One PAN to a whole portfolio, in three calls.
CAS Portfolio Fetch
A Consolidated Account Statement is the widest snapshot an Indian investor can get: every mutual-fund folio from CAMS and KFintech, every demat holding from NSDL and CDSL. Grappi splits it into the three things that actually happen. /v1/cas/request places the statement request with the RTA, returning the CAPTCHA the investor answers. /v1/cas/read finds the resulting mail over IMAP, decrypts the PDF and parses it into holdings and transactions. /v1/cas/import folds that into a portfolio keyed on ISIN, so next month's statement updates positions instead of duplicating them, with cost, gain and XIRR rolled up. Live use needs a verified business.
Endpoints
Every endpoint shares auth, idempotency, consent and metering hooks, a unified error envelope, and a hash-chained audit trail.
Which RTAs can be requested server-side today (KFintech yes; NSDL/CDSL need an investor OTP, so use the mailbox scan instead).
Opens a session with the RTA and returns the CAPTCHA image the investor must read. Free, because a misread CAPTCHA is a retry, not a service.
Submits the statement request with the CAPTCHA answer. The RTA then e-mails the password-protected CAS to the investor.
Opens the RTA session, solves its CAPTCHA (NopeCHA) and submits, retrying with a fresh session on a misread. One call, one price regardless of attempts. Needs NOPECHA_API_KEY.
Finds the RTA's mail over IMAP, pulls the attachment, decrypts and parses it. Billed per document parsed — an empty inbox is free. Use an app password.
Folds a parsed CAS into the portfolio: one stable key per position (so next month updates rather than duplicates), cost/value/gain rolled up, XIRR when available.
The latest imported CAS portfolio for this tenant.
How it works
From signup to a live CAS Portfolio Fetch call in four steps.
Create a free account
Sign up and get a prefunded sandbox key in seconds. No card required.
Unlock the rail
Grant the scope on a sandbox key instantly. Live use unlocks after business verification.
Make your first call
Send the sample request to /v1/cas/request/submit with your sandbox key and read back live JSON.
Go live
Swap the sandbox key for a live key. Every call is metered, itemized, and audit-chained.
Call 3.1 cas auto request — submit
The flagship call for this rail. Swap the sandbox key for your own and you are live.
Developer ready
Docs, MCP, and a prompt that does the work
Every rail ships with an integration guide, an MCP server for AI agents, and a ready-to-paste prompt, so your first CAS Portfolio Fetch call takes minutes, not days.
Integration guide
The quickstart covers keys, auth, idempotency, the error envelope, and paise money units. The catalog documents every CAS Portfolio Fetch endpoint with a live sample you can run from the playground.
MCP server for AI agents
grappi-mcp exposes the API as agent tools over the same gateway, so every tool call keeps auth, consent, metering, and audit. Drop this into your MCP client config.
{
"mcpServers": {
"grappi": {
"command": "npx",
"args": ["grappi-mcp"],
"env": {
"GRAPPI_API_BASE": "https://api.grappi.in",
"GRAPPI_API_KEY": "sk_sandbox_••••"
}
}
}
}Prompt-ready integration
Paste this into Claude, Cursor, or any coding agent. It carries the real contract rules, so the generated client matches the gateway on the first try.
Integrate the Grappi CAS Portfolio Fetch API into my app. Endpoints: - GET /v1/cas/request/providers (CAS provider matrix) - POST /v1/cas/request/session (3.1 CAS Auto Request — open session) - POST /v1/cas/request/submit (3.1 CAS Auto Request — submit) - POST /v1/cas/request/auto (3.1 CAS Auto Request — one call) - POST /v1/cas/read/mailbox/scan (3.2 CAS Auto Read — mailbox scan) - POST /v1/cas/import/document (3.3 CAS Auto Import — import parsed CAS) - GET /v1/cas/portfolio (3.3 CAS Auto Import — current portfolio) Contract rules: send the key as the x-api-key header, treat all money as integer paise (₹1.00 = 100), send an Idempotency-Key on every POST, and branch on the error envelope error.code (handle 402 insufficient_balance, 403 consent_required, 422 validation_failed, 429 rate_limited). Write a small typed client for these endpoints plus one worked call, with validation and error handling, in my project's language.
Frequently asked questions
Can I try it for free?
Yes. Signing up creates a sandbox key, so you can call this rail immediately without a card. Sandbox calls run against test data, not production.
What comes with every endpoint?
Auth, idempotency, consent and metering hooks, a unified error envelope, and a hash-chained audit trail — identical across every rail on the platform.
What do I need to go live?
Verified business. Grantable in sandbox, live use needs KYB. Once live, the same key and the same contract carry over from sandbox.
Is this compliant for regulated use?
Reads are consent-bound and DPDP and RBI-AA aligned. Every call lands in a hash-chained audit trail, and regulated rails stay locked until an access request is approved.
Related products
Other rails on the verified business tier.
Get started
Start building with CAS Portfolio Fetch
Create a free sandbox account, get a prefunded key, and call CAS Portfolio Fetch on the same contract as every other rail.
- Instant sandbox key, no card required
- One key works across every rail
- Open rails are live the moment you sign up