Finmind HTTP API

Without a login

Public endpoints

These answer any caller. They are cached on the server for ten minutes and sent with a public Cache-Control header, so a client may cache them too. When the source read fails they answer 503 with a Retry-After header rather than a stale or empty body.

Money and prices are JSON strings holding exact decimals, never floats. A trade_date is the exchange session day the stored close belongs to; a change is measured against the previous stored session, which for a thin share may be weeks earlier. Disclosures carry published_at in UTC and published_date on the Tashkent calendar.

Try it

Three requests that work today

Each example was run against production on 2026-09-26; the output shown is abridged to the fields named.

curl -s https://finmind.uz/api/v1/public/market/instruments/

{"as_of": "2026-09-25",
 "stocks": [{"ticker": "AGBA", "isin": "UZ7001560000", "name": "Agrobank ATB",
             "share_class": "common", "sector": "Financials",
             "last": "589", "change_pct": "-0.17", "trade_date": "2026-09-25"}, ...],
 "bonds":  [{"isin": "UZ6057687AE6", "ticker": "BFMT2B5",
             "coupon_rate_pct": "27", "maturity_date": "2028-01-20",
             "currency": "UZS", "last": "123998", "trade_date": "2026-09-25"}, ...]}

curl -s https://finmind.uz/api/v1/public/market/stocks/AGBA/

{"kind": "stock", "ticker": "AGBA", "isin": "UZ7001560000", "name": "Agrobank ATB",
 "currency": "UZS", "exchange": "UZSE",
 "issuer": {"sector": "Financials", "sub_industry": "Diversified Banks", ...},
 "quote": {"last": "589", "prev_close": "590", "change": "-1", "change_pct": "-0.17",
           "open": "609", "high": "609", "low": "589", "volume": "28615",
           "trade_date": "2026-09-25", "prev_trade_date": "2026-09-24"},
 "history": [..., {"date": "2026-09-25", "close": "589"}],
 "fundamentals": {...}, "disclosures": [...], "other_share_classes": [...]}

curl -s https://finmind.uz/api/v1/public/market/bonds/UZ6057687AE6/

{"kind": "bond", "isin": "UZ6057687AE6", "ticker": "BFMT2B5",
 "issuer": "BIZNES FINANS MIKROMOLIYA TASHKILOTI MChJ",
 "face_value": "100000", "coupon_rate_pct": "27", "coupon_frequency_per_year": 12,
 "issue_date": "2026-01-28", "maturity_date": "2028-01-20", "matured": false,
 "quote": {"last": "123998", "prev_close": "120000", "change_pct": "3.33",
           "trade_date": "2026-09-25", "prev_trade_date": "2026-09-24"},
 "history": [...], "disclosures": [...]}

Signed in

Authentication and entitlements

Every other endpoint needs a JSON Web Token obtained with a Finmind account's email and password. The token carries the person's own entitlements: an endpoint behind a paid feature answers 401 without a token and 403 with the code feature_locked when the Finmind account does not hold that feature. The free areas of the catalogue (the order book, learning) need only the token, and the tools of the Essentials plan, such as the portfolio, need that plan.

curl -s -X POST https://finmind.uz/api/v1/auth/token/ \
  -H 'Content-Type: application/json' \
  -d '{"email": "you@example.com", "password": "..."}'
# {"refresh": "...", "access": "..."}

curl -s https://finmind.uz/api/v1/portfolio/ \
  -H 'Authorization: Bearer <access>'

Access token

Valid 30 minutes. Sent as an Authorization: Bearer header.

Refresh token

Valid 7 days. POST it to /api/v1/auth/token/refresh/; each refresh returns a new pair and retires the old one.

Two-factor Finmind accounts

The first call answers twofa_required with a challenge instead of a token; the schema documents the second step.

Sign out

POST the refresh token to /api/v1/auth/logout/ to retire it.

For organisations

Organisation API keys

An organisation account (a fund, an insurer, a bank treasury) can give its own systems API keys. Owners and admins create them in the organisation's workspace, each with the scopes it needs, after confirming it is them. A key belongs to the organisation, not to a person, and it opens only that organisation's endpoints: never a person's own data, never another organisation's, never the members, keys or agreement.

curl -s https://finmind.uz/api/v1/orgs/<organisation>/market/instruments/ \
  -H 'Authorization: Api-Key fm_org_<prefix>_<secret>'

Shown once

The full key is shown once, when it is created. Finmind stores only a SHA-256 fingerprint of its secret and cannot show it again.

Expiry

90 days unless chosen otherwise, 365 days at most. Up to 20 working keys per organisation.

Rate limit

120 requests per minute for all of an organisation's keys together, and for each key, unless the contract says more; market data also keeps the public limit of 600 per minute, counted per organisation. A limited call answers 429 with a Retry-After header.

When a key stops working

Revoked, expired, the organisation suspended or closed, or its agreement no longer including API access: the answer is 401 with a code that says which. Revoked keys stay listed; nothing deletes one.

Market data through a key or in an export is for the organisation's internal use only and may not be redistributed; every answer carries a data_licence object naming the sources (uzse.uz, openinfo.uz, cbu.uz). The organisation's own positions and transactions are its own without that limit. Every import and every export is recorded on the organisation's audit log.

Limits

Rate limits, paging and versioning

These endpoints carry their own rate limits, counted per client address; there is no single limit shared across them. A limited call answers 429 with a Retry-After header.

Lists are paged with page and page_size (50 by default, 500 at most). One version prefix, /api/v1, is served; a breaking change would arrive under a new prefix.

Stated plainly

What is not offered yet

• No personal API keys. A person's token is their own Finmind sign-in, valid for their own data and entitlements. API keys exist for organisation accounts only, and never open a person's own data.
• No browser calls from other websites. CORS allows finmind.uz only, so a page on another domain cannot call the API from the visitor's browser; a server, a script or a notebook can.
• No live quotes. Prices are the exchange's daily closes as stored; each carries the session day it belongs to, and a figure the source does not publish is null, never zero.
• No published deprecation policy yet. There is one version prefix and the schema states its version; we would rather say that than promise a policy we have not written.

Terms of use

Using the data

The API is covered by the terms of service. Personal use, research and a tool for your own investing are welcome. Bulk download, resale or redistribution of the data needs our written permission first: write to finmind_support@protonmail.com and say what you are building. Name the sources when you publish figures: the prices are the exchange's (uzse.uz) and the company facts and disclosures are openinfo.uz's, both read by Finmind.

Machine-readable neighbours: the disclosures feed at /feeds/disclosures.xml, the sitemap, and /llms.txt for language models.