Skip to main content
Version: v5

REST API

Every command available on obb is also a route of a FastAPI app, openbb_core.api.rest_api:app, built from the same installed extensions. You can serve that app with the openbb-api launcher or with any ASGI server.

Start the server​

Install the launcher and at least one provider:

pip install openbb-platform-api openbb-cboe

Then start it:

openbb-api

openbb-api binds to 127.0.0.1:6900 and moves to the next free port if 6900 is taken. Next to the command routes it serves a landing page at / and the widgets.json, apps.json, and agents.json files that OpenBB Workspace reads; the Workspace quickstart covers that side. The openbb-api reference lists every launcher flag.

The app itself needs only openbb-core, so any ASGI server can run it. With uvicorn, which openbb-core installs, it listens on uvicorn's default 127.0.0.1:8000:

uvicorn openbb_core.api.rest_api:app

Make a request​

Routes live under the /api/v1 prefix and mirror the Python path: obb.cboe.equity.quote becomes GET /api/v1/cboe/equity/quote, and keyword arguments become query parameters.

curl "http://127.0.0.1:6900/api/v1/cboe/equity/quote?symbol=AAPL&provider=cboe"

The response body is the serialized OBBject, with the rows under results:

import requests

response = requests.get(
    "http://127.0.0.1:6900/api/v1/cboe/equity/quote",
    params={"symbol": "AAPL", "provider": "cboe"},
    timeout=30,
)
response.raise_for_status()
rows = response.json()["results"]

Interactive documentation is at /docs (Swagger UI) and /redoc, and the OpenAPI schema is at /openapi.json.

Listen on the network​

Bind to 0.0.0.0 inside a container or to accept connections from other machines:

openbb-api --host 0.0.0.0 --port 6900

The same values can come from the OPENBB_API_HOST and OPENBB_API_PORT environment variables, or from a [launcher] table in openbb.toml:

[launcher]
host = "0.0.0.0"
port = 6900

openbb-api looks for openbb.toml in ~/.openbb_platform/ and in the working directory and its parents, and --config-file PATH adds one more file on top. Command-line flags override the file. See openbb.toml for the full lookup order and the [system] table.

Require a login​

The API accepts every request by default. Set three environment variables before starting the server to require HTTP Basic authentication on the command routes:

VariableValue
OPENBB_API_AUTHtrue
OPENBB_API_USERNAMEThe username clients must send
OPENBB_API_PASSWORDThe password clients must send

The variables can also go in ~/.openbb_platform/.env, which is loaded at startup. Clients then send a standard Authorization: Basic header, which requests builds from a tuple:

import requests

response = requests.get(
    "http://127.0.0.1:6900/api/v1/cboe/equity/quote",
    params={"symbol": "AAPL", "provider": "cboe"},
    auth=("my_user", "my_password"),
    timeout=30,
)

Requests with a missing or wrong password get 401 Unauthorized. Data provider keys are separate from this login; the server reads them from its own credentials.

warning

Basic authentication sends the password on every request. Outside localhost, serve the API over HTTPS.

Restrict CORS​

The API allows every origin, method, and header by default. That suits local development; for a server reachable from the internet, list the allowed origins under api_settings.cors in ~/.openbb_platform/system_settings.json, which both openbb-api and the bare app read at startup:

{
  "api_settings": {
    "cors": {
      "allow_origins": ["https://pro.openbb.co"],
      "allow_methods": ["GET", "POST"],
      "allow_headers": ["*"]
    }
  }
}

openbb-api also accepts the same fields in openbb.toml. The bare uvicorn command does not read openbb.toml.

[system.api_settings.cors]
allow_origins = ["https://pro.openbb.co"]
allow_methods = ["GET", "POST"]
allow_headers = ["*"]

Settings lists the other API settings.

Serve over HTTPS​

Pass a certificate and key to the server. openbb-api hands unrecognized flags to uvicorn.run as keyword arguments, so uvicorn options take underscores there:

openbb-api --ssl_certfile ./localhost.crt --ssl_keyfile ./localhost.key

With the uvicorn command, use its own hyphenated flags:

uvicorn openbb_core.api.rest_api:app --ssl-certfile ./localhost.crt --ssl-keyfile ./localhost.key

A self-signed certificate works for local use once the operating system or browser trusts it. ODP Desktop can generate one.

Next steps​

The Workspace quickstart connects the running server to OpenBB Workspace. The openbb-api reference covers the remaining launcher flags, the openbb.toml tables, custom apps, and .spec proxy mode. To give AI agents the same commands, continue with the MCP server quickstart.

On this page