Getting a Xantos client's holdings and statements out of the app

Behind a Xantos login sits a hand-picked book of US equities — the company describes it as up to around thirty names — together with monthly account statements and downloadable tax documents. Those records are a client's slice of a brokerage account custodied at Alpaca Securities, a FINRA/SIPC member as the app's own disclosures state, surfaced through the Xantos mobile client and portal. The integration question is narrow and answerable: get that book, those balances and those documents into a system, with the account holder's permission, in a structured form a program can read.

Bottom line: the data is well defined and account-bound, the adviser and custodian are both US-regulated, and there is a documented file export that doubles as a correctness check. We map the app's authenticated surfaces under the client's consent and reconcile the result against that export.

What account data Xantos holds

Each row below is a real surface a Xantos user sees, where it comes from inside the app, how fine-grained it is, and what an integrator does with it.

Getting to the data: the routes that fit Xantos

Consented interface integration of the app and portal

We analyze the authenticated traffic between the Xantos client and its backend under the account holder's authorization, then implement against the login, session and document surfaces. Reachable: holdings, balances, transfer history, the statement and tax-document lists, fee debits. Effort is moderate; durability tracks the app's release cadence, which we plan for. Access is arranged with you during onboarding — we stand up a consenting test account and work from it.

The documented native export

Xantos publishes a help-centre procedure for exporting transaction and deposit/withdrawal history for tax reporting. Reachable: a transaction and funding file on the client's manual cadence. Effort is low and durability high, but it is coarse and batch. It earns its place as the reconciliation oracle, not the live feed.

User-consented scheduled sync

The same surfaces as the first route, run on a schedule under recorded, revocable consent. We design the cadence around when statements and tax forms actually post rather than polling blindly.

For most teams the working spine is the consented interface integration: it returns current holdings and statement metadata in structured form, while the documented export is the independent check that proves the numbers agree. The scheduled sync is the same build with a clock and a consent record on it.

A worked example: a Xantos portfolio pull

Illustrative only — exact paths, field names and the token shape are confirmed during the build against a consenting account, not asserted here.

# 1. Establish an authenticated session for the consenting client
POST /auth/session
  { "email": "<client>", "secret": "<client-supplied>" }
  -> 200 { "access_token": "...", "expires_in": 3600,
           "refresh_token": "..." }

# 2. Current managed holdings (the ~30-name book)
GET /v1/accounts/me/positions
  Authorization: Bearer <access_token>
  -> 200 [
       { "symbol": "AAPL", "qty": "4.213",
         "avg_entry": "172.40", "market_value": "...",
         "weight": "0.061" }, ... ]

# 3. Statement and tax-document index
GET /v1/accounts/me/documents?type=statement,tax
  -> 200 [ { "id": "...", "kind": "monthly_statement",
             "period": "2026-04", "url": "..." } ]

# Handling notes the delivered client implements:
#  - 401 -> refresh once via refresh_token, then re-auth
#  - statement/tax docs are custodial output (Alpaca format);
#    parsers are written to that layout
#  - pull on month-end / tax-season cadence, not by polling
      

What lands in your repo

Tied to the surfaces above, not a generic checklist:

• An OpenAPI description of the Xantos surfaces we map — positions, account value, transfers, the document index, fee debits.
• An auth-flow report: the login, session-token and refresh chain as it behaves in the Xantos client, with the failure paths.
• Runnable Python and Node.js clients for the portfolio, statement and tax-document pulls, ready to drop into a job.
• A pytest suite that includes a reconciliation test: structured pull versus the documented export, asserting they agree.
• Interface documentation and Regulation S-P-aligned guidance on consent records, data minimization and retention.

Where Xantos sits with the SEC and Reg S-P

Xantos Labs LLC is an SEC-registered investment adviser per the SEC's IAPD adviser record, so it owes clients a fiduciary duty and the client account is squarely the adviser's responsibility. That client data is "customer information" under Regulation S-P, the SEC's privacy and safeguarding rule under Gramm-Leach-Bliley, which the SEC amended in 2024 with phased compliance dates running into 2025 and mid-2026 for smaller advisers, per the SEC's amendment. Custody and the statement and tax-form formats come from Alpaca Securities, a FINRA/SIPC member as Xantos's disclosures state, so the document layouts follow Alpaca's custodial output. We work only from the account holder's recorded consent, scope it to the records the client asked for, log access, minimize personal fields, and sign an NDA where required. Consent is revocable and the sync stops when it is revoked.

Engineering realities we handle on Xantos

• The Xantos / Alpaca boundary. The app blends an advisory layer (the model, the roughly thirty-name selection, the 1% monthly fee accrual) with a custodial ledger (settled positions, statements, tax forms). We label each field by origin so a downstream reconciliation lines up instead of double counting the same dollar.
• Session lifetime. Xantos sessions expire. We design the scheduled pull around the token-refresh window and raise a re-consent prompt before it lapses, so a feed does not quietly go stale between statement cycles.
• Front-end drift. The app ships updates. We add a front-end-change check to the maintenance pass, so a redesigned statements or documents screen is caught and the client patched before the feed breaks.
• Document cadence. Statements post monthly and tax forms once a year. We schedule pulls to those events rather than polling, which keeps call volume — and pay-per-call cost — low.

Three integrations teams ask us for

• A wealth-aggregation app folding a client's Xantos-managed balance and holdings into a single net-worth view alongside their other accounts.
• A tax-prep tool that ingests the year-end Xantos composite tax form automatically instead of asking the client to upload a PDF.
• An RIA-operations dashboard that reconciles the monthly Xantos advisory-fee debit against the custodial ledger and flags mismatches.

The app screens this maps to

Public store screenshots of Xantos — the portfolio, account and document surfaces named above. Select to enlarge.

Sources and the check behind this

Mapped on 16 May 2026 from primary material: the SEC IAPD adviser record for Xantos Labs LLC, Alpaca's own account of running Xantos on its Broker API, the Xantos help-centre export procedure, and the SEC's 2024 Regulation S-P amendment. Surface names follow how the app presents them; identifiers and figures are attributed inline rather than asserted bare.

• SEC IAPD — Xantos Labs, LLC adviser record
• Alpaca — Xantos Labs on the Alpaca Broker API
• Xantos Help Center — exporting transaction & deposit/withdrawal history
• SEC Regulation S-P amendment (Federal Register, 2024)

Compiled by the OpenBanking Studio integration desk · May 2026.

Where Xantos sits among managed-investing apps

Same-category apps an integrator often has to cover alongside Xantos. Plain ecosystem context, not a ranking.

• Betterment — managed ETF portfolios with goals, balances and tax-loss-harvesting records behind an account; similar holdings-and-statement shape to unify.
• Wealthfront — automated portfolios, cash and lending data per user; comparable account and document surfaces.
• Acorns — round-up-funded portfolios with transaction-linked contributions; funding history is the data-heavy part.
• Stash — goal-based portfolios with scheduled deposits and per-position holdings to reconcile.
• M1 Finance — custom "pie" portfolios with rebalancing and cash-position records.
• SoFi Invest — auto-investing and self-directed trades sitting next to banking and tracking data in one account.
• Public — multi-asset self-directed holdings, bonds and options with account statements.
• Titan — actively managed strategies with performance and fee records behind a login.

Questions integrators ask about Xantos

Can you separate what Xantos manages from what Alpaca holds as custodian?

Yes. The app shows a client's slice of an Alpaca-custodied brokerage account. We map which fields originate in the Xantos advisory layer — the model weights, the roughly thirty-name selection, the monthly advisory-fee accrual — and which come off the custodial ledger — settled positions, statements, tax forms — so a reconciliation across the two lines up rather than double counts.

Does the documented Xantos transaction export remove the need for an interface integration?

It covers part of it. Xantos documents an export of transaction and deposit/withdrawal history for tax reporting, which is a good batch fallback and a reconciliation oracle. It is coarse and on the client's manual cadence, so for current holdings, balances and statement metadata on a schedule we still build the consented interface integration and use the export to prove the figures match.

Which US rules govern pulling a client's Xantos records?

Xantos Labs LLC is an SEC-registered investment adviser per the SEC IAPD adviser record and owes its clients a fiduciary duty. The client data is customer information under Regulation S-P, the SEC privacy and safeguarding rule, which the SEC amended in 2024 with phased compliance dates. We work only from the account holder's recorded consent, minimize personal data, log every access and sign an NDA where the client needs one.

If we only need periodic statement and tax-doc pulls from Xantos, what is the lighter path?

Statements post monthly and tax forms once a year, so the hosted pay-per-call endpoint usually fits that shape — you call it when a document posts and pay for those calls only. Heavier or embedded use, or anything that needs the live holdings feed, tends to favour taking the source. We size both against your expected volume before you commit.

Working with us

Most Xantos builds — the consented holdings, statement and tax-document pull, with its OpenAPI description, runnable Python or Node.js source, the reconciliation tests and interface docs — ship in one to two weeks. Take it as delivered source for those endpoints, billed from $300 and paid only after delivery once you have checked it works against a consenting account; or call our hosted endpoints and pay per call with nothing upfront. You bring the app name and what you need from its data; access and the compliance paperwork are arranged with you as part of the work. Start the conversation at /contact.html.