Request contract

POST /api/v1/portfolios. Store an encrypted read-only exchange credential and create a portfolio owned by the authenticated API account. Send the personal token in X-API-Key and keep it outside browser code and public logs.

Response and metering

The response includes connection identity, exchange, label and synchronization state through the normalized account contract. Successful metered responses publish X-Credit-Cost and X-Credits-Remaining so usage can be recorded without another request.

Production behavior

This is a provider mutation and has the largest fixed credit cost. Validate exchange, required passphrase and permissions before submitting. Handle application/problem+json errors by stable code, preserve the correlation ID and never retry a mutation unless the workflow is idempotent.