Authorizations

List authorizations

List authorizations the caller is a party to (either side), newest first. Use role to split the two intuitive views:

role=authorized — “what customers can I act on?” (broker view).
role=granter — “who can act on my behalf?” (customer view).

status and type narrow further; omitting both returns every state including REVOKED (kept for audit).

Honors Nxos-On-Behalf-Of — a broker can list a customer’s grants by pointing the header at the customer’s org id.

Cursor-based pagination via the standard limit / cursor query params; pass back the previous response’s nextCursor to advance.

GET

authorizations

cURL

curl --request GET \
  --url https://api.nxos.io/v1/authorizations \
  --header 'Authorization: <authorization>'

const options = {method: 'GET', headers: {Authorization: '<authorization>'}};

fetch('https://api.nxos.io/v1/authorizations', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.nxos.io/v1/authorizations",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.nxos.io/v1/authorizations"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<authorization>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.nxos.io/v1/authorizations")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<authorization>'

response = http.request(request)
puts response.read_body

{
  "object": "list",
  "data": [
    {
      "object": "authorization",
      "grantingOrganizationId": "org_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
      "authorizedOrganizationId": "org_b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5",
      "type": "LOA",
      "status": "REVOKED",
      "signedAt": "2025-12-01T10:30:00.000Z",
      "revokedAt": "2026-03-15T14:30:00.000Z",
      "revokedReason": "Client off-boarded",
      "createdAt": "2025-12-01T10:30:00.000Z",
      "updatedAt": "2026-03-15T14:30:00.000Z"
    }
  ],
  "hasMore": true,
  "nextCursor": "<string>"
}

{
  "error": {
    "code": "invalid_request",
    "message": "The request body is malformed or missing required fields.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "missing_api_key",
    "message": "No Authorization header provided.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "Your organization is not enabled for this action.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded: 1000 requests per minute. Retry in 23 seconds.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "internal_error",
    "message": "An unexpected server error occurred.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

Headers

Authorization

string

required

Bearer token. Format: Bearer <api_key>

Query Parameters

limit

integer<int32>

default:25

Maximum number of items to return. Defaults to 25, max 100.

cursor

string

Cursor for the next page of results, returned in previous responses.

role

enum<string>

Which side of the grant the caller is on. Omit to return both directions. Filter for which side of the grant the caller is on. Omitted = both directions.

Available options:

granter,

authorized

status

enum<string>

Filter by lifecycle status. Omit to return all states (including REVOKED). Lifecycle status of an authorization grant.

PENDING — Row exists, the granter has not signed yet. The authorized org cannot act on the granter's behalf.
ACTIVE — Granter has signed (signedAt is set). The authorized org may act on the granter's behalf when the Nxos-On-Behalf-Of header is set.
REVOKED — Previously active or pending, then revoked by either party. Kept for audit; never reverts to ACTIVE.

Available options:

PENDING,

ACTIVE,

REVOKED

type

enum<string>

Filter by grant type. Currently only LOA exists. Type of cross-org authorization. Today the only value is LOA (Letter of Authorization), which lets the authorized organization act on the granter's behalf via the platform API when the Nxos-On-Behalf-Of header is set.

Available options:

LOA

Response

The request has succeeded.

Paginated list envelope. All list endpoints return this shape.

object

enum<string>

required

Object type. Always list for paginated responses.

Available options:

list

data

object[]

required

Array of results.

Show child attributes

hasMore

boolean

required

Whether more results are available beyond this page.

nextCursor

string | null

required

Cursor to pass as cursor query parameter for the next page. Null when there are no more results.

cURL

curl --request GET \
  --url https://api.nxos.io/v1/authorizations \
  --header 'Authorization: <authorization>'

const options = {method: 'GET', headers: {Authorization: '<authorization>'}};

fetch('https://api.nxos.io/v1/authorizations', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.nxos.io/v1/authorizations",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.nxos.io/v1/authorizations"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<authorization>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.nxos.io/v1/authorizations")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<authorization>'

response = http.request(request)
puts response.read_body

{
  "object": "list",
  "data": [
    {
      "object": "authorization",
      "grantingOrganizationId": "org_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
      "authorizedOrganizationId": "org_b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5",
      "type": "LOA",
      "status": "REVOKED",
      "signedAt": "2025-12-01T10:30:00.000Z",
      "revokedAt": "2026-03-15T14:30:00.000Z",
      "revokedReason": "Client off-boarded",
      "createdAt": "2025-12-01T10:30:00.000Z",
      "updatedAt": "2026-03-15T14:30:00.000Z"
    }
  ],
  "hasMore": true,
  "nextCursor": "<string>"
}

{
  "error": {
    "code": "invalid_request",
    "message": "The request body is malformed or missing required fields.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "missing_api_key",
    "message": "No Authorization header provided.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "Your organization is not enabled for this action.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded: 1000 requests per minute. Retry in 23 seconds.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

{
  "error": {
    "code": "internal_error",
    "message": "An unexpected server error occurred.",
    "requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
  }
}

Overview

Organizations

Accounts

Funding methods

Quotes

Beneficiaries

Transactions

Authorizations

Payouts

Nxosnet

Fees

Webhooks

Sandbox

List authorizations

Headers

Query Parameters

Response