iCapital
Generally AvailableAfter OAuth2 authorization an agent can research funds, review allocations and subscriptions, and track capital calls, distributions and NAVs for client positions.
- Alternative Investments
- Private Markets
- Wealth Management
- Authentication
- OAuth 2.0
- Hosting
- Vendor-hosted endpoint
- Required scopes
- 4
How it works
Every agent request passes through Ferentin policy before it reaches iCapital.
- AI agentAsks for something
- Ferentin policies
- OAuth 2.0 consent
- Permission aware access
- Audit logging
- iCapital MCP serverAuthorized connection
- Governed resultMasked, logged, returned
What you can do with iCapital
- Fund research
- Allocation review
- Capital activity tracking
- Nav tracking
- Document search
Permissions requested
The OAuth 2.0 scopes iCapital asks you to approve when you connect.
| Scope | Access |
|---|---|
| openid | Not rated |
| profile | Not rated |
| Not rated | |
| offline_access | Not rated |
Before you connect
- An entitled iCapital account is required.
- Dynamic Client Registration is NOT available: the Okta authorization server advertises https://auth.simonmarkets.com/oauth2/v1/clients but rejects anonymous registration with 403 'Invalid session' (verified 2026-09-20). Credential inheritance is therefore REQUIRE_TENANT.
- The authorization server is hosted on the SIMON Markets Okta tenant (auth.simonmarkets.com, custom server aus12xhtrm4lv59w32p7) — iCapital acquired SIMON, so the issuer domain differs from the resource domain by design.
- Protected-resource metadata advertises only OIDC scopes (openid, profile, email); entitlement is enforced inside iCapital, not through OAuth scopes. Add 'offline_access' for refresh tokens.
1 more technical note
- Alternatives data is materially more sensitive than public-market holdings — review DLP and audit policy before publishing this server to a tenant.
About iCapital
iCapital is a marketplace and operating platform for alternative investments — private equity, private credit, hedge funds and structured notes — distributed to wealth managers.
Frequently asked about iCapital
- What can AI agents do with iCapital through Ferentin?
- Through Ferentin, agents can use iCapital for fund research, allocation review, capital activity tracking, nav tracking and document search. Every call is checked against your Ferentin policies first.
- How is iCapital access secured?
- Requests through the iCapital integration are covered by OAuth 2.0 consent, permission aware access and audit logging. These controls are applied by Ferentin, not by iCapital, so they hold across every connected agent.
- What permissions does the iCapital integration require?
- The iCapital integration requests 4 OAuth 2.0 scopes: openid; profile; email; offline_access
- How do I connect iCapital to Ferentin?
- Open the Ferentin admin console, add iCapital as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
- Is the iCapital integration generally available?
- Yes. The iCapital integration is generally available on Ferentin, including the free tier.
Related integrations
3
Addepar
Query your firm's Addepar portfolio data — holdings, exposure, attribution and transactions — with the signed-in user's own entitlements.
SS&C Black Diamond
Look up clients and accounts, pull performance and holdings to the tax lot, and review fees, transactions and rebalancing opportunities.
Chronograph
Query private-equity portfolio performance, valuations, and company metrics so your agent can surface fund and deal analytics on demand.