Fundrise Authentication API

### Getting access To get started, please contact the support team via connect@fundrise.com.### Terminology - Client: This refers to an End-User or customer that a Partner onboards onto Fundrise for investing in Fundrise assets. - Partner: This refers to a company working with Fundrise to provide their End-Users or customers access to Fundrise assets.### Access issuesTo ensure a safe, secure platform, Fundrise imposes strict access controls to all APIs. As such, there may be services or capabilities documented that are inaccessible with current permissions. Contact the support team via connect@fundrise.com to gain permissions for additional endpoints or to receive customized support for specific issues or concerns.### Security ModelsFundrise's API supports two different HTTP security schemes:- PartnerBasicAuthentication- ClientBearerAuthenticationThe appropriate security scheme per endpoint is identified in the documentation. PartnerBasicAuthentication and ClientBearerAuthentication use values that should be treated as sensitive data. Fundrise requires encrypted storage of these values with necessary controls to limit access. All information returned must be treated in full compliance to the end-user agreements.#### PartnerBasicAuthentication Access an endpoint using Partner credentials in HTTP Header. PartnerBasicAuthentication is enforced by HTTP Basic Authentication. A Partner username and password will be provided by Fundrise support. The Partner password should be stored securely. At a minimum, it should be encrypted at-rest and access restricted to services making requests to the Fundrise API. The Partner password should not be exposed to a Client or any of their devices. If the password is compromised please contact Fundrise support.#### ClientBearerAuthentication Access an endpoint using an OAuth access token associated with a specific Client. ClientBearerAuthentication is enforced by HTTP Bearer Authentication and requires an OAuth access token. Since access tokens are scoped to specific Clients, they identify and authenticate the Client in a request. Access tokens can be obtained in Get Access Token requests by using the refresh token flow. OAuth refresh token are issued on Client Creation and scoped specifically to that Client. The refresh tokens will not expire and should be stored securely after Client creation. At a minimum, refresh tokens should be encrypted at-rest and access restricted to services making requests to the Fundrise API. Refresh tokens should not be exposed to a Client or any of their devices.