# ByAllAccounts API: access, auth, sandbox and MCP (checked Oct 2026)

> ByAllAccounts, a Morningstar product, documents its investor and advisor account aggregation APIs publicly, but credentials and a DEV Firm ID are issued only after contracting. It offers a REST API with embedded OpenAPI 3.0.1 definitions, a DataConnect XML API, UI components and a Postman collection.

- Vendor: Morningstar (Morningstar, Inc.)
- Website: https://developers.byallaccounts.morningstar.com/
- Category: Account aggregation (adjacent)
- API access: Partner-gated
- Last checked: 2026-10-17
- Id: `byallaccounts` · JSON: https://wealthtech.dev/products/byallaccounts.json

## Developer surface

| Field | Value | Source and quote | Checked |
|---|---|---|---|
| API access | Partner-gated | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/docs/1-access.md) "Upon contracting, your assigned ByAllAccounts Implementation Manager will kick off the project." | 2026-10-17 |
| Developer docs | https://developers.byallaccounts.morningstar.com/ | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/) "Here you'll find everything you need to seamlessly integrate account aggregation into your platform, including comprehensive integration guides and API references." | 2026-10-17 |
| API style | REST, Bulk XML, Files over SFTP | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/docs/connect-suite.md) "\| [DataConnect XML API](https://www.byallaccounts.net/Manuals/DataConnect/DataConnect_V4_Ultra_User_Guide.PDF) \| API \| This API supports a wide variety of user registration, authentication, and data extraction operations across all user types." | 2026-10-17 |
| Authentication | Partner credentials | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/docs/3-authenticate-users.md) "Invoke a DataConnect API `<SESSIONAUTHRQ>` request, providing your Administrator credentials" | 2026-10-17 |
| How to get access | Contract with ByAllAccounts; an Implementation Manager then configures access and issues Firm IDs for PROD and DEV plus administrator credentials. | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/docs/1-access.md) "They will then configure your access to the ByAllAccounts platform." | 2026-10-17 |
| Sandbox | Yes, on request | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/docs/1-access.md) "**ByAllAccounts Firm IDs for PROD and DEV** licensed to use the Connect Suite" | 2026-10-17 |
| Rate limits | Not found | Not found. No rate limits found on the Connect development guide, REST API landing page or endpoint reference pages read. No rate limits found on the Connect development guide, REST API landing page or endpoint reference pages read. | 2026-10-17 |
| Webhooks | Not found | Not found. No webhooks found. The Connect Suite docs describe critical component events handled in the parent web page ('7. Manage Critical Events'), not server webhooks. No webhooks found. The Connect Suite docs describe critical component events handled in the parent web page ('7. Manage Critical Events'), not server webhooks. | 2026-10-17 |
| SDKs | UI components (W3C custom HTML elements), Postman collection | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/docs/connect-suite.md) "W3C custom HTML element" | 2026-10-17 |
| OpenAPI spec | Published | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/reference/getpositionsusingget-1.md) ""openapi": "3.0.1"" | 2026-10-17 |
| Partner program | Not found | Not found. No partner program page found on the developer hub pages read. No partner program page found on the developer hub pages read. | 2026-10-17 |
| Public integration list | https://developers.byallaccounts.morningstar.com/llms.txt | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/llms.txt) "## Documentation: Advisor Feed Onboarding Hub" | 2026-10-17 |
| Ways to connect | Native API, File exchange | Checked on the source's own page. [developers.byallaccounts.morningstar.com](https://developers.byallaccounts.morningstar.com/docs/connect-suite.md) "The Connect Suite supports two distinct user types: investors, who link their own accounts, and advisors, who link their managed/book of business accounts." | 2026-10-17 |

## MCP servers and AI connectors

None recorded on public pages we checked.

## What the docs don't say

- No rate limits are stated on the pages read.
- The REST API reference covers four endpoints (persons create/delete, positions, transactions); the guide says DataConnect XML operations are also needed for the investor aggregation workflow.
- The embedded OpenAPI definition's server URL is //basrvqaap6001.morningstar.com/WPDemo/webportfolio/api/v1; no production base URL is stated on the pages read.
- The www.morningstar.com product page for ByAllAccounts returned a human-verification page (HTTP 202) to automated reading, so product claims there were not captured.

## Changes

No changes recorded since this record was first published.
---
Source: https://wealthtech.dev/products/byallaccounts · Facts licensed CC BY 4.0 (attribution "wealthtech.dev"). Every fact states where it was checked and when; check the source before relying on it.