{ "page": "https://wealthtech.dev/products/byallaccounts", "title": "ByAllAccounts API: access, auth, sandbox and MCP (checked Oct 2026)", "description": "ByAllAccounts, a Morningstar product, documents its investor and advisor account aggregation APIs publicly, but credentials and a DEV Firm ID are issued only after contracting. It offers a REST API with embedded OpenAPI 3.0.1 definitions, a DataConnect XML API, UI components and a Postman collection.", "updated": "2026-10-17", "data": { "$schema": "https://wealthtech.dev/schema/product.schema.json", "url": "https://wealthtech.dev/products/byallaccounts", "title": "ByAllAccounts API: access, auth, sandbox and MCP (checked Oct 2026)", "lastChecked": "2026-10-17", "id": "byallaccounts", "name": "ByAllAccounts", "vendor": "Morningstar", "website": "https://developers.byallaccounts.morningstar.com/", "category": "aggregation", "tier": "adjacent", "company": "morningstar", "listed": true, "access": { "value": "partner-gated", "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/docs/1-access.md", "evidence": "Upon contracting, your assigned ByAllAccounts Implementation Manager will kick off the project.", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-docs-1-access-md.txt", "note": "Docs are public; credentials (Firm IDs for PROD and DEV, DataConnect administrator credentials) are issued after contracting and a signed Statement of Work." }, "docsUrl": { "value": "https://developers.byallaccounts.morningstar.com/", "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/", "evidence": "Here you'll find everything you need to seamlessly integrate account aggregation into your platform, including comprehensive integration guides and API references.", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com.txt", "note": null }, "style": { "value": [ "rest", "bulk-xml", "file-sftp" ], "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/docs/connect-suite.md", "evidence": "| [DataConnect XML API](https://www.byallaccounts.net/Manuals/DataConnect/DataConnect_V4_Ultra_User_Guide.PDF) | API | This API supports a wide variety of user registration, authentication, and data extraction operations across all user types.", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-docs-connect-suite-md.txt", "note": "REST API for investor aggregation plus a DataConnect XML API. The Advisor Feed Onboarding Hub lists many custodian SFTP/FTP feeds (llms.txt capture). 'bulk-xml' is the closest enum value for DataConnect XML requests." }, "auth": { "value": [ "partner-credentials" ], "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/docs/3-authenticate-users.md", "evidence": "Invoke a DataConnect API `` request, providing your Administrator credentials", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-docs-3-authenticate-users-md.txt", "note": "Administrator credentials authenticate a session; the response gives jsessionId and csrfToken. The REST OpenAPI definition declares an apiKey security scheme in the Authorization header." }, "howToGetAccess": { "value": "Contract with ByAllAccounts; an Implementation Manager then configures access and issues Firm IDs for PROD and DEV plus administrator credentials.", "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/docs/1-access.md", "evidence": "They will then configure your access to the ByAllAccounts platform.", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-docs-1-access-md.txt", "note": null }, "sandbox": { "value": "yes-on-request", "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/docs/1-access.md", "evidence": "**ByAllAccounts Firm IDs for PROD and DEV** licensed to use the Connect Suite", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-docs-1-access-md.txt", "note": "A DEV Firm ID comes with project set-up after contracting. The test-accounts page lists test financial institutions for simulating account linking." }, "rateLimits": { "value": null, "state": "unknown", "checked": "2026-10-17", "note": "No rate limits found on the Connect development guide, REST API landing page or endpoint reference pages read." }, "webhooks": { "value": null, "state": "unknown", "checked": "2026-10-17", "note": "No webhooks found. The Connect Suite docs describe critical component events handled in the parent web page ('7. Manage Critical Events'), not server webhooks." }, "sdks": { "value": [ "UI components (W3C custom HTML elements)", "Postman collection" ], "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/docs/connect-suite.md", "evidence": "W3C custom HTML element", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-docs-connect-suite-md.txt", "note": "Account Linking and Account Summary UI components; no language SDKs found. A Postman collection is published." }, "openapi": { "value": "published", "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/reference/getpositionsusingget-1.md", "evidence": "\"openapi\": \"3.0.1\"", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-reference-getpositionsusingget-1-md.txt", "note": "Each REST endpoint page embeds its OpenAPI 3.0.1 definition; no single downloadable spec file link was found on the pages read." }, "partnerProgram": { "value": null, "state": "unknown", "checked": "2026-10-17", "note": "No partner program page found on the developer hub pages read." }, "publicIntegrationList": { "value": "https://developers.byallaccounts.morningstar.com/llms.txt", "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/llms.txt", "evidence": "## Documentation: Advisor Feed Onboarding Hub", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-llms-txt.txt", "note": "The hub lists custodian feed onboarding pages with FI IDs (for example Altruist - SFTP Access, Charles Schwab Institutional - SFTP). This is a list of feed sources, not a partner directory." }, "connectionMechanisms": { "value": [ "native-api", "file" ], "state": "verified", "checked": "2026-10-17", "source": "vendor", "url": "https://developers.byallaccounts.morningstar.com/docs/connect-suite.md", "evidence": "The Connect Suite supports two distinct user types: investors, who link their own accounts, and advisors, who link their managed/book of business accounts.", "capture": "evidence/byallaccounts/developers-byallaccounts-morningstar-com-docs-connect-suite-md.txt", "note": null }, "mcp": [], "whatDocsDontSay": [ "No rate limits are stated on the pages read.", "The REST API reference covers four endpoints (persons create/delete, positions, transactions); the guide says DataConnect XML operations are also needed for the investor aggregation workflow.", "The embedded OpenAPI definition's server URL is //basrvqaap6001.morningstar.com/WPDemo/webportfolio/api/v1; no production base URL is stated on the pages read.", "The www.morningstar.com product page for ByAllAccounts returned a human-verification page (HTTP 202) to automated reading, so product claims there were not captured." ], "changelog": [], "summary": "ByAllAccounts, a Morningstar product, documents its investor and advisor account aggregation APIs publicly, but credentials and a DEV Firm ID are issued only after contracting. It offers a REST API with embedded OpenAPI 3.0.1 definitions, a DataConnect XML API, UI components and a Postman collection.", "license": "CC BY 4.0", "attribution": "wealthtech.dev", "publisher": "wealthtech.dev" } }