anthid-com Account Manual Controls API
Account-level manual control configuration
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/anthid-com:anthid-com-account-manual-controls-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Account Manual Controls API
description: Account-level manual control configuration
license:
name: ''
version: 0.1.0
servers:
- url: https://api.anthid.com
description: Production
tags:
- name: Account Manual Controls
description: Account-level manual control configuration
paths:
/v1/controls/accounts/{account_id}:
get:
tags:
- Account Manual Controls
summary: Get account control
description: Returns manual controls for a trading account. Users and API keys require Controls Basic or Premium and control read access. Services need `control:read` and `x-organization-id`. The organization must own the account.
operationId: getAccountControl
parameters:
- name: account_id
in: path
description: Trading account ID
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
- name: x-organization-id
in: header
description: Organization id required when reading with service-account credentials
required: false
schema:
type:
- string
- 'null'
format: uuid
responses:
'200':
description: Account control found
content:
application/json:
schema:
$ref: '#/components/schemas/AccountControl'
example:
account_id: 550e8400-e29b-41d4-a716-446655440000
created_at: '2026-08-12T16:20:00Z'
manual_reason: Trading paused during account review
manually_disabled: true
organization_id: 550e8400-e29b-41d4-a716-446655440222
updated_at: '2026-08-12T16:20:00Z'
version: 1
'400':
description: Path or query parameters are invalid, or the service-account `x-organization-id` header is missing or invalid
content:
application/json:
schema:
type: string
text/plain:
schema:
type: string
'401':
description: Missing or invalid authentication credentials
'403':
description: Caller lacks controls entitlement or read permission, or the account is missing or owned by another organization
content:
application/json:
schema:
type: string
'404':
description: Account control was not found
content:
application/json:
schema:
type: string
'429':
description: Caller exceeded the request rate limit
'500':
description: Server error
content:
application/json:
schema:
type: string
security:
- bearerAuth: []
- clientCredentials: []
- apiKeyAuth: []
put:
tags:
- Account Manual Controls
summary: Upsert account control
description: Creates or replaces manual controls for a trading account in the caller's organization. Omitted optional fields are cleared. Requires Controls Basic or Premium. Users need an organization admin role; API keys need control edit permission for the account's environment.
operationId: upsertAccountControl
parameters:
- name: account_id
in: path
description: Trading account ID
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
requestBody:
description: Manual disable flag and optional operator-facing reason
content:
application/json:
schema:
$ref: '#/components/schemas/UpsertControlRequest'
example:
manual_reason: Trading paused during account review
manually_disabled: true
required: true
responses:
'200':
description: Account control upserted
content:
application/json:
schema:
$ref: '#/components/schemas/AccountControl'
example:
account_id: 550e8400-e29b-41d4-a716-446655440000
created_at: '2026-08-12T16:20:00Z'
manual_reason: Trading paused during account review
manually_disabled: true
organization_id: 550e8400-e29b-41d4-a716-446655440222
updated_at: '2026-08-12T16:20:00Z'
version: 1
'400':
description: Request body is invalid
content:
application/json:
schema:
type: string
text/plain:
schema:
type: string
'401':
description: Missing or invalid authentication credentials, or missing organization context
content:
application/json:
schema:
type: string
'403':
description: Caller lacks controls entitlement or edit permission, or the account is missing or owned by another organization
content:
application/json:
schema:
type: string
'413':
description: Request body exceeds the size limit
content:
text/plain:
schema:
type: string
'415':
description: Content-Type must be application/json
content:
text/plain:
schema:
type: string
'422':
description: JSON does not match the request schema
content:
text/plain:
schema:
type: string
'429':
description: Caller exceeded the request rate limit
'500':
description: Server error
content:
application/json:
schema:
type: string
security:
- bearerAuth: []
- apiKeyAuth: []
delete:
tags:
- Account Manual Controls
summary: Delete account control
description: Deletes manual controls for a trading account in the caller's organization. Requires Controls Basic or Premium. Users need an organization admin role; API keys need control edit permission for the account's environment.
operationId: deleteAccountControl
parameters:
- name: account_id
in: path
description: Trading account ID
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
responses:
'200':
description: Account control deleted, or was already deleted. `deleted_at` is when it was first removed and does not move on a repeat call.
content:
application/json:
schema:
$ref: '#/components/schemas/DeletedResponse'
example:
deleted: true
deleted_at: '2026-08-12T16:20:00Z'
resource: account_control
'400':
description: Path parameters are invalid
content:
application/json:
schema:
type: string
text/plain:
schema:
type: string
'401':
description: Missing or invalid authentication credentials, or missing organization context
content:
application/json:
schema:
type: string
'403':
description: Caller lacks controls entitlement or edit permission, or the account is missing or owned by another organization
content:
application/json:
schema:
type: string
'404':
description: No control of this kind has ever existed in this scope
content:
application/json:
schema:
type: string
'429':
description: Caller exceeded the request rate limit
'500':
description: Server error
content:
application/json:
schema:
type: string
security:
- bearerAuth: []
- apiKeyAuth: []
patch:
tags:
- Account Manual Controls
summary: Patch account control
description: Creates or patches manual controls for a trading account. Omitted and null fields are unchanged; `clear` removes named fields. Requires Controls Basic or Premium. Users need an organization admin role; API keys need control edit permission for the account's environment.
operationId: patchAccountControl
parameters:
- name: account_id
in: path
description: Trading account ID
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
requestBody:
description: Fields to change, and fields to remove
content:
application/json:
schema:
$ref: '#/components/schemas/PatchControlRequest'
example:
clear:
- manual_reason
manually_disabled: true
required: true
responses:
'200':
description: Account control patched
content:
application/json:
schema:
$ref: '#/components/schemas/AccountControl'
example:
account_id: 550e8400-e29b-41d4-a716-446655440000
created_at: '2026-08-12T16:20:00Z'
manual_reason: null
manually_disabled: true
organization_id: 550e8400-e29b-41d4-a716-446655440222
updated_at: '2026-08-13T09:15:00Z'
version: 2
'400':
description: No fields changed, or a field is both set and cleared; malformed JSON or path parameters also fail
content:
application/json:
schema:
type: string
text/plain:
schema:
type: string
'401':
description: Missing or invalid authentication credentials, or missing organization context
content:
application/json:
schema:
type: string
'403':
description: Caller lacks controls entitlement or edit permission, or the account is missing or owned by another organization
content:
application/json:
schema:
type: string
'413':
description: Request body exceeds the size limit
content:
text/plain:
schema:
type: string
'415':
description: Content-Type must be application/json
content:
text/plain:
schema:
type: string
'422':
description: JSON does not match the request schema
content:
text/plain:
schema:
type: string
'429':
description: Caller exceeded the request rate limit
'500':
description: Server error
content:
application/json:
schema:
type: string
security:
- bearerAuth: []
- apiKeyAuth: []
/v1/controls/accounts/{account_id}/history:
get:
tags:
- Account Manual Controls
summary: List control changes for an account
description: Lists account and symbol control changes, newest first. Includes the actor's credential type, without actor identifiers. Requires Controls Basic or Premium and control read access for the account.
operationId: listAccountControlChanges
parameters:
- name: account_id
in: path
description: Trading account ID
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
- name: cursor
in: query
description: Opaque cursor from `next_cursor`. Legacy timestamp-only cursors return 400; restart without a cursor.
required: false
schema:
type:
- string
- 'null'
- name: limit
in: query
description: Page size. Defaults to 25 and is clamped to 1 through 100.
required: false
schema:
type:
- integer
- 'null'
format: int64
responses:
'200':
description: Control changes, newest first
content:
application/json:
schema:
$ref: '#/components/schemas/ListControlChangesResponse'
example:
data:
- changed_at: '2026-08-12T16:20:00Z'
changed_by: USER
cleared_fields: []
control_kind: RISK
event_type: SET
scope: ACCOUNT
set_fields:
max_order_size: '100'
symbol: null
next_cursor: null
'400':
description: Path, query parameters, or cursor are invalid; legacy timestamp-only cursors require restarting without a cursor
content:
application/json:
schema:
type: string
text/plain:
schema:
type: string
'401':
description: Missing or invalid authentication credentials, or an authenticated credential without an organization
content:
application/json:
schema:
type: string
'403':
description: Caller lacks controls entitlement or account read access, or the account is missing or owned by another organization
content:
application/json:
schema:
type: string
'429':
description: Caller exceeded the request rate limit
'500':
description: Unexpected server error while reading control history
content:
application/json:
schema:
type: string
security:
- bearerAuth: []
- apiKeyAuth: []
components:
schemas:
ManualControlField:
type: string
description: 'Fields of a manual control a PATCH may remove.
An enum rather than free text so a misspelled name is rejected instead of
silently doing nothing. A caller that believes it re-enabled an account and
did not is the failure this exists to prevent.'
enum:
- manually_disabled
- manual_reason
ControlChangedBy:
type: string
description: 'Who changed a control, as much as is useful to say.
The class of credential only -- never the identifier behind it. An
`api_key_id` or an external user id means nothing to the tenant reading it,
looks like a leak, and would be worse than showing nothing at all. What a
supervising tenant actually needs first is whether one of their people did
this or one of their automated keys did, and that is answerable without
naming anyone.
A resolved display name belongs here later, once identities can be turned
into labels. Until then this stays deliberately coarse rather than
deliberately opaque.'
enum:
- API_KEY
- USER
- SERVICE
UpsertControlRequest:
type: object
required:
- manually_disabled
properties:
manual_reason:
type:
- string
- 'null'
manually_disabled:
type: boolean
AccountControl:
type: object
required:
- account_id
- organization_id
- version
- manually_disabled
- created_at
- updated_at
properties:
account_id:
type: string
format: uuid
created_at:
type: string
format: date-time
manual_reason:
type:
- string
- 'null'
manually_disabled:
type: boolean
organization_id:
type: string
format: uuid
updated_at:
type: string
format: date-time
version:
type: integer
format: int64
DeletedResourceKind:
type: string
description: 'The resource a delete acted on.
Named rather than free text so a caller can branch on it, and so the same
vocabulary is available when these deletes start emitting events.'
enum:
- trading_account
- test_trading_account
- broker_credential
- oauth_client
- organization
- user
- organization_control
- account_control
- account_risk_control
- account_time_control
- symbol_control
- symbol_risk_control
- symbol_time_control
PatchControlRequest:
type: object
properties:
clear:
type: array
items:
$ref: '#/components/schemas/ManualControlField'
description: 'Fields to remove. Clearing `manually_disabled` restores its default of
false, since the column cannot be null.'
manual_reason:
type:
- string
- 'null'
manually_disabled:
type:
- boolean
- 'null'
DeletedResponse:
type: object
description: 'The body every successful delete returns.
Deletes are idempotent, so a caller that retries one it is unsure landed
gets the same 200 as the caller that deleted it. That leaves the caller
unable to tell the two apart from the status alone, which is what
`deleted_at` is for: it is the moment the resource was *first* deleted and
does not move on a repeat call.'
required:
- deleted
- resource
- deleted_at
properties:
deleted:
type: boolean
description: 'Always true. A caller checking one field to confirm the outcome does not
have to special-case which endpoint it called.'
deleted_at:
type: string
format: date-time
description: When the resource was first deleted, not when this call was made.
id:
type:
- string
- 'null'
description: 'Absent for resources keyed by a natural composite key rather than a
single identifier, which today is every control in the controls service.
The path already identifies those, so nothing is lost by omitting it.'
resource:
$ref: '#/components/schemas/DeletedResourceKind'
ControlChange:
type: object
description: 'One recorded change to a control.
Deliberately omits `principal_id`, `request_id`, `source_ip` and the
idempotency key. They exist on the record and matter to an investigation,
but none of them is readable by the tenant and two of them are internal
correlation values. This is the supervisory view, not the audit export.'
required:
- control_kind
- scope
- event_type
- set_fields
- cleared_fields
- changed_by
- changed_at
properties:
changed_at:
type: string
format: date-time
changed_by:
$ref: '#/components/schemas/ControlChangedBy'
cleared_fields:
type: array
items:
type: string
description: Fields this change removed.
control_kind:
type: string
description: 'Which family of control changed: manual, risk, or time.'
event_type:
type: string
description: Whether the change set fields or removed the control outright.
scope:
type: string
description: 'Which level it sits at: organization, account, or symbol.'
set_fields:
description: Fields this change set, as supplied.
symbol:
type:
- string
- 'null'
description: Present only for a symbol-scoped control.
ListControlChangesResponse:
type: object
required:
- data
properties:
data:
type: array
items:
$ref: '#/components/schemas/ControlChange'
next_cursor:
type:
- string
- 'null'
securitySchemes:
apiKeyAuth:
type: apiKey
in: header
name: x-api-key
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
clientCredentials:
type: http
scheme: bearer
bearerFormat: JWT
description: Machine bearer token minted via the client_credentials grant.
x-tagGroups:
- name: Organization
tags:
- Organization Controls
- name: Account
tags:
- Account Manual Controls
- Account Risk Controls
- Account Time Controls
- name: Symbols
tags:
- Symbol Manual Controls
- Symbol Risk Controls
- Symbol Time Controls
- Effective Controls
- name: Evaluation
tags:
- Control Evaluation