Update Security

post/extensions/roboinvestor/{graph_id}/operations/update-security

Update mutable fields on a security (name, type, subtype, terms, share counts, entity linkage). Unset fields are ignored.

Idempotency: supply an Idempotency-Key header to make safe retries; replays within 24 hours return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.

Authentication

Authenticate in any one of these ways — not all of them:

API key in the X-API-Key header.
Bearer token in the Authorization header.

Path parameters

Name	Type	Description
`graph_id`required	string	Graph Id

Header parameters

Name	Type	Description
`Idempotency-Key`optional	string	Idempotency-Key

Request body

Required, application/json.

Field	Type	Description
`entity_id`optional	string	Reassign to a different issuing entity. Unset = unchanged.
`source_graph_id`optional	string	Update the pre-association tenant graph. Unset = unchanged.
`name`optional	string	New display name. Unset = unchanged.
`security_type`optional	string	New instrument family. Unset = unchanged. Reclassifying a security may invalidate existing `terms` shape; the operation does not validate the cross-field consistency.
`security_subtype`optional	string	New subtype refinement. Unset = unchanged.
`terms`optional	object	Replacement terms blob. Pass `null`/omit to leave existing terms unchanged; pass `{}` to clear them.
`is_active`optional	boolean	Active flag. Set `false` to soft-deactivate (positions remain addressable but the security is hidden from active lookups).
`authorized_shares`optional	integer	New authorized share count. Unset = unchanged.
`outstanding_shares`optional	integer	New outstanding share count. Unset = unchanged.
`security_id`required	string	Target security ID.

Example request

curl

curl -X POST "https://api.robosystems.ai/extensions/roboinvestor/{graph_id}/operations/update-security" \
  -H "X-API-Key: $ROBOSYSTEMS_API_KEY" \
  -H "Idempotency-Key: <Idempotency-Key>" \
  -H "Content-Type: application/json" \
  -d '{
  "outstanding_shares": 7250000,
  "security_id": "sec_acme_common_a"
}'

Responses

200 Successful Response

Field Type Description

operationrequired

string

Kebab-case operation name

operationIdrequired

string

op_-prefixed ULID for audit and SSE correlation

statusrequired

string

Operation lifecycle state

One of: completed, pending, failed

resultoptional

SecurityResponse

Command-specific result payload

SecurityResponse fields

Field	Type	Description
`id`required	string	Security ID (`sec_*` ULID).
`entity_id`optional	string	ID of the issuing entity, when set.
`entity_name`optional	string	Cached display name of the issuing entity, denormalized for list rendering. May lag the entity row's current name briefly.
`source_graph_id`optional	string	Tenant graph this security is pre-associated to, when the issuer entity hasn't been promoted yet.
`name`required	string	Display name of the security.
`security_type`required	string	Instrument family (e.g. `common_stock`, `preferred_stock`, `warrant`, `convertible_note`).
`security_subtype`optional	string	Optional subtype refinement (e.g. `class_a`, `series_a`).
`terms`required	object	Instrument-specific terms blob. Shape depends on `security_type` — see `CreateSecurityRequest.terms` for common keys.
`is_active`required	boolean	`true` when the security is in active status; `false` after a soft-delete or deactivation.
`authorized_shares`optional	integer	Total shares authorized for this class, when set.
`outstanding_shares`optional	integer	Shares currently issued and outstanding.
`created_at`required	string (date-time)	Row creation timestamp (UTC).
`updated_at`required	string (date-time)	Last-modified timestamp (UTC).

atrequired

string

ISO-8601 UTC timestamp

createdByoptional

string

User ID that initiated the operation (null for legacy callers)

idempotentReplayoptional

boolean

True when this envelope came from the idempotency cache — the underlying command did not execute again. False on fresh executions.

Default: false

Status	Meaning
400	Invalid request
401	Authentication required
403	Access denied
404	Resource not found
409	Idempotency-Key conflict — key reused with different body
422	Validation error
429	Rate limit exceeded
500	Internal server error