You can now calculate return and risk metrics for an individual security, without needing a position in a portfolio. This lets you analyze how a security has behaved before adding it to a portfolio, or compare securities with each other.

The new endpoints, grouped under Security KPIs in the API reference, are:

• Read Security Time-Weighted Return: the security's TWR, with frequency, seriesType (PER_PERIOD or ACCUMULATED) and type (GROSS, the default, or GROSS_UP).
• Read Security Drawdown: the security's drawdown series, also with the type parameter.
• Read Security Volatility and Read Security Sharpe Ratio: annualized values, with frequency and calculateWindow, following the same methodology used for portfolios.

The return is calculated by simulating a single purchase of the security at the start of the period, with no contributions or redemptions, so it reflects only the security's price variation and its own events. To compare it with a portfolio's TWR, whose default is GROSS_UP, use the same return basis in both queries.

Learn more in Security Metrics.

You can now filter the transaction list by security type, for example, to fetch only the stock transactions of a portfolio without going through its entire history.

List Transactions and List Economic Group Transactions accept the new securityType parameter, a list of one or more security types (for example, STOCK_LOCAL). It accepts the same values as the securityType filter of the position endpoints and can be combined with the other filters, such as startDate, endDate, brokerId and type.

Example: GET /portfolios/{portfolioId}/transactions?securityType=STOCK_LOCAL.

Learn more about the available types in Security.

You can now query the volatility and the Sharpe ratio of portfolios and economic groups. These risk metrics complement the return analysis: they show how much the returns vary and how much return was obtained relative to the risk taken.

The new endpoints are Read Volatility, Read Sharpe Ratio, Read Economic Group Volatility and Read Economic Group Sharpe Ratio. Values are annualized, and the Sharpe ratio uses the CDI as the risk-free rate.

Each response returns the value for the requested period (interval) and a time series (timeseries). The main parameters are:

• frequency (required): DAILY, MONTHLY, YEARLY or INTERVAL.
• calculateWindow: the window of past returns used at each point: 3M, 6M, 12M (default), 24M or PER_FREQUENCY.
• startDate and endDate, plus filters by broker, security, asset class, security type and classification.

Learn more in Volatility and Sharpe Ratio.

You can now create investment profiles, target allocations defined by security classification, and check whether each portfolio's allocation complies with its profile.

An investment profile has a unique name, a list of classifications (classifications) whose percentages add up to 1, and optional compliance thresholds (thresholdLimits, default [5, 15]). Profiles are managed with Create Investment Profile, List Investment Profiles, Get Investment Profile By Id, Update Investment Profile and Delete Investment Profile.

To associate a profile with a portfolio, send investmentProfileId in Update Portfolio by ID; sending null removes the association. Portfolios now return the associated profile in the investmentProfile field.

Two new endpoints show the portfolio's target allocation compliance:

• Get Portfolio Target Allocation: for each classification in the profile, returns the target allocation (target), the actual allocation (allocation) and the difference between them (differential).
• Get Portfolio Positions Allocation: returns each position's weight in the portfolio's total exposure, with grouping (groupBy) and the investmentProfileRelation filter (ALL, IN or OUT) to see the positions inside or outside the profile.

Learn more in Investment Profile.

The security search now has an exact match option, useful when you already know the exact term, such as a ticker, and want to avoid partial results.

List Securities accepts the new searchExactMatch parameter (boolean, default false), used together with search. With searchExactMatch=true, partial matches are disabled and only securities that exactly match the searched term are returned. Without the parameter, the search keeps working as before, including partial matches.

Example: GET /securities?search=PETR4&searchExactMatch=true.

Learn more in Security.

Portfolios can now have their come-cotas calculated automatically. With this setting turned on, you no longer need to manually enter come-cotas for the funds subject to this tax.

The new boolean field autoComeCotas (default false) can be set in Create Portfolio and Update Portfolio by ID, and is returned by List Portfolios and Read Portfolio by ID.

{
  "autoComeCotas": true
}

With autoComeCotas set to true, Gorila calculates the come-cotas of all eligible funds in the portfolio and recalculates them whenever transactions are entered retroactively. If you manually register a come-cotas (a COME_COTAS transaction) on the correct date (the last business day of May and November), the manual entry prevails over the automatic one.

Learn more in the automatic come-cotas section of Portfolio.

You can now query the liquidity of portfolios and economic groups: how much of the market value can be converted into cash in each time range. This view helps you plan redemptions and analyze liquidity risk.

The Read Portfolio Liquidity and Read Economic Group Liquidity endpoints return the market value grouped into fixed day ranges (ranges): 0 to 1, 2 to 30, 31 to 180, 181 to 360, 361 to 720 and 721+ days, plus one range for securities whose liquidity is unavailable. Each range has minDays, maxDays and marketValue. In the 721+ range, maxDays is null; in the unavailable range, both limits are null.

For the breakdown by position, List Position Liquidity and List Economic Group Position Liquidity return each position's daysToLiquidity (null when liquidity is unavailable), with the usual security and broker filters.

All four endpoints accept the referenceDate parameter. Short positions are left out of both the aggregated calculation and the position listing.

Learn more in Liquidity.

GorilaCORE now accepts the new alphanumeric CNPJ format adopted by the Brazilian Federal Revenue Service, in addition to the current numeric CNPJs. This way, funds, issuers and brokers that receive a CNPJ in the new format can be identified normally in the API.

CNPJ fields and filters accept both formats, always with 14 characters and no punctuation, for example 12ABC34501DE35. This includes:

• issuerId in Read Issuer by ID and when creating banking bonds with Create Security;
• cnpj when creating investment clubs and managed funds, and when identifying a security by its CNPJ (for example, security.cnpj in Create Transaction);
• the securityCnpj filter in portfolio and economic group endpoints, such as List Positions;
• the brokerId filter (the broker's CNPJ).

Responses, such as those of List Securities, return cnpj and issuer in the same format, without punctuation. If your integration validates the CNPJ as a numeric-only value, update it to accept letters.

The new INITIAL_CUSTODY_ADJUSTMENT transaction type records a portfolio's position in a security on a cut-off date, when there is no reliable history of transactions prior to that date. Use it instead of a simple buy: the dedicated type makes these adjustments easy to identify.

Send the new type to Create Transaction with the same fields as a regular transaction (transactDate, quantity, side, brokerId and security). The price field is optional: if it is not provided, Gorila uses the security's closing price on the transaction date.

{
  "type": "INITIAL_CUSTODY_ADJUSTMENT",
  "transactDate": "2023-04-11",
  "quantity": 300,
  "side": "BUY",
  "brokerId": "18945670000146",
  "security": {
    "id": 122720
  }
}

Transactions of this type are also returned by List Transactions and List Economic Group Transactions.

Learn more in Transaction and in the initial custody adjustment example.

You can now change the name and description of securities created by your organization, keeping their identification up to date without having to recreate them.

The Update Security by ID endpoint now accepts the name and description fields for securities of type CUSTOM, INVESTMENT_CLUB and MANAGED_FUND:

{
  "name": "Apartment",
  "description": "Apartment located in São Paulo"
}

For other security types, sending name or description returns a 400 error. The other fields accepted by the endpoint are not affected by this restriction.

Learn more in Custom Security and Investment Clubs and Managed Funds.

You can now filter the security search by creation date, and each security now shows when it was created.

The List Securities endpoint accepts the new createdDateFrom and createdDateTo query parameters, in the YYYY-MM-DD format, to return only the securities created from and/or up to a given date. createdDateTo cannot be earlier than createdDateFrom. Example: GET /securities?createdDateFrom=2026-04-01&createdDateTo=2026-04-28.

The List Securities and Read Security by ID endpoints also return the new createdDate field, with the security's creation date.

You can now check whether a security has a tax incentive through the new taxIncentivized field, and set it on your custom securities.

The taxIncentivized field (boolean) is returned by the List Securities and Read Security by ID endpoints. For custom securities:

• Create Security accepts taxIncentivized (default false);
• Update Security by ID lets you change taxIncentivized and now also accepts the maturity date (maturityDate).

Learn more in Custom Security.

You can now filter the portfolio list by creation date, and each portfolio now shows when it was created.

The List Portfolios endpoint accepts the new createdDateFrom and createdDateTo query parameters, in the YYYY-MM-DD format, to return only the portfolios created from and/or up to a given date. Example: GET /portfolios?createdDateFrom=2026-01-01&createdDateTo=2026-03-31.

Each portfolio in the response also includes the new createdDate field, with the date and time it was created (for example, "createdDate": "2024-01-01T00:00:00Z").

The security object now includes its maturity date, index and rate, also in position and transaction responses, so you do not need a separate request to read the security.

New fields:

• maturityDate: maturity date of the security.
• index: benchmark used as reference.
• dealType: type of indexation of the security.
• yield: rate of the security, according to dealType and index.

The fields are returned by List Securities and Read Security by ID and also in the security summary (the security object) included in other responses, for both portfolios and economic groups: positions and per-position metrics (such as List Positions), security events and transactions (such as List Transactions).

Transactions imported by the BTG and XP integrations, which previously could not be changed through the API, can now be edited and deleted. Your changes are kept even after new syncs or reprocessing of the integration.

The Update Transaction by ID and Delete Transaction by ID endpoints now accept these transactions.

When editing, you can change price, quantity, exchangeRate and fees. The brokerId, side, sourceBrokerId, targetBrokerId and transactDate fields cannot be changed, and a request that tries to change them returns a 400 error.

Your organization can now create its own security classifications and reclassify any security, adapting the class tree to the way it evaluates its portfolios.

New endpoints to manage custom classifications:

• Create Security Classification: creates a classification at any level (level, from CLASSIFICATION_L0 to CLASSIFICATION_L3). Below L0, the parent classification is given in parentId and can be one of Gorila's official classifications.
• Read Classification by ID, Update Security Classification by ID (to rename it) and Delete Security Classification by ID. Only custom classifications can be renamed or deleted. Deleting one also deletes its subclasses, and the securities in them return to Gorila's official classification.

The List Securities Classifications endpoint now also includes your organization's classifications.

To reclassify a security, send the desired classificationId to Update Security by ID, or null to return it to the official classification. The reclassification applies to all portfolios in your organization and is reflected in positions and metrics.

Learn more in Security Classification.

You can now register and manage the events of your custom securities, such as expiration, amortization, interest and dividends, so that they are reflected in the positions, Profit & Loss and returns of your portfolios.

New endpoints:

• Create Security Event: registers one event per request.
• List Security Custom Events: lists the registered events, with filters by period (startDate, endDate) and type (types).
• Update Security Event and Delete Security Event: update and delete an event.

Supported types:

• Expiration (EXPIRATION), with the settlement price (settlementPrice). It closes the positions in the security on the event date, and each security can have only one.
• Cash events (CASH_AMORTIZATION, CASH_AMORTIZATION_UNSCHEDULED, CASH_DIVIDEND, CASH_INCOME, CASH_INTEREST, CASH_JSCP, CASH_PREMIUM and CASH_RETURN_OF_CAPITAL), with the amount paid per unit of the security (unitValue).

Every event has a reference date (referenceDate) and a payment date (paymentDate), which cannot be earlier than the reference date.

// REQUEST
// POST https://core.gorila.com.br/securities/{securityId}/events

{
  "type": "CASH_AMORTIZATION",
  "referenceDate": "2024-01-31",
  "paymentDate": "2024-02-05",
  "unitValue": 2.5
}

Learn more in Custom Security.

You can now filter the transaction list by the date each transaction was created or updated, which makes it easier to fetch only what changed since your last sync.

The List Transactions and List Economic Group Transactions endpoints accept four new query parameters, in the YYYY-MM-DD format:

• createdDateFrom and createdDateTo: transactions created from and/or up to the given date.
• updatedDateFrom and updatedDateTo: transactions updated from and/or up to the given date.

They can be combined with the other filters of the list. The creation and update dates of each transaction are returned in the createdDate and updatedDate fields.

You can now query the drawdown of portfolios and economic groups: the percentage drop of the accumulated return relative to its peak.

The new Read Drawdown and Read Economic Group Drawdown endpoints return the daily drawdown series, with the date (referenceDate) and the value (drawdown) of each point, in decimal format (-0.25 means a 25% drop).

The peak is always calculated from the entire history: startDate and endDate only trim the returned series. The endpoints also accept filters by security, asset class, security type, classification and broker, which restrict the positions considered.

Learn more in Drawdown.

Fund securities now carry the class and subclass structure introduced by CVM Resolution 175. Each subclass is a separate security, so you can tell apart securities that share the same CNPJ.

The List Securities and Read Security by ID endpoints return the new fund identification fields: anbimaFundId, anbimaFundName, anbimaClassId, anbimaClassName, anbimaSubclassId, anbimaSubclassName, cvmClassId and cvmSubclassId.

Example of the new fields in the response:

{
  "anbimaFundId": "F0000261599",
  "anbimaFundName": "Fundo de Investimento em Cotas de Fundos de Investimento RIVO FIDC",
  "anbimaClassId": "C0000261599",
  "anbimaClassName": "RIVO FIDC",
  "anbimaSubclassId": "S0000261599",
  "anbimaSubclassName": "SÊNIOR",
  "cvmClassId": "1",
  "cvmSubclassId": "1"
}

Since several securities can share the same CNPJ, multi-class funds must be referenced by the security ID (security.id) when creating transactions (Create Transaction) and price conversions (Price Conversion). Requests that identify these funds by cnpj are rejected with a 400 error.