API overview

Redbark Advisor is in Closed Beta. The API can change while we work with beta firms. We keep changes small and tell beta firms before anything breaks.

The Redbark Advisor API gives your own tools the same access your team has in the app. Each call works inside one firm.

Base URL

https://advisor.redbark.com/api/v1

The OpenAPI 3.1 document is at https://advisor.redbark.com/api/v1/openapi.json. It is public and needs no key. The endpoint pages in this tab are built from it.

What the API covers

Area	What you can do
Firm	Read the firm and who the call acts as. Change the name and branding.
Team	List members and invitations. Invite, change, remove and resend.
Clients	List, add and change clients. Invite them to their portal and archive them.
Checklists	Manage checklist templates. Send checklists, edit items, approve items or ask for changes.
Documents	List, upload, download and delete documents. Review the values and facts read from them.
Money	Read accounts, balances, transactions and bank connections. Accept or reject balances.
Document types	Manage document types, their fields and the facts they fill.
Messages	Read threads and document comments. Post, edit and delete messages.
Reports	List, create and delete client reports.
Webhooks	Manage webhook endpoints, see deliveries, resend and send tests.

Your first request

Make an API key in Settings > API and MCP. Then ask who the key acts as:

curl https://advisor.redbark.com/api/v1/organisation \
  -H "Authorization: Bearer rbk_org_live_..."

{
  "object": "organisation",
  "id": "adv_org_rFBeHmyzaTdUsrNs9KcWnu",
  "name": "Harbour & Co",
  "slug": "harbour",
  "brand_color": "#1F4E79",
  "has_logo": true,
  "send_client_emails": true,
  "show_secured_by": true,
  "onboarded": true,
  "acting_as": { "member_id": "adv_mem_8sKq2Lr0Vb3nT6wYp1Zc4d", "role": "admin" }
}

List your clients the same way:

curl "https://advisor.redbark.com/api/v1/clients?limit=10" \
  -H "Authorization: Bearer rbk_org_live_..."

Conventions

JSON in and JSON out. Field names are snake_case.
Send a body on POST and PATCH with Content-Type: application/json. A body can be up to 256 KiB.
GET and DELETE take their inputs in the query string.
Ids are opaque strings with a prefix, such as adv_cli_ for a client. Store them as they are.
Times are UTC strings in ISO 8601 form.
Every response carries an X-Request-Id header. Quote it if you contact us.

Scopes

Every API key and connected app carries scopes. A scope is an area and a level, such as clients:read or clients:write.

There is one read and one write scope for each area in the table above.
A write scope includes its read scope.
Each endpoint page shows the scope it needs.
A call without the scope fails with 403 insufficient_scope.

See Authentication for the full list.

Admin-only calls

Some calls change how the firm is set up. Only an admin can make them:

Changing the firm’s name and branding.
Inviting, changing and removing team members.
Adding and changing document types, their fields and fact definitions.
Adding, changing and deleting webhook endpoints, rolling secrets, resending deliveries and sending tests.

Each of these endpoint pages says “Only an admin can call this.” An API key always acts as an admin. A connected app acts as the member who connected it, so it gets 403 admin_required on these calls unless that member is an admin.

Next steps

Authentication

API keys, connected apps and scopes.

Errors

Error codes, rate limits and pagination.

Webhooks

Get told when things change.

Guides

Firm

Team

Clients

Checklists

Documents

Money

Document types

Messages

Reports

Webhooks

Webhook events

Base URL

What the API covers

Your first request

Conventions

Scopes

Admin-only calls

Next steps

Authentication

Errors

Webhooks

​Base URL

​What the API covers

​Your first request

​Conventions

​Scopes

​Admin-only calls

​Next steps

Authentication

Errors

Webhooks

Base URL

What the API covers

Your first request

Conventions

Scopes

Admin-only calls

Next steps