Developer API

Building with TheProfitPath's API

Use scoped API keys to sync journal data and retrieve performance, calendar, news, collaboration, and eligible Market Monitor data without sharing a browser session.

Create a key Back to docs

Authentication

External apps authenticate with a scoped API key sent in the X-API-Key header. Browser sessions keep using secure cookies, so the public API never depends on the user's login cookie.

Base URL

Use https://theprofitpath.app/api as the canonical same-origin API base.

Key management

Create, list, and revoke keys from Settings > Developer API in the app. Keys can be personal or belong to an organization, and the raw secret is only shown once at creation time.

Scopes

Read-only keys can fetch journal, collaboration, notification, calendar, news, and eligible Market Monitor data. Read/write keys can also perform documented mutations. Every endpoint declares its required resource scope.

Organizations

Use organizations when a team, firm, or client needs its own namespace for API keys and integrations.

Implementation checklist

Fetch or create a key, store it in a secret manager, send X-API-Key on every request, handle 401s cleanly, and re-sync when the key is revoked.

Request example

Send the API key in the header, not in the query string.

curl https://theprofitpath.app/api/trades \
  -H "X-API-Key: tppk_your_secret_here"

curl "https://theprofitpath.app/api/economic-calendar?start=2026-08-10&end=2026-08-17" \
  -H "X-API-Key: tppk_your_secret_here"

curl "https://theprofitpath.app/api/market-monitor/analysis?symbol=ES&assetClass=future" \
  -H "X-API-Key: tppk_your_secret_here"

Machine-readable discovery is available at /api/capabilities and /api/openapi.json.

Supported resources

Identity and journal

GET /api/auth/me · read:me

GET|POST|PUT|DELETE /api/trades · trades

GET|POST|PUT|DELETE /api/accounts · accounts

GET|POST|DELETE /api/accounts/{id}/transactions · accounts

PUT /api/accounts/{id}/settings · write:accounts

POST /api/accounts/{id}/assign-trades · write:accounts

GET /api/journal[/stats|/calendar] · read:journal

GET /api/statistics/* · read:statistics

GET|POST|PUT|DELETE /api/tags · tags

GET|POST|PUT|DELETE /api/strategies · strategies

GET /api/strategies/overview · read:strategies

POST /api/strategies/{id}/duplicate|assign-trades · write:strategies

POST /api/csv-import/* · write:trades

Review and coaching data

GET /api/reports[/overview|/schedule|/{id}] · read:reports

DELETE /api/reports/{id} · write:reports

POST /api/reports/{id}/share · write:reports

GET /api/emotions[/analysis|/coach] · read:emotions

GET|POST|PUT|DELETE /api/goals · goals

GET /api/insights · read:insights

POST /api/insights/generate · write:insights

GET /api/statistics/achievement-coach · read:statistics

Calendar, news, and markets

GET /api/economic-calendar · read:economic-calendar

GET /api/economic-calendar/news · read:market-news

GET /api/economic-calendar/news/stream · read:market-news

GET /api/market-monitor/catalog[/search] · read:market-monitor

GET /api/market-monitor/watchlist|settings · read:market-monitor

GET /api/market-monitor/analysis · read:market-monitor

GET /api/market-monitor/report · read:market-monitor

GET /api/market-monitor/candles · read:market-monitor

GET /api/market-monitor/context · read:market-monitor

POST /api/market-monitor/overview|quotes|explain · read:market-monitor

PUT /api/market-monitor/watchlist|settings · write:market-monitor

POST /api/market-monitor/report/generate · write:market-monitor

Collaboration and account activity

GET /api/notifications · read:notifications

GET|PUT /api/auth/notification-settings · notification-settings

GET|POST|DELETE /api/mentor/* · mentor

GET|POST|PUT|DELETE /api/community/* · community

GET|POST|DELETE /api/profiles/* · profiles

GET|POST|DELETE /api/referrals/* · referrals

Security model

Keys are hashed at rest. The raw secret is never stored in plain text.

Revoking a key immediately disables the integrations using it.

Scope checks happen per resource, so read-only keys cannot mutate journal data.

A good integration starts with trades, then expands into accounts and reports.

Browser session only

Create, list, and revoke API keys or organizations
Password, two-factor authentication, and active-session controls
Stripe billing, checkout, and customer portal actions
Notion OAuth, support conversations, uploads, and AI Tutor chat or live voice
Admin consoles outside the administrator-only Market Monitor preview

Market Monitor remains an administrator preview. Its API endpoints require both the matching key scope and an admin or superadmin key owner. Any plan, rate-limit, and platform-feature gates on the equivalent product operation continue to apply.

Existing keys retain exactly their stored resource scopes when the catalogue expands. Create a replacement key and select the new resource when an integration needs access to a newly connected product surface.