task Completion\n- Restricted Investor\n- Investment Team\n\n**Note:** GET requests may return additional universal and custom role types beyond those listed above, depending on your Arch configuration.\n\nFor more information about permissions associated with roles, please refer to [Arch Permissions by User Type](https://intercom.help/archhelp/en/articles/8975969-arch-permissions-by-user-type).\n\n## Standards\n\n### Time Zone\n\nDates and times are in UTC unless otherwise specified.\n\n</td>\n\n</table>\n"
servers:
- url: /
host: arch.co
tags:
- name: User Roles
paths:
  /client-api/v0/user-roles:
    get:
      operationId: get-list-user-roles
      summary: Get a paginated list of user roles
      parameters:
      - name: limit
        in: query
        description: The number of user roles to return
        schema:
          type: integer
          default: 25
          maximum: 1000
      - name: offset
        in: query
        description: The number of user roles to skip before collecting results
        schema:
          type: integer
          default: 0
          minimum: 0
      - name: accountIds
        in: query
        description: Only include roles on one of the account ids provided. Applies only to roles where `objectType` is `account`.
        example: 1,2,3,4
        schema:
          type: array
          items:
            type: integer
      - name: investingEntityIds
        in: query
        description: Only include roles on one of the investing entity ids provided. Applies only to roles where `objectType` is `investingEntity`.
        example: 10,12,13,14
        schema:
          type: array
          items:
            type: integer
      - name: userIds
        in: query
        description: Only include roles on one of the user ids provided.
        example: 1,2,3,4
        schema:
          type: array
          items:
            type: integer
      - name: objectType
        in: query
        description: 'Which type of object to include. Allowed values: `account` or `investingEntity`.


          **This field defaults to `account` for backwards compatibility.** Callers that want

          investing-entity or holding roles must provide this parameter.

          '
        example: investingEntity
        schema:
          type: array
          items:
            type: string
            enum:
            - account
            - investingEntity
      - name: roleType
        in: query
        description: 'Filter results to only include roles matching the specified portal name.

          Spaces and special characters must be URL-encoded.


          Example values (as they appear in the database):

          - `Tax Only` (in URL: `?roleType=Tax%20Only`)

          - `Full Access` (in URL: `?roleType=Full%20Access`)

          '
        example: Tax%20Only
        schema:
          type: string
      security:
      - BearerAuth: []
      description: 'Returns a paginated list of **direct** user roles. Only shows roles

        explicitly granted on accounts, investing entities, or holdings.

        Access inherited via parent folders is not expanded into this list.


        Each returned role identifies its target via a single `objectRef` (an `AccountRef`,

        `InvestingEntityRef`, or `HoldingRef`) along with an `objectType` discriminator. The

        legacy `accountId` and `userUrl` fields are still populated where applicable but are

        deprecated; new integrations should read `objectRef` and `userRef` instead.

        '
      tags:
      - User Roles
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRoleList'
        '403':
          description: No permission to view access to some accounts
          content:
            application/json:
              schema:
                properties:
                  error:
                    type: string
                    example: No permission to view access to some accounts
        '500':
          description: Internal server error.
    post:
      summary: Create new user roles
      security:
      - BearerAuth: []
      tags:
      - User Roles
      requestBody:
        required: true
        description: A list of new user roles to create.
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/RequestUserRole'
      responses:
        '200':
          description: Success
        '400':
          description: Missing required fields
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
        '403':
          description: No permission to invite to some accounts
          content:
            application/json:
              schema:
                properties:
                  error:
                    type: string
                    example: No permission to invite to some accounts
        '409':
          description: Some user roles already exist
          content:
            application/json:
              schema:
                properties:
                  error:
                    type: string
                    example: Some user roles already exist
        '500':
          description: Internal server error.
    delete:
      summary: Remove user roles
      security:
      - BearerAuth: []
      tags:
      - User Roles
      requestBody:
        required: true
        description: A list of user roles to remove.
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/RequestUserRole'
      responses:
        '200':
          description: Success
        '400':
          description: Missing required fields
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
        '403':
          description: No access to some accounts
          content:
            application/json:
              schema:
                properties:
                  error:
                    type: string
                    example: No access to some accounts
        '409':
          description: Some user roles don't exist yet
          content:
            application/json:
              schema:
                properties:
                  error:
                    type: string
                    example: Some user roles don't exist yet
        '500':
          description: Internal server error.
components:
  schemas:
    ResponseUserRole:
      type: object
      required:
      - kind
      - objectRef
      - userRef
      - roleType
      properties:
        kind:
          type: string
          enum:
          - user-role
        objectRef:
          description: 'Reference to the object this role applies to. The concrete ref can be an `AccountRef`,

            an `InvestingEntityRef`, or a `HoldingRef`. The `kind` field on the ref can be used

            as a discriminator.

            '
          oneOf:
          - $ref: '#/components/schemas/AccountRef'
          - $ref: '#/components/schemas/InvestingEntityRef'
          - $ref: '#/components/schemas/HoldingRef'
          discriminator:
            propertyName: kind
            mapping:
              account-ref: '#/components/schemas/AccountRef'
              investing-entity-ref: '#/components/schemas/InvestingEntityRef'
              holding-ref: '#/components/schemas/HoldingRef'
        accountId:
          type: integer
          deprecated: true
          description: '**Deprecated.** Use `objectRef.id` instead. Only populated for

            account roles; omitted for investing-entity and holding roles.

            Retained for backwards compatibility.

            '
          example: 56
        userRef:
          $ref: '#/components/schemas/UserRef'
        userUrl:
          type: string
          deprecated: true
          description: '**Deprecated.** Use `userRef.url` instead. Retained for backwards compatibility.

            '
          example: /users/15
        roleType:
          type: string
          description: 'The role type. May include additional universal and custom role types beyond those

            available for POST and DELETE requests, depending on your Arch configuration.

            '
          example: Tax Only
    InvestingEntityRef:
      type: object
      required:
      - kind
      - id
      - url
      properties:
        kind:
          type: string
          enum:
          - investing-entity-ref
        id:
          type: number
          description: The ID of the referenced investing entity
          example: 711
        url:
          type: string
          description: A relative url to the referenced investing entity
          example: /investing-entities/711
        name:
          type: string
          description: The name of the referenced investing entity
          example: Investing Entity 711
    RoleType:
      type: string
      example: Tax Only
      enum:
      - Full Access
      - Tax Only
      - Restricted Tax Only
      - View Only
      - File Only
      - Informed Tax Only
      - View Only with Task Completion
      - Restricted Investor
      - Investment Team
      description: 'The type of role. Only the values listed below are accepted.

        '
    UserRef:
      type: object
      required:
      - kind
      - id
      - url
      properties:
        kind:
          type: string
          enum:
          - user-ref
        id:
          type: integer
          description: The ID of the referenced user
          example: 15
        url:
          type: string
          description: A relative url to the referenced user
          example: /users/15
        name:
          type: string
          description: The display name of the referenced user
          example: John Smith
    HoldingRef:
      type: object
      required:
      - kind
      - id
      - url
      properties:
        kind:
          type: string
          enum:
          - holding-ref
        id:
          type: number
          description: The ID of the referenced holding
          example: 112
        url:
          type: string
          description: A relative url to the referenced holding
          example: /holdings/112
        name:
          type: string
          description: The name of the referenced holding
          example: Holding 112
    AccountRef:
      type: object
      required:
      - kind
      - id
      - url
      properties:
        kind:
          type: string
          enum:
          - account-ref
        id:
          type: number
          description: The ID of the referenced account
          example: 56
        url:
          type: string
          description: A relative url to the referenced account
          example: /account/56
        name:
          type: string
          description: The name of the referenced account
          example: Account 56
    UserRoleList:
      type: object
      required:
      - kind
      - selfUrl
      - contents
      properties:
        kind:
          type: string
          description: page
        selfUrl:
          type: string
          description: The relative URL for accessing this resource via the Arch Client API
          example: /user-roles
        contents:
          type: array
          items:
            $ref: '#/components/schemas/ResponseUserRole'
        prev:
          type: string
          description: The relative URL for the previous page of user roles
          example: null
        next:
          type: string
          description: The relative URL for the next page of user roles
          example: /user-roles?offset=25
    RequestUserRole:
      type: object
      required:
      - accountId
      - userId
      - roleType
      properties:
        accountId:
          type: integer
          example: 56
        userId:
          type: integer
          example: 15
        roleType:
          $ref: '#/components/schemas/RoleType'
          example: Tax Only
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT