SDK lifecycle & generated clients

1. Create a least-privilege sandbox application in the Developer Console.
2. Keep the credential outside source control and load it from an environment variable or secret manager.
3. Use the API Explorer to validate the exact operation, path parameters, request body and required scope.
4. Use the SDK lifecycle manifest to verify package fingerprints and explicit OpenAPI contract attestation status.
5. Generate a cURL, JavaScript, Python or PHP starter for the exact operation without embedding credentials.
6. Inspect workspace-scoped request latency and failures in Developer Observability before requesting production access.
7. Request production access separately; application identity does not create model, policy or transaction authority.

curl

curl -X GET \
  -H "Authorization: Bearer $FINANCEGPT_API_KEY" \
  -H "Accept: application/json"
  "https://financegpt.dev/api/v2/investment/portfolios/{portfolio}/book/operations"

javascript

const response = await fetch("https:\/\/financegpt.dev\/api\/v2\/investment\/portfolios\/{portfolio}\/book\/operations", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${FINANCEGPT_API_KEY}`,
    Accept: 'application/json',
  },
});
const data = await response.json();

python

import json
import os
import requests

response = requests.request(
    'GET',
    'https://financegpt.dev/api/v2/investment/portfolios/{portfolio}/book/operations',
    headers={
        'Authorization': 'Bearer ' + os.environ['FINANCEGPT_API_KEY'],
        'Accept': 'application/json',
    },
)
response.raise_for_status()
print(response.json())

php

<?php
$ch = curl_init('https://financegpt.dev/api/v2/investment/portfolios/{portfolio}/book/operations');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer '.getenv('FINANCEGPT_API_KEY'),
        'Accept: application/json',
    ],
]);
$response = curl_exec($ch);
curl_close($ch);
echo $response;