Introduction

The LP Reporting API exposes every part of the Report Studio as HTTP endpoints: create a fund report, configure it, pull the computed numbers as JSON, and render the investor statement. The Renesis Report Workspace is itself a client of these endpoints, so anything the product can do, your integration can do. Two endpoints do most of the work:

GET /api/funds/{report_id}/config returns the report’s configuration (fund identity, period, strategies, fees, content, branding).
GET /api/funds/{report_id}/computed returns the numbers (NAV, returns, risk, fees by month, holdings, allocations) as JSON floats, the same values that get baked into the rendered statement.

If you are building your own reporting dashboard, /computed is the endpoint to build against. /config is configuration, /computed is computed metrics; never derive one from the other. If you don’t need a report at all, just the portfolio’s current value as one number (on-chain NAV publishing, attestation workflows, scheduled pulls), skip the report endpoints entirely and use the Portfolio NAV endpoint.

Numbers come from the same portfolio ledger that drives the Renesis dashboard. If the dashboard NAV is wrong, /computed will be wrong. Fix the ledger first (re-reconcile the affected wallet or account), then re-read.

Base URL

Production: https://api.renesis.fi

All LP Reporting endpoints are served under the /lp-report-studio prefix. For other environments, contact your administrator. Throughout this reference, paths are written relative to that prefix. GET /api/funds means:

GET https://api.renesis.fi/lp-report-studio/api/funds

Authentication

All endpoints authenticate with a Renesis API key (prefix ak_), passed in the X-API-Key header. Create and manage keys from your user page in the dashboard; the secret is shown only once at creation, so copy it then.

export API_KEY="ak_xxxxxxxxxxxxxxxxxxxx"

curl -H "X-API-Key: $API_KEY" \
  "https://api.renesis.fi/lp-report-studio/api/funds"

If a key was issued with a path allowlist, it must include the /lp-report-studio prefix to call these endpoints. Keep keys secret and server-side. A Keycloak bearer token works everywhere the API key does (Authorization: Bearer <token>). That is the path in-app sessions use; for a server-to-server integration prefer the API key, since it has no session to keep alive.

Gateway rejections

Key verification happens at the gateway, before the service is reached, and uses its own error envelope:

Status	Body	Cause
`401`	`{"error":"invalid_api_key"}`	Unknown, revoked, or malformed key
`403`	`{"error":"path_not_allowed_for_api_key"}`	The key carries a path allowlist that does not cover `/lp-report-studio`
`503`	`{"error":"api_key_verification_unavailable"}`	Key verification is temporarily unreachable; retry

Permissions

Every endpoint on this service requires the caller to hold one of the admin, trader, or pms_user roles. On top of that, endpoints scoped to a {report_id} enforce per-report access:

Access	Who has it	What it allows
Read	The report owner, and any address on `sharing.email_addresses` that also holds one of the three roles above	`GET /config`, `GET /branding`, `GET /computed`, `POST /computed`, `GET /assets/logo`, `GET /output/{filename}`
Write	The report owner only	`PUT /config`, `DELETE`, `PUT /fees`, `POST /branding`, `POST /logo`, `GET /detect-vaults`, `POST /strategies/from-vaults`, `POST /render`, `POST /render-preview`
Admin	The `admin` role	Everything, on every report. Templates are the exception: they are personal, and admin does not bypass ownership.

GET /api/funds filters to the reports the caller can read, so it is safe to call as a discovery step.

A limited partner cannot call this service. The role gate runs before the per-report access check, and an LP user holds only the limited-partner role, so every endpoint here answers 401 for them regardless of email_addresses or investor registration. Serve LP end users through the LP Portal endpoints instead, or proxy their requests server-side with your own credential.

Rendering counts as a write operation. A recipient with read access can download an already-rendered statement through GET /output/{filename}, but cannot trigger a new render.

Resource model

lp_report                       one fund report, identified by report_id (uuid)
├── portfolio_id                the Renesis portfolio that supplies NAV, balances, transactions
├── configuration               fund identity, reporting period, strategies, fees, content, branding
├── sharing.email_addresses     read-only recipients
└── rendered output             HTML statements produced by /render

One report maps to exactly one portfolio. The portfolio is the LP scope: if a manager runs several LP mandates, each mandate gets its own portfolio and its own report.

Response format

Every JSON endpoint on this service returns an ok boolean alongside its payload:

{
  "ok": true,
  "config": { }
}

Errors carry the same envelope with a message:

{
  "ok": false,
  "error": "report not found"
}

The role and access gates predate this envelope and answer in the platform-wide shape instead:

{
  "isError": true,
  "message": "No access to report!",
  "statusCode": 403
}

Treat a non-2xx status as the signal; parse error or message, whichever is present. The LP Portal endpoints use the isError envelope throughout.

Status codes

Code	Meaning
`200`	Success
`201`	Created (`POST /api/funds`, `POST /api/templates`)
`400`	Malformed body or a missing required field. Note that unknown configuration keys are not rejected, see below.
`401`	Missing, expired, or role-deficient credential
`403`	Authenticated, but no access to this report
`404`	Report, template, or rendered file not found
`422`	`POST /render-preview` or `POST /computed` rejected the input (text budget, sign-colour validation, malformed `config_overrides`)
`500`	Server fault, or a render-time validation failure on `POST /render`, which has no 422 path
`503`	A dependency is unavailable: an unverifiable API key at the gateway, or PDF rendering on an environment that does not have it yet. Retry rather than changing the request.

Silence is the default failure mode on writes. PUT /config drops unknown and unwritable keys without error, and clamps over-long text without error, returning 200 either way. A typo in a field name looks exactly like a successful save. Always compare the echoed config in the response against what you sent. See Configuration.

Quickstart

Discover a report, read its numbers, render the statement.

export API_KEY="ak_xxxxxxxxxxxxxxxxxxxx"
export BASE="https://api.renesis.fi/lp-report-studio"

# 1) List the reports this key can see.
#    The list rows are raw storage records: the display name is `report_name`.
curl -s -H "X-API-Key: $API_KEY" "$BASE/api/funds" \
  | jq '.reports[] | {id: .id, name: .report_name}'

export REPORT_ID="fb161519-6c91-4317-87f0-2ac092b0db80"

# 2) Read the configuration (normalized shape, name lives at identity.name)
curl -s -H "X-API-Key: $API_KEY" "$BASE/api/funds/$REPORT_ID/config" | jq '.config'

# 3) Read the computed numbers for a period
curl -s -H "X-API-Key: $API_KEY" \
  "$BASE/api/funds/$REPORT_ID/computed?period_start=2026-01-01&period_end=2026-03-31" \
  | jq '{aum: .fund.total_aum, returns, risk}'

# Or build against the sample fund first, before your own data is ready:
curl -s -H "X-API-Key: $API_KEY" "$BASE/api/demo/computed" | jq '.fund'

# 4) Render the statement
curl -s -X POST -H "X-API-Key: $API_KEY" -H "Content-Type: application/json" \
  "$BASE/api/funds/$REPORT_ID/render" \
  -d '{"period":"Q1 2026","period_start":"2026-01-01","period_end":"2026-03-31"}' | jq

Health

GET /healthz

Public, no authentication.

{ "ok": true, "pg": true, "mongo": true }

Key your uptime check on the pg and mongo booleans. The top-level ok is always true and does not reflect dependency health.

Configuration

Create reports, read and patch the unified config, upload logos, detect vault strategies, reuse templates. Includes the validation rules that are not enforced for you.

Computed metrics

The full JSON shape behind every number on the statement, with sign, null, and unit semantics. Build dashboards against this.

Rendering

Render the statement, preview unsaved edits, download the output, and handle render-time validation failures.

Position Groups

Group raw positions into named strategies, and read their combined value, P&L and history.

Portfolio NAV

Pull a portfolio’s current NAV as one number, in your chosen currency, for scheduled pulls and on-chain publishing.

LP Portal

Per-investor endpoints: investors, capital events, share accounting, and the endpoints an LP user can call directly.

Getting Started

Methodology

API Reference

LP Reporting API

Introduction

Base URL

Authentication

Gateway rejections

Permissions

Resource model

Response format

Status codes

Quickstart

Health

Configuration

Computed metrics

Rendering

Position Groups

Portfolio NAV

LP Portal

​Introduction

​Base URL

​Authentication

​Gateway rejections

​Permissions

​Resource model

​Response format

​Status codes

​Quickstart

​Health

Configuration

Computed metrics

Rendering

Position Groups

Portfolio NAV

LP Portal

Introduction

Base URL

Authentication

Gateway rejections

Permissions

Resource model

Response format

Status codes

Quickstart

Health