Phillip Capital
API docs by Redocly

Phillip Capital Public API (1.0.0)

Download OpenAPI specification:

Base URL: https://api.phillipcapital.com.au

Authentication: OAuth 2.0 Client Credentials

Welcome to the Phillip Capital Public API documentation.

Our APIs provide secure, scalable, and reliable access to the data and services provided by Phillip Capital. Built with modern infrastructure and industry standards in mind, these APIs are designed for fast, efficient integration with your systems. Key features include:

  • Scalability to support high-volume transactions and data processing

  • Security via OAuth 2.0 authentication and TLS encryption

  • Flexibility to support diverse integration use cases

  • Reliability backed by Phillip Capitals’s proven financial systems expertise

This documentation provides detailed information on authentication, usage, versioning, and available endpoints. For more information or to request access to the API, please contact your Phillip Capital representative.

We're always looking to improve our APIs and services. If you have any feedback or suggestions, please let us know.

Introduction

A REST API (or Representational State Transfer API) is a method for two systems to communicate and share data over the internet, adhering to a standardized set of rules. In simpler terms, it’s a way for applications to talk to each other, allowing them to exchange information in a consistent and reliable manner. A REST API is an API that communicates using the HTTP protocol, where different resources (such as data or services) are accessible via specific web addresses (URLs). Each URL represents a resource, which could be anything from ledger data to contract note copies. By leveraging REST APIs, systems can efficiently expose data and functionality, ensuring a seamless, reliable exchange of information across distributed platforms.

Authentication

We utilise the OAuth 2.0 "Client Credentials" flow to ensure secure access to our APIs. This industry-standard authentication protocol allows systems to authenticate and communicate securely without involving user interaction, making it ideal for server-to-server integrations.

How It Works

In the Client Credentials flow, an application (the client) requests an access token directly from the authentication server (Identity Provider, or IdP) using its own credentials. This access token is then used to authorise API requests. Here’s a step-by-step overview:

  1. Client Authentication:

The client authenticates with the Identity Provider using a unique client ID and secret. These credentials are issued by the Phillip Capital authentication system when your application is registered.

  1. Access Token Request:

Once authenticated, the client requests an access token by calling the token endpoint of the IdP. This request includes the client ID, client secret, and a grant type of client_credentials.

  1. Access Token Issuance:

If the client is successfully authenticated, the Identity Provider returns an access token. This token is a time-limited key that the client can use to make authorised API calls.

  1. Authorised API Requests:

The client then includes the access token in the header of subsequent API requests, typically in the form of a Bearer token. The API verifies the token before processing the request, ensuring that the client is authorised to access the requested resource.

Example

Obtaining an access token and using it to make a secure API call is a two-step process.

1). Requesting an Access Token

 curl -X POST https://oauth.phillipcapital.com.au/oauth2/token  
 -u client_id:client_secret  
 -d 'grant_type=client_credentials&scope=DataApiServer/data_read_scope'

This request sends the client ID, client secret, and grant type to the token endpoint. If the credentials are valid, the Identity Provider responds with an access token:

 {"access_token":"9zjf....90823kjns", "token_type":"bearer","expires_in":3600}

2). Making an Authorised API Call

Once you receive the access token, include it in the Authorisation header of your API requests:

 curl -k -X GET https://api.phillipcapital.com.au/ledgers?accountNumber=123456   
 --header 'Accept: application/json'   
 --header 'Authorization: Bearer k9fk32......9238kmsq2'   
 --header 'Content-Type: application/json'

All communication between your application and Phillip Capital must be encrypted using TLS to protect sensitive data like the client secrets. Access tokens are short-lived to minimise the risk of token misuse in the event of a security breach. By using OAuth 2.0, Phillip Capital ensures that your application can interact with our APIs in a secure, scalable, and standardised way, without exposing unnecessary risk to either party.

Back Office

Retrieve ledger entries

Fetches the ledger entries, with optional account number, currency and date range filters.

If you provide an account number, you must have permissions to that account. If not, you will receive an empty array in the response.

You can apply any combination of the date filters to narrow down the results. If no date filters are provided, the API will return all contract notes for the account. For accounts with large numbers of contract notes, it is recommended to use the date filters to reduce the response size or responses may be slower than expected.

Authorizations:
OAuth2ClientCredentials
query Parameters
accountNumber
string
Example: accountNumber=acct_123
currency
string
Example: currency=AUD
transactionDate
string
Example: transactionDate=2024-03-01

Transaction date in YYYY-MM-DD format. If neither transactionDate or settlementDate are provided, transactionDate defaults to the current date.

settlementDate
string
Example: settlementDate=2024-03-30

Settlement date in YYYY-MM-DD format.

Responses

Response samples

Content type
application/json
[
  • {
    },
  • {
    }
]

Retrieve holdings

Fetches all holdings for the accounts to which you have access. It may be filtered for a specific account number.

If you filter by account number, you must provide an account number to which you have permissions to view. If not, you will receive an empty array in the response.

Authorizations:
OAuth2ClientCredentials
query Parameters
accountNumber
string
Example: accountNumber=acct_123

Responses

Response samples

Content type
application/json
[
  • {
    },
  • {
    }
]

Retrieve corporate actions

Fetches the corporate actions to which you have access, with optional to and from dates

You can apply any combination of the date filters to narrow down the results. If no date filters are provided, the API will return all corporate actions for the current date. A date range must be 31 days or less. If only one date is provided, the API will automatically set the other date to be 31 days prior/following.

Authorizations:
OAuth2ClientCredentials
query Parameters
from
string
Example: from=2025-06-25
to
string
Example: to=2025-06-26

Responses

Retrieve contract notes

Fetches the contract notes for the accounts to which you have access, with optional account number, currency and date range filters.

You can apply any combination of the date filters to narrow down the results. If no date filters are provided, the API will return all contract notes for the account. For accounts with large numbers of contract notes, it is recommended to use the date filters to reduce the response size or responses may be slower than expected.

Note that 'grossValue' is the value of the price x quantity, and 'netValue' is the gross value plus brokerage and GST.

Authorizations:
OAuth2ClientCredentials
query Parameters
accountNumber
string
Example: accountNumber=acct_123
currency
string
Example: currency=AUD
tradeDate
string
Example: tradeDate=2024-03-01

Trade date in YYYY-MM-DD format. If neither tradeDate or settlementDate are provided, tradeDate defaults to the current date.

settlementDate
string
Example: settlementDate=2024-03-25

Settlement date in YYYY-MM-DD format.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Retrieve balances

Fetches the balances for the accounts to which you have access. You may filter by account number and currency.
Unless filtered by currency, balances in all currencies will be returned. If filtering by account number then you must provide an account number to which you have permissions to view. If not, you will receive an empty array in the response.

Authorizations:
OAuth2ClientCredentials
query Parameters
accountNumber
string
Example: accountNumber=acct_123
currency
string
Example: currency=AUD

Responses

Response samples

Content type
application/json
[
  • {
    },
  • {
    }
]

Onboarding

Create an individual account application

Submits a new individual account application for a single applicant.

This endpoint is used when an individual person wants to open a personal trading account.

Authorizations:
OAuth2ClientCredentials
Request Body schema: application/json
required

Individual account application details

required
object

Common fields for all application requests

Responses

Request samples

Content type
application/json
{
  • "application": {
    }
}

Response samples

Content type
application/json
{
  • "id": "5545eebf-a0e4-499e-b075-171ddb202e3c",
  • "type": "individual"
}

Create a joint account application

Submits a new joint account application for multiple applicants.

This endpoint is used when two or more individuals want to open a shared trading account. All applicants must provide their personal details, identification, and tax information.

Required Information

  • Applicants: Array of applicant details (minimum 2 applicants)
  • Each Applicant: Name, date of birth and contact information

Important Notes

  • All applicants must be 18 years or older
  • All applicants will have equal access to the account
Authorizations:
OAuth2ClientCredentials
Request Body schema: application/json
required

Joint account application details

required
object

Common fields for all application requests

Responses

Request samples

Content type
application/json
{
  • "application": {
    }
}

Response samples

Content type
application/json
{
  • "id": "6656ffcg-b1f5-5aaf-c186-282ece313f4d",
  • "type": "joint"
}

Create a company account application

Submits a new company account application for a corporate entity.

This endpoint is used when a company wants to open a trading account. The application must include company details, tax information, and details of directors and beneficial owners.

Required Information

  • Company Details: Name, ACN, ABN, registration date, registered address
  • Beneficial Owners: Individuals with significant ownership or control

Important Notes

  • At least one director must be designated as the primary applicant
  • All beneficial owners with 25% or more ownership must be disclosed
Authorizations:
OAuth2ClientCredentials
Request Body schema: application/json
required

Company account application details

required
object

Common fields for all application requests

Responses

Request samples

Content type
application/json
{
  • "application": {
    }
}

Response samples

Content type
application/json
{
  • "id": "7767ggdh-c2g6-6bbg-d297-393fdf424g5e",
  • "type": "company"
}

Create an individual trust account application

Submits a new individual trust account application where the trustees are individuals.

This endpoint is used when a trust with individual trustees wants to open a trading account. The application must include trust details, trustee information, and beneficiary details.

Required Information

  • Trust Details: Name, type, ABN/TFN, business address
  • Trust Tax Info: Tax classification, FATCA status if applicable
  • Trust Settlor: Information about who established the trust
  • Trust Ownership: Majority ownership details
  • Applicants: Individual trustees with their personal details
  • Beneficiaries: Trust beneficiaries (if applicable based on trust type)
  • Appointers: Trust appointers (if applicable)

Trust Types Supported

  • Self-Managed Superannuation Fund (SMSF)
  • Other regulated trusts
  • Bare trusts
  • Discretionary trusts
  • Fixed trusts
  • Unit trusts
Authorizations:
OAuth2ClientCredentials
Request Body schema: application/json
required

Individual trust account application details

required
object

Common fields for all application requests

Responses

Request samples

Content type
application/json
{
  • "application": {
    }
}

Response samples

Content type
application/json
{
  • "id": "8878hhei-d3h7-7cch-e3a8-4a4geg535h6f",
  • "type": "individualtrust"
}

Create a corporate trust account application

Submits a new corporate trust account application where the trustee is a company.

This endpoint is used when a trust with a corporate trustee wants to open a trading account. The application must include trust details, corporate trustee company information, and details of directors of the trustee company.

Required Information

  • Trust Details: Name, type, ABN/TFN, business address
  • Trust Tax Info: Tax classification, FATCA status if applicable
  • Trust Settlor: Information about who established the trust
  • Trust Ownership: Majority ownership details
  • Company Details: Corporate trustee's company information
  • Applicants: Directors of the corporate trustee with their personal details
  • Beneficiaries: Trust beneficiaries (if applicable based on trust type)
  • Appointers: Trust appointers (if applicable)

Key Differences from Individual Trust

  • Requires company details for the corporate trustee
  • Applicants are directors of the trustee company, not individual trustees
  • May include other companies as owners of the corporate trustee
Authorizations:
OAuth2ClientCredentials
Request Body schema: application/json
required

Corporate trust account application details

required
object

Common fields for all application requests

Responses

Request samples

Content type
application/json
{
  • "application": {
    }
}

Response samples

Content type
application/json
{
  • "id": "9989iifj-e4i8-8ddi-f4b9-5b5hfh646i7g",
  • "type": "corporatetrust"
}