The FINRA API Platform authentication and authorization scheme is based on OAuth 2.0., and there are two steps. The first call is made to FINRA Identity Platform (FIP) using credentials provided by FINRA Entitlement Service to get an OAUTH2 token. The second call is made to the fileX API endpoint with the "Authorization= Bearer" header and with the token generated in step 1. 

To invoke FIP OAUTH2 API: 

1. Use any HTTP client, make a HTTPS POST call with FINRA Entitlement service provided credentials as Basic Auth header.
2. Use the environment specific domain with the OAUTH URI: fip/rest/ews/oauth2/access_token 3. Use any standard library that supports OAUTH2 client credentials grant.
   1. The library should be configured with grant_type=client_credentials 

   2. Client id, Client secret will be the existing user account id and password provided by FINRA Entitlement services 

      FIP OAUTH2 API response will be in JSON format. Example of the response from https://ews.fip.finra.org/fip/rest/ews/oauth2/access_token : 

{
    "access_token": "*AAJTSQACMDIABHR5cGUAA0pXVAACUzEAAjAx*eyJ0eXAiOiJKV1QiLCJjdHkiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.ZXlKMGVYQWlPaU pLVjFRaUxDSmxibU1pT2lKQk1USTRRMEpETFVoVE1qVTJJaXdpWVd4bklqb2laR2x5SW4wLi56RlNXS09XZklKX1FJT3htWEZtalpB LjF4LVVCMF9OdG85WmhkZlRvTW10dXNNZkxGMUN6MS0tVVVKYTYzYXBwdm8xWExVYzRLXy1raUVEOHFpRXpLZU14aUtLWDc1eTRwcVc4eVlDMs",
    "scope": "any",
    "token_type": "Bearer",
    "expires_in":"43170"
}

FINRA recommends customers to first test their setup in lower environments before cutting it over to ‘Production’.

FINRA Web applications/systems use TLS Certificates signed by following Certificate Authorities: 

• Entrust CA
• DigiCert CA
• Amazon CA 

Please ensure your applications/system trusts all the above listed Certificate Authorities when using fileX HTTPS REST APIs. FINRA APIs only support TLS version 1.2 encryption standards. See FAQs for supported ciphers.

The FIP API can return a range of standard HTTP response codes based on the request made to the service. Here is a list of common response codes:

fileX APIs return a range of standard HTTP response codes based on the request made to the service. Table below lists the response codes and possible reasons

If you encounter issues or response code other than 200 (success), please check your request for errors/invalid content and retry. If you still encounter issues after fixing your request, please contact FINRA Support with the response code and the request details for further assistance

The following header parameters should be passed (as applicable) when making all the fileX REST API calls: