{ "item": [ { "name": "Connect sessions", "description": "Hosted connect flow orchestration (moved from /v1)", "item": [ { "id": "cfe93da4-c777-48d0-9381-244dd4581d0b", "name": "Create a hosted connect session", "request": { "name": "Create a hosted connect session", "description": { "content": "Same operation as v1.1 `createConnectSession` served by the same handler - the `/v1` path remains a transitional alias. Creates a session for the hosted connect flow and returns a one-time `hostedUrl`. The underlying connection is created internally once the user confirms a bank — or, with `connectionId` set, the session reconnects that connection instead and the bank picker is skipped.\n", "type": "text/plain" }, "url": { "path": [ "v2", "connect-sessions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "disabled": true, "description": { "content": "Unique key (UUID recommended) making the request idempotent for 24 hours, scoped per partner. A replay with the same key returns the original response.\n", "type": "text/plain" }, "key": "Idempotency-Key", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"returnUrl\": \"\",\n \"locale\": \"en\",\n \"country\": \"\",\n \"providerId\": \"\",\n \"connectionId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": null }, "response": [ { "id": "244c800e-224f-4f1c-adf8-36ef175ee3ef", "name": "Session created.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "disabled": true, "description": { "content": "Unique key (UUID recommended) making the request idempotent for 24 hours, scoped per partner. A replay with the same key returns the original response.\n", "type": "text/plain" }, "key": "Idempotency-Key", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"returnUrl\": \"\",\n \"locale\": \"en\",\n \"country\": \"\",\n \"providerId\": \"\",\n \"connectionId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"sessionId\": \"\",\n \"hostedUrl\": \"\",\n \"expiresAt\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "12cab3ed-8214-4ef9-ab45-be4f83d7812d", "name": "Invalid request — malformed parameters or headers, out-of-range `limit`, unknown `sort`/`order`/`recordState` value, `dateTo` before `dateFrom`, more than 20 `variableSymbol` values, `sinceSeq` or `sinceCreatedSeq` combined with anything but `limit` (or with each other), or a cursor that is undecodable or inconsistent with the query parameters.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "disabled": true, "description": { "content": "Unique key (UUID recommended) making the request idempotent for 24 hours, scoped per partner. A replay with the same key returns the original response.\n", "type": "text/plain" }, "key": "Idempotency-Key", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"returnUrl\": \"\",\n \"locale\": \"en\",\n \"country\": \"\",\n \"providerId\": \"\",\n \"connectionId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9c64dfb6-5c04-41d2-b633-68ba36a2940e", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "disabled": true, "description": { "content": "Unique key (UUID recommended) making the request idempotent for 24 hours, scoped per partner. A replay with the same key returns the original response.\n", "type": "text/plain" }, "key": "Idempotency-Key", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"returnUrl\": \"\",\n \"locale\": \"en\",\n \"country\": \"\",\n \"providerId\": \"\",\n \"connectionId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "0b95cd10-b91a-442f-a4f7-1a4ca048b27e", "name": "`application_not_active` - the application is not activated, so it cannot open bank connections. `sandbox_provider_not_allowed` - the pre-declared `providerId` is a sandbox provider (`*_xf`), which a live key never reaches.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "disabled": true, "description": { "content": "Unique key (UUID recommended) making the request idempotent for 24 hours, scoped per partner. A replay with the same key returns the original response.\n", "type": "text/plain" }, "key": "Idempotency-Key", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"returnUrl\": \"\",\n \"locale\": \"en\",\n \"country\": \"\",\n \"providerId\": \"\",\n \"connectionId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "27c3afce-dfe5-4917-8a29-eb1709db7475", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "disabled": true, "description": { "content": "Unique key (UUID recommended) making the request idempotent for 24 hours, scoped per partner. A replay with the same key returns the original response.\n", "type": "text/plain" }, "key": "Idempotency-Key", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"returnUrl\": \"\",\n \"locale\": \"en\",\n \"country\": \"\",\n \"providerId\": \"\",\n \"connectionId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "0fed01c9-7fd4-4a79-80d8-28fd6512a670", "name": "Get connect session status", "request": { "name": "Get connect session status", "description": { "content": "For troubleshooting and server-side reconciliation; the webhook stream remains the authoritative completion signal. Same handler as the v1.1 operation.\n", "type": "text/plain" }, "url": { "path": [ "v2", "connect-sessions", ":sessionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "sessionId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "3b5e936e-4777-42ca-b686-3f4b88704087", "name": "Session status.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions", ":sessionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "sessionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"sessionId\": \"\",\n \"state\": \"Cancelled\",\n \"connectionId\": \"\",\n \"resultCode\": \"Ok\",\n \"error\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9058cd47-1be0-46df-a2c4-c73138552407", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions", ":sessionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "sessionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "1c91f011-9af7-4242-9477-a6ee5d850e57", "name": "Resource not found — including resources that exist but belong to a different partner or client (indistinguishable by design).", "originalRequest": { "url": { "path": [ "v2", "connect-sessions", ":sessionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "sessionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "5a09e9bc-9895-4baf-8a90-c4910995ad50", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "connect-sessions", ":sessionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "sessionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Partner", "description": "Partner self-description and capability discovery (moved from /v1)", "item": [ { "id": "ba5da0e7-75b3-4db7-b61b-8523e23695f7", "name": "Capability discovery", "request": { "name": "Capability discovery", "description": { "content": "Self-description of the calling partner (partner-scoped, no `X-Client-Id`). Same handler as the v1.1 operation. Calling a disabled capability elsewhere returns `403 capability_disabled`.\n", "type": "text/plain" }, "url": { "path": [ "v2", "partner", "config" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "6fa14c28-7770-4bc3-aa74-7367028aec16", "name": "Partner configuration.", "originalRequest": { "url": { "path": [ "v2", "partner", "config" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"partnerId\": \"\",\n \"name\": \"\",\n \"mode\": \"live\",\n \"capabilities\": {\n \"refresh\": \"\",\n \"reconnect\": \"\",\n \"enrichment\": \"\",\n \"autoRevokeAfterCreate\": \"\",\n \"nonRegulatedProviders\": \"\"\n },\n \"webhook\": {\n \"signatureVersion\": \"v1\"\n },\n \"consentDuration\": \"\",\n \"countries\": [\n \"\",\n \"\"\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "fb54b833-aef7-4906-a5bd-493b81c0565f", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "partner", "config" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "d7793cca-7d16-46c7-aec1-3d323b527e33", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "partner", "config" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Providers", "description": "Bank (provider) discovery (v2 data plane)", "item": [ { "id": "34757dc5-5c8b-4a09-9add-38876d69e0f6", "name": "List providers available to the partner (paginated)", "request": { "name": "List providers available to the partner (paginated)", "description": { "content": "Providers filtered to the partner's allowed countries and integration sources (from platform configuration). **Ordering (normative):** stable ascending by `id` (pagination guarantee only). Partner-scoped — no `X-Client-Id`.\n\nA provider whose effective status is `Forbidden` is absent from this page, unconditionally and with no parameter to include it. Forbidden is an internal curation decision, not a state of the bank: it says BudgetBakers has not offered this provider to this partner, so for the partner it does not exist rather than being unavailable. The status itself therefore never reaches this plane and is not in `status`'s vocabulary.\n\nSandbox providers (code `*_xf`, country `XF`) are listed to a sandbox key (`bb_test_`) only. A live key (`bb_live_`) never reaches them, so they are absent from its pages the same way.\n", "type": "text/plain" }, "url": { "path": [ "v2", "providers" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "ISO 3166-1 alpha-2 filter (`XF` = sandbox-only fictional country).", "type": "text/plain" }, "key": "country", "value": "" }, { "disabled": true, "description": { "content": "Case-insensitive substring match on the provider name.", "type": "text/plain" }, "key": "search", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "8b7de6c9-4940-43dd-95b5-f7b5b47a0207", "name": "One page of providers.", "originalRequest": { "url": { "path": [ "v2", "providers" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "ISO 3166-1 alpha-2 filter (`XF` = sandbox-only fictional country).", "type": "text/plain" }, "key": "country", "value": "" }, { "disabled": true, "description": { "content": "Case-insensitive substring match on the provider name.", "type": "text/plain" }, "key": "search", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"limit\": \"\",\n \"nextCursor\": \"\",\n \"data\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"code\": \"\",\n \"countryCode\": \"\",\n \"logoUrl\": \"\",\n \"bicCodes\": [\n \"\",\n \"\"\n ],\n \"status\": \"\",\n \"mode\": \"\",\n \"timeZone\": \"\"\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"code\": \"\",\n \"countryCode\": \"\",\n \"logoUrl\": \"\",\n \"bicCodes\": [\n \"\",\n \"\"\n ],\n \"status\": \"\",\n \"mode\": \"\",\n \"timeZone\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9f75a8a1-7be3-474e-9e45-a9e57888beb8", "name": "Invalid request — malformed parameters or headers, out-of-range `limit`, unknown `sort`/`order`/`recordState` value, `dateTo` before `dateFrom`, more than 20 `variableSymbol` values, `sinceSeq` or `sinceCreatedSeq` combined with anything but `limit` (or with each other), or a cursor that is undecodable or inconsistent with the query parameters.", "originalRequest": { "url": { "path": [ "v2", "providers" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "ISO 3166-1 alpha-2 filter (`XF` = sandbox-only fictional country).", "type": "text/plain" }, "key": "country", "value": "" }, { "disabled": true, "description": { "content": "Case-insensitive substring match on the provider name.", "type": "text/plain" }, "key": "search", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "cb64e269-f64c-4d00-96c1-7cf2b68572e7", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "providers" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "ISO 3166-1 alpha-2 filter (`XF` = sandbox-only fictional country).", "type": "text/plain" }, "key": "country", "value": "" }, { "disabled": true, "description": { "content": "Case-insensitive substring match on the provider name.", "type": "text/plain" }, "key": "search", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "2d2afb51-fc6c-4f20-8a69-3c9ce28e9547", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "providers" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "ISO 3166-1 alpha-2 filter (`XF` = sandbox-only fictional country).", "type": "text/plain" }, "key": "country", "value": "" }, { "disabled": true, "description": { "content": "Case-insensitive substring match on the provider name.", "type": "text/plain" }, "key": "search", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Clients", "description": "End-user (client) lifecycle (v2 data plane)", "item": [ { "id": "3dd5a75c-bc1e-48cb-b3fd-ff423e8d36fa", "name": "Create a client (upsert by externalId)", "request": { "name": "Create a client (upsert by externalId)", "description": { "content": "Creates the partner's end user. Partner-scoped. Re-posting an existing `externalId` returns the existing client — never a duplicate.\n", "type": "text/plain" }, "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": null }, "response": [ { "id": "fe7c3f17-5392-4fe9-b036-abc1e2464289", "name": "The created (or upserted) client.", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"data\": {\n \"id\": \"\",\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9725f616-b705-4dbe-a145-1861696a9547", "name": "Invalid request — malformed parameters or headers, out-of-range `limit`, unknown `sort`/`order`/`recordState` value, `dateTo` before `dateFrom`, more than 20 `variableSymbol` values, `sinceSeq` or `sinceCreatedSeq` combined with anything but `limit` (or with each other), or a cursor that is undecodable or inconsistent with the query parameters.", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "d225d9e1-d45c-4031-8159-632cd2a7c6cc", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "65ca01a9-5f52-495f-a666-abece8930ceb", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "9b73a675-5ab9-4c47-b141-6249c3b0fe0c", "name": "Look up a client by externalId", "request": { "name": "Look up a client by externalId", "description": { "content": "Partner-scoped lookup; the page contains zero or one items.", "type": "text/plain" }, "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Look up the client by the partner-supplied external id (exact match). Returns a page with zero or one items.\n", "type": "text/plain" }, "key": "externalId", "value": "" }, { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "67553d5f-ed2a-49b0-ab6f-8c59e434793d", "name": "Matching clients (zero or one).", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Look up the client by the partner-supplied external id (exact match). Returns a page with zero or one items.\n", "type": "text/plain" }, "key": "externalId", "value": "" }, { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"limit\": \"\",\n \"nextCursor\": \"\",\n \"data\": [\n {\n \"id\": \"\",\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n },\n {\n \"id\": \"\",\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "d20cbfa1-ea42-4e3a-9554-52218dcda407", "name": "Invalid request — malformed parameters or headers, out-of-range `limit`, unknown `sort`/`order`/`recordState` value, `dateTo` before `dateFrom`, more than 20 `variableSymbol` values, `sinceSeq` or `sinceCreatedSeq` combined with anything but `limit` (or with each other), or a cursor that is undecodable or inconsistent with the query parameters.", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Look up the client by the partner-supplied external id (exact match). Returns a page with zero or one items.\n", "type": "text/plain" }, "key": "externalId", "value": "" }, { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "5bf54e3a-d7b5-4bd2-80c7-43281f1a8b74", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Look up the client by the partner-supplied external id (exact match). Returns a page with zero or one items.\n", "type": "text/plain" }, "key": "externalId", "value": "" }, { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "ee7329fd-fa4b-4b80-ba15-9983d5a920e1", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "clients" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Look up the client by the partner-supplied external id (exact match). Returns a page with zero or one items.\n", "type": "text/plain" }, "key": "externalId", "value": "" }, { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "ea613ed6-49ae-4a14-a02c-1af7f8b0f371", "name": "Get a client", "request": { "name": "Get a client", "description": {}, "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "clientId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "b4725e25-bc7f-4311-b7ec-8665edad1e5c", "name": "The client.", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"data\": {\n \"id\": \"\",\n \"email\": \"\",\n \"countryCode\": \"\",\n \"externalId\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "13f0713e-09aa-4b29-82d8-b08331915110", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "3f9ba998-33ad-427f-9fc1-0c88f826a53e", "name": "Resource not found — including resources that exist but belong to a different partner or client (indistinguishable by design).", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "5f4c4c19-20f7-4554-a8b3-79e8fa707e25", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "c91ae27a-cad2-4469-b9c2-6cd45fa1f78f", "name": "Delete a client and all their data", "request": { "name": "Delete a client and all their data", "description": { "content": "Removes the client and cascades to their connections, accounts and transactions in the v2 store. Idempotent — deleting an absent client returns 404.\n", "type": "text/plain" }, "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "clientId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE", "body": {}, "auth": null }, "response": [ { "id": "57260904-3bf2-461c-8f5e-9c15b36b28be", "name": "Deleted.", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" } ], "method": "DELETE", "body": {} }, "status": "No Content", "code": 204, "header": [ { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "cookie": [], "_postman_previewlanguage": "text" }, { "id": "32bbf6fd-8ce2-4858-a87a-98738e32d1d1", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a131da97-80e4-447b-8fdd-48156e84fbd5", "name": "Resource not found — including resources that exist but belong to a different partner or client (indistinguishable by design).", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9920a262-ebec-4738-8db9-ab4909f8a297", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "clients", ":clientId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "clientId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Connections", "description": "Connection record retrieval (lifecycle actions stay on /v1)", "item": [ { "id": "9548d98b-8984-4c2f-b8ea-89ede04306ea", "name": "Get a connection record", "request": { "name": "Get a connection record", "description": { "content": "The stored connection record (state, provider, consent expiry). Lifecycle actions (create, refresh, revoke…) remain on their `/v1` paths.\n", "type": "text/plain" }, "url": { "path": [ "v2", "connections", ":connectionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "connectionId", "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "59da97d8-4a01-47bb-8d60-0923479057e5", "name": "The connection.", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"data\": {\n \"id\": \"\",\n \"state\": \"\",\n \"providerId\": \"\",\n \"consentExpiresAt\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "73eb33e3-56b2-4ba6-9fff-d86a971bc4d5", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "cae4f805-58af-4f8b-985a-870d930aaeba", "name": "Resource not found — including resources that exist but belong to a different partner or client (indistinguishable by design).", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "506b6b7c-70fa-4d69-8cef-13637811282a", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Accounts", "description": "Account retrieval for an authorized connection (v2 data plane)", "item": [ { "id": "549a41d0-a705-4c13-ba37-841efe4361e4", "name": "List accounts of a connection (paginated)", "request": { "name": "List accounts of a connection (paginated)", "description": { "content": "Paginated list of the connection's accounts. **Ordering (normative):** stable ascending by `id`; the order carries no business meaning and is documented only as a pagination guarantee. Unlike v1 there is no 100-account cap — connections with more accounts paginate instead of being silently truncated. The list is **not** filtered by `subscriptionStatus`: accounts the user did not select in the account picker are returned too, as `Disabled` — visible, with their balance, but carrying no transactions.\n", "type": "text/plain" }, "url": { "path": [ "v2", "connections", ":connectionId", "accounts" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [ { "type": "any", "value": "", "key": "connectionId", "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "4caa673f-0051-4104-9491-13f33d27c1e6", "name": "One page of accounts.", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId", "accounts" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"limit\": \"\",\n \"nextCursor\": \"\",\n \"data\": [\n {\n \"id\": \"\",\n \"subscriptionStatus\": \"Unsubscribed\",\n \"name\": \"\",\n \"type\": \"\",\n \"balance\": \"522.889\",\n \"currencyCode\": \"\",\n \"iban\": \"\"\n },\n {\n \"id\": \"\",\n \"subscriptionStatus\": \"Inactive\",\n \"name\": \"\",\n \"type\": \"\",\n \"balance\": \"7585.965\",\n \"currencyCode\": \"\",\n \"iban\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a4374478-e3b7-4a3d-8760-c496dc48b7fa", "name": "Invalid request — malformed parameters or headers, out-of-range `limit`, unknown `sort`/`order`/`recordState` value, `dateTo` before `dateFrom`, more than 20 `variableSymbol` values, `sinceSeq` or `sinceCreatedSeq` combined with anything but `limit` (or with each other), or a cursor that is undecodable or inconsistent with the query parameters.", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId", "accounts" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "e1696a07-7cd8-4353-81c4-8e3510340c6d", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId", "accounts" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "34c1f081-ccb7-46c0-8239-cbce6a82d9c9", "name": "Resource not found — including resources that exist but belong to a different partner or client (indistinguishable by design).", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId", "accounts" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "d1a14b37-3d5a-4eb6-b566-504e030d96e5", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "connections", ":connectionId", "accounts" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Connection ID as returned by the v1 connection endpoints.", "type": "text/plain" }, "type": "any", "value": "", "key": "connectionId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "acb943db-1fd9-4d17-88b8-1b232877637b", "name": "Get a single account", "request": { "name": "Get a single account", "description": { "content": "Single account wrapped in the `{\"data\": …}` envelope.", "type": "text/plain" }, "url": { "path": [ "v2", "accounts", ":accountId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "accountId", "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "5468bd21-03ab-4f56-b46f-e28876f3630b", "name": "The account.", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"data\": {\n \"id\": \"\",\n \"subscriptionStatus\": \"Active\",\n \"name\": \"\",\n \"type\": \"\",\n \"balance\": \"-5731372944.92\",\n \"currencyCode\": \"\",\n \"iban\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "dba06b30-5a5a-452c-b0d4-edbc806e7c60", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "22764a70-e317-40b8-8f17-882dffd6175d", "name": "Resource not found — including resources that exist but belong to a different partner or client (indistinguishable by design).", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a4f45c38-ae6a-4162-8dd1-320db6cd3913", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Transactions", "description": "Transaction retrieval for an account (v2 data plane)", "item": [ { "id": "806d9914-1bb6-4fdb-83c8-e990c2a15737", "name": "List transactions of an account (sorted, filtered, paginated)", "request": { "name": "List transactions of an account (sorted, filtered, paginated)", "description": { "content": "Paginated transaction list. **Default ordering (normative):** `recordDate` descending, then `id` descending — newest first, deterministic. Sorting is configurable via `sort`/`order`; filters (`dateFrom`/`dateTo`, `recordState`, `variableSymbol`) combine with AND semantics. All filter and sort parameters must stay constant across a cursor walk (see `nextCursor`). History depth is provider-driven — typically around 90 days of history is available after the initial connect. **Delta sync:** poll with `sinceSeq` (combinable only with `limit`) to receive every row inserted or modified since your last position, ordered by `seq` — including late-arriving transactions whose `recordDate` predates rows you already hold, which date-based paging would miss.\n", "type": "text/plain" }, "url": { "path": [ "v2", "accounts", ":accountId", "transactions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "Sort key for the transaction list. `recordDate` (default) or `amount`. The `id` tiebreak (see `order`) makes every sort total, so pagination is deterministic.\n (This can only be one of recordDate,amount)", "type": "text/plain" }, "key": "sort", "value": "recordDate" }, { "disabled": true, "description": { "content": "Sort direction, `desc` (default) or `asc`. **Normative:** rows are ordered by (`sort` key, then `id`) with **both** keys in this direction; `null` sort-key values sort last for `desc` and first for `asc`.\n (This can only be one of asc,desc)", "type": "text/plain" }, "key": "order", "value": "desc" }, { "disabled": true, "description": { "content": "Inclusive lower bound on `recordDate`, as a calendar date (UTC): `recordDate >= dateFrom T00:00:00Z`.\n", "type": "text/plain" }, "key": "dateFrom", "value": "" }, { "disabled": true, "description": { "content": "Inclusive upper bound on `recordDate`, as a calendar date (UTC): `recordDate < (dateTo + 1 day) T00:00:00Z`. `dateTo` must not precede `dateFrom` (`validation_error`).\n", "type": "text/plain" }, "key": "dateTo", "value": "" }, { "disabled": true, "description": { "content": "Return only transactions in the given record state. (This can only be one of Cleared,Uncleared)", "type": "text/plain" }, "key": "recordState", "value": "Cleared" }, { "disabled": true, "description": { "content": "Return only transactions whose `details.variableSymbol` matches one of the given values. Repeatable standard query parameter (`?variableSymbol=888&variableSymbol=456`), at most 20 values (`validation_error` beyond that). Matching ignores leading zeros on both sides (`00123` matches `123`); trailing digits are significant. Note this replaces v1's JSON-array-in-query encoding with plain repetition.\n", "type": "text/plain" }, "key": "variableSymbol", "value": "" }, { "disabled": true, "description": { "content": "Return only transactions whose `details.variableSymbol` matches one of the given values. Repeatable standard query parameter (`?variableSymbol=888&variableSymbol=456`), at most 20 values (`validation_error` beyond that). Matching ignores leading zeros on both sides (`00123` matches `123`); trailing digits are significant. Note this replaces v1's JSON-array-in-query encoding with plain repetition.\n", "type": "text/plain" }, "key": "variableSymbol", "value": "" }, { "disabled": true, "description": { "content": "**Delta sync** (exclusive lower bound): return only rows whose `seq` is greater than the given value, ordered by `seq` ascending. Poll with the highest `seq` you have processed (`sinceSeq=0` for a full initial sync); a row re-appears whenever it changes server-side. Combinable ONLY with `limit` — any other filter, `sort`/`order`, or a foreign cursor is rejected with `validation_error`. Continue a page walk via the returned `nextCursor` or simply by the last item's `seq`; both are equivalent. Gaps in `seq` are normal. The feed is per-account; within an account the ingest pipeline is serialized, so a poll never misses a lower `seq` committed late.\n", "type": "text/plain" }, "key": "sinceSeq", "value": "" }, { "disabled": true, "description": { "content": "**Create-only delta sync** (exclusive lower bound): return only rows whose `createdSeq` is greater than the given value, ordered by `createdSeq` ascending. Unlike `sinceSeq`, a row appears on this feed exactly once — server-side modifications never re-deliver it. Combinable ONLY with `limit`; mutually exclusive with `sinceSeq`. Continue via the returned `nextCursor` or the last item's `createdSeq`; gaps are normal.\n", "type": "text/plain" }, "key": "sinceCreatedSeq", "value": "" } ], "variable": [ { "type": "any", "value": "", "key": "accountId", "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "e43e308b-42a9-453c-bf7f-78e8283cc161", "name": "One page of transactions.", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId", "transactions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "Sort key for the transaction list. `recordDate` (default) or `amount`. The `id` tiebreak (see `order`) makes every sort total, so pagination is deterministic.\n (This can only be one of recordDate,amount)", "type": "text/plain" }, "key": "sort", "value": "recordDate" }, { "disabled": true, "description": { "content": "Sort direction, `desc` (default) or `asc`. **Normative:** rows are ordered by (`sort` key, then `id`) with **both** keys in this direction; `null` sort-key values sort last for `desc` and first for `asc`.\n (This can only be one of asc,desc)", "type": "text/plain" }, "key": "order", "value": "desc" }, { "disabled": true, "description": { "content": "Inclusive lower bound on `recordDate`, as a calendar date (UTC): `recordDate >= dateFrom T00:00:00Z`.\n", "type": "text/plain" }, "key": "dateFrom", "value": "" }, { "disabled": true, "description": { "content": "Inclusive upper bound on `recordDate`, as a calendar date (UTC): `recordDate < (dateTo + 1 day) T00:00:00Z`. `dateTo` must not precede `dateFrom` (`validation_error`).\n", "type": "text/plain" }, "key": "dateTo", "value": "" }, { "disabled": true, "description": { "content": "Return only transactions in the given record state. (This can only be one of Cleared,Uncleared)", "type": "text/plain" }, "key": "recordState", "value": "Cleared" }, { "disabled": true, "description": { "content": "Return only transactions whose `details.variableSymbol` matches one of the given values. Repeatable standard query parameter (`?variableSymbol=888&variableSymbol=456`), at most 20 values (`validation_error` beyond that). Matching ignores leading zeros on both sides (`00123` matches `123`); trailing digits are significant. Note this replaces v1's JSON-array-in-query encoding with plain repetition.\n", "type": "text/plain" }, "key": "variableSymbol", "value": "" }, { "disabled": true, "description": { "content": "**Delta sync** (exclusive lower bound): return only rows whose `seq` is greater than the given value, ordered by `seq` ascending. Poll with the highest `seq` you have processed (`sinceSeq=0` for a full initial sync); a row re-appears whenever it changes server-side. Combinable ONLY with `limit` — any other filter, `sort`/`order`, or a foreign cursor is rejected with `validation_error`. Continue a page walk via the returned `nextCursor` or simply by the last item's `seq`; both are equivalent. Gaps in `seq` are normal. The feed is per-account; within an account the ingest pipeline is serialized, so a poll never misses a lower `seq` committed late.\n", "type": "text/plain" }, "key": "sinceSeq", "value": "" }, { "disabled": true, "description": { "content": "**Create-only delta sync** (exclusive lower bound): return only rows whose `createdSeq` is greater than the given value, ordered by `createdSeq` ascending. Unlike `sinceSeq`, a row appears on this feed exactly once — server-side modifications never re-deliver it. Combinable ONLY with `limit`; mutually exclusive with `sinceSeq`. Continue via the returned `nextCursor` or the last item's `createdSeq`; gaps are normal.\n", "type": "text/plain" }, "key": "sinceCreatedSeq", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"limit\": \"\",\n \"nextCursor\": \"\",\n \"data\": [\n {\n \"id\": \"\",\n \"recordDate\": \"\",\n \"seq\": \"\",\n \"createdSeq\": \"\",\n \"amount\": \"6828165.78\",\n \"currencyCode\": \"\",\n \"recordState\": \"Uncleared\",\n \"note\": \"\",\n \"counterParty\": \"\",\n \"enrichment\": {\n \"recurrent\": \"\",\n \"category\": {\n \"categoryId\": \"\",\n \"categoryName\": \"\",\n \"subcategoryId\": \"\",\n \"subcategoryName\": \"\"\n },\n \"merchant\": {\n \"id\": \"\",\n \"name\": \"\",\n \"logoUri\": \"\"\n }\n },\n \"details\": {\n \"variableSymbol\": \"\",\n \"constantSymbol\": \"\",\n \"specificSymbol\": \"\",\n \"transactionCode\": \"\",\n \"creditorReference\": \"\",\n \"externalCategoryName\": \"\",\n \"mccCode\": \"\",\n \"others\": {\n \"key_0\": true\n }\n }\n },\n {\n \"id\": \"\",\n \"recordDate\": \"\",\n \"seq\": \"\",\n \"createdSeq\": \"\",\n \"amount\": \"-0036.633\",\n \"currencyCode\": \"\",\n \"recordState\": \"Uncleared\",\n \"note\": \"\",\n \"counterParty\": \"\",\n \"enrichment\": {\n \"recurrent\": \"\",\n \"category\": {\n \"categoryId\": \"\",\n \"categoryName\": \"\",\n \"subcategoryId\": \"\",\n \"subcategoryName\": \"\"\n },\n \"merchant\": {\n \"id\": \"\",\n \"name\": \"\",\n \"logoUri\": \"\"\n }\n },\n \"details\": {\n \"variableSymbol\": \"\",\n \"constantSymbol\": \"\",\n \"specificSymbol\": \"\",\n \"transactionCode\": \"\",\n \"creditorReference\": \"\",\n \"externalCategoryName\": \"\",\n \"mccCode\": \"\",\n \"others\": {\n \"key_0\": 8656,\n \"key_1\": \"string\",\n \"key_2\": \"string\"\n }\n }\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "ac0c705f-b770-4ae4-b7d8-0083d0f29c73", "name": "Invalid request — malformed parameters or headers, out-of-range `limit`, unknown `sort`/`order`/`recordState` value, `dateTo` before `dateFrom`, more than 20 `variableSymbol` values, `sinceSeq` or `sinceCreatedSeq` combined with anything but `limit` (or with each other), or a cursor that is undecodable or inconsistent with the query parameters.", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId", "transactions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "Sort key for the transaction list. `recordDate` (default) or `amount`. The `id` tiebreak (see `order`) makes every sort total, so pagination is deterministic.\n (This can only be one of recordDate,amount)", "type": "text/plain" }, "key": "sort", "value": "recordDate" }, { "disabled": true, "description": { "content": "Sort direction, `desc` (default) or `asc`. **Normative:** rows are ordered by (`sort` key, then `id`) with **both** keys in this direction; `null` sort-key values sort last for `desc` and first for `asc`.\n (This can only be one of asc,desc)", "type": "text/plain" }, "key": "order", "value": "desc" }, { "disabled": true, "description": { "content": "Inclusive lower bound on `recordDate`, as a calendar date (UTC): `recordDate >= dateFrom T00:00:00Z`.\n", "type": "text/plain" }, "key": "dateFrom", "value": "" }, { "disabled": true, "description": { "content": "Inclusive upper bound on `recordDate`, as a calendar date (UTC): `recordDate < (dateTo + 1 day) T00:00:00Z`. `dateTo` must not precede `dateFrom` (`validation_error`).\n", "type": "text/plain" }, "key": "dateTo", "value": "" }, { "disabled": true, "description": { "content": "Return only transactions in the given record state. (This can only be one of Cleared,Uncleared)", "type": "text/plain" }, "key": "recordState", "value": "Cleared" }, { "disabled": true, "description": { "content": "Return only transactions whose `details.variableSymbol` matches one of the given values. Repeatable standard query parameter (`?variableSymbol=888&variableSymbol=456`), at most 20 values (`validation_error` beyond that). Matching ignores leading zeros on both sides (`00123` matches `123`); trailing digits are significant. Note this replaces v1's JSON-array-in-query encoding with plain repetition.\n", "type": "text/plain" }, "key": "variableSymbol", "value": "" }, { "disabled": true, "description": { "content": "**Delta sync** (exclusive lower bound): return only rows whose `seq` is greater than the given value, ordered by `seq` ascending. Poll with the highest `seq` you have processed (`sinceSeq=0` for a full initial sync); a row re-appears whenever it changes server-side. Combinable ONLY with `limit` — any other filter, `sort`/`order`, or a foreign cursor is rejected with `validation_error`. Continue a page walk via the returned `nextCursor` or simply by the last item's `seq`; both are equivalent. Gaps in `seq` are normal. The feed is per-account; within an account the ingest pipeline is serialized, so a poll never misses a lower `seq` committed late.\n", "type": "text/plain" }, "key": "sinceSeq", "value": "" }, { "disabled": true, "description": { "content": "**Create-only delta sync** (exclusive lower bound): return only rows whose `createdSeq` is greater than the given value, ordered by `createdSeq` ascending. Unlike `sinceSeq`, a row appears on this feed exactly once — server-side modifications never re-deliver it. Combinable ONLY with `limit`; mutually exclusive with `sinceSeq`. Continue via the returned `nextCursor` or the last item's `createdSeq`; gaps are normal.\n", "type": "text/plain" }, "key": "sinceCreatedSeq", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "34778475-d012-4335-8a4e-fd6e77723d13", "name": "Invalid or missing X-Api-Key, or API access blocked because the spending cap was reached. Raise the cap or settle payment in the partner portal.", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId", "transactions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "Sort key for the transaction list. `recordDate` (default) or `amount`. The `id` tiebreak (see `order`) makes every sort total, so pagination is deterministic.\n (This can only be one of recordDate,amount)", "type": "text/plain" }, "key": "sort", "value": "recordDate" }, { "disabled": true, "description": { "content": "Sort direction, `desc` (default) or `asc`. **Normative:** rows are ordered by (`sort` key, then `id`) with **both** keys in this direction; `null` sort-key values sort last for `desc` and first for `asc`.\n (This can only be one of asc,desc)", "type": "text/plain" }, "key": "order", "value": "desc" }, { "disabled": true, "description": { "content": "Inclusive lower bound on `recordDate`, as a calendar date (UTC): `recordDate >= dateFrom T00:00:00Z`.\n", "type": "text/plain" }, "key": "dateFrom", "value": "" }, { "disabled": true, "description": { "content": "Inclusive upper bound on `recordDate`, as a calendar date (UTC): `recordDate < (dateTo + 1 day) T00:00:00Z`. `dateTo` must not precede `dateFrom` (`validation_error`).\n", "type": "text/plain" }, "key": "dateTo", "value": "" }, { "disabled": true, "description": { "content": "Return only transactions in the given record state. (This can only be one of Cleared,Uncleared)", "type": "text/plain" }, "key": "recordState", "value": "Cleared" }, { "disabled": true, "description": { "content": "Return only transactions whose `details.variableSymbol` matches one of the given values. Repeatable standard query parameter (`?variableSymbol=888&variableSymbol=456`), at most 20 values (`validation_error` beyond that). Matching ignores leading zeros on both sides (`00123` matches `123`); trailing digits are significant. Note this replaces v1's JSON-array-in-query encoding with plain repetition.\n", "type": "text/plain" }, "key": "variableSymbol", "value": "" }, { "disabled": true, "description": { "content": "**Delta sync** (exclusive lower bound): return only rows whose `seq` is greater than the given value, ordered by `seq` ascending. Poll with the highest `seq` you have processed (`sinceSeq=0` for a full initial sync); a row re-appears whenever it changes server-side. Combinable ONLY with `limit` — any other filter, `sort`/`order`, or a foreign cursor is rejected with `validation_error`. Continue a page walk via the returned `nextCursor` or simply by the last item's `seq`; both are equivalent. Gaps in `seq` are normal. The feed is per-account; within an account the ingest pipeline is serialized, so a poll never misses a lower `seq` committed late.\n", "type": "text/plain" }, "key": "sinceSeq", "value": "" }, { "disabled": true, "description": { "content": "**Create-only delta sync** (exclusive lower bound): return only rows whose `createdSeq` is greater than the given value, ordered by `createdSeq` ascending. Unlike `sinceSeq`, a row appears on this feed exactly once — server-side modifications never re-deliver it. Combinable ONLY with `limit`; mutually exclusive with `sinceSeq`. Continue via the returned `nextCursor` or the last item's `createdSeq`; gaps are normal.\n", "type": "text/plain" }, "key": "sinceCreatedSeq", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "8eb5fbde-1161-4fc9-9884-47907432abcf", "name": "Resource not found — including resources that exist but belong to a different partner or client (indistinguishable by design).", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId", "transactions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "Sort key for the transaction list. `recordDate` (default) or `amount`. The `id` tiebreak (see `order`) makes every sort total, so pagination is deterministic.\n (This can only be one of recordDate,amount)", "type": "text/plain" }, "key": "sort", "value": "recordDate" }, { "disabled": true, "description": { "content": "Sort direction, `desc` (default) or `asc`. **Normative:** rows are ordered by (`sort` key, then `id`) with **both** keys in this direction; `null` sort-key values sort last for `desc` and first for `asc`.\n (This can only be one of asc,desc)", "type": "text/plain" }, "key": "order", "value": "desc" }, { "disabled": true, "description": { "content": "Inclusive lower bound on `recordDate`, as a calendar date (UTC): `recordDate >= dateFrom T00:00:00Z`.\n", "type": "text/plain" }, "key": "dateFrom", "value": "" }, { "disabled": true, "description": { "content": "Inclusive upper bound on `recordDate`, as a calendar date (UTC): `recordDate < (dateTo + 1 day) T00:00:00Z`. `dateTo` must not precede `dateFrom` (`validation_error`).\n", "type": "text/plain" }, "key": "dateTo", "value": "" }, { "disabled": true, "description": { "content": "Return only transactions in the given record state. (This can only be one of Cleared,Uncleared)", "type": "text/plain" }, "key": "recordState", "value": "Cleared" }, { "disabled": true, "description": { "content": "Return only transactions whose `details.variableSymbol` matches one of the given values. Repeatable standard query parameter (`?variableSymbol=888&variableSymbol=456`), at most 20 values (`validation_error` beyond that). Matching ignores leading zeros on both sides (`00123` matches `123`); trailing digits are significant. Note this replaces v1's JSON-array-in-query encoding with plain repetition.\n", "type": "text/plain" }, "key": "variableSymbol", "value": "" }, { "disabled": true, "description": { "content": "**Delta sync** (exclusive lower bound): return only rows whose `seq` is greater than the given value, ordered by `seq` ascending. Poll with the highest `seq` you have processed (`sinceSeq=0` for a full initial sync); a row re-appears whenever it changes server-side. Combinable ONLY with `limit` — any other filter, `sort`/`order`, or a foreign cursor is rejected with `validation_error`. Continue a page walk via the returned `nextCursor` or simply by the last item's `seq`; both are equivalent. Gaps in `seq` are normal. The feed is per-account; within an account the ingest pipeline is serialized, so a poll never misses a lower `seq` committed late.\n", "type": "text/plain" }, "key": "sinceSeq", "value": "" }, { "disabled": true, "description": { "content": "**Create-only delta sync** (exclusive lower bound): return only rows whose `createdSeq` is greater than the given value, ordered by `createdSeq` ascending. Unlike `sinceSeq`, a row appears on this feed exactly once — server-side modifications never re-deliver it. Combinable ONLY with `limit`; mutually exclusive with `sinceSeq`. Continue via the returned `nextCursor` or the last item's `createdSeq`; gaps are normal.\n", "type": "text/plain" }, "key": "sinceCreatedSeq", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "87689f14-62b4-4100-b936-3834f20f93a2", "name": "Rate limit exceeded. Retry with exponential backoff and honor Retry-After.", "originalRequest": { "url": { "path": [ "v2", "accounts", ":accountId", "transactions" ], "host": [ "{{PARTNER_API_URL}}" ], "query": [ { "disabled": true, "description": { "content": "Maximum number of items in this page. Values outside `1..500` are rejected with `validation_error` (v2 does not silently clamp).\n", "type": "text/plain" }, "key": "limit", "value": "100" }, { "disabled": true, "description": { "content": "Keyset cursor returned by the previous page's `nextCursor` field. Treat it as opaque and iterate until the response's `nextCursor` is `null`. **Normative:** the cursor must be sent together with the *identical* `sort`, `order` and filter parameters used when it was issued; a mismatch (or a tampered / undecodable cursor) is rejected with `400 validation_error`. Unlike v1, this cursor is a keyset, not an offset — it is stable under concurrent inserts.\n", "type": "text/plain" }, "key": "nextCursor", "value": "" }, { "disabled": true, "description": { "content": "Sort key for the transaction list. `recordDate` (default) or `amount`. The `id` tiebreak (see `order`) makes every sort total, so pagination is deterministic.\n (This can only be one of recordDate,amount)", "type": "text/plain" }, "key": "sort", "value": "recordDate" }, { "disabled": true, "description": { "content": "Sort direction, `desc` (default) or `asc`. **Normative:** rows are ordered by (`sort` key, then `id`) with **both** keys in this direction; `null` sort-key values sort last for `desc` and first for `asc`.\n (This can only be one of asc,desc)", "type": "text/plain" }, "key": "order", "value": "desc" }, { "disabled": true, "description": { "content": "Inclusive lower bound on `recordDate`, as a calendar date (UTC): `recordDate >= dateFrom T00:00:00Z`.\n", "type": "text/plain" }, "key": "dateFrom", "value": "" }, { "disabled": true, "description": { "content": "Inclusive upper bound on `recordDate`, as a calendar date (UTC): `recordDate < (dateTo + 1 day) T00:00:00Z`. `dateTo` must not precede `dateFrom` (`validation_error`).\n", "type": "text/plain" }, "key": "dateTo", "value": "" }, { "disabled": true, "description": { "content": "Return only transactions in the given record state. (This can only be one of Cleared,Uncleared)", "type": "text/plain" }, "key": "recordState", "value": "Cleared" }, { "disabled": true, "description": { "content": "Return only transactions whose `details.variableSymbol` matches one of the given values. Repeatable standard query parameter (`?variableSymbol=888&variableSymbol=456`), at most 20 values (`validation_error` beyond that). Matching ignores leading zeros on both sides (`00123` matches `123`); trailing digits are significant. Note this replaces v1's JSON-array-in-query encoding with plain repetition.\n", "type": "text/plain" }, "key": "variableSymbol", "value": "" }, { "disabled": true, "description": { "content": "**Delta sync** (exclusive lower bound): return only rows whose `seq` is greater than the given value, ordered by `seq` ascending. Poll with the highest `seq` you have processed (`sinceSeq=0` for a full initial sync); a row re-appears whenever it changes server-side. Combinable ONLY with `limit` — any other filter, `sort`/`order`, or a foreign cursor is rejected with `validation_error`. Continue a page walk via the returned `nextCursor` or simply by the last item's `seq`; both are equivalent. Gaps in `seq` are normal. The feed is per-account; within an account the ingest pipeline is serialized, so a poll never misses a lower `seq` committed late.\n", "type": "text/plain" }, "key": "sinceSeq", "value": "" }, { "disabled": true, "description": { "content": "**Create-only delta sync** (exclusive lower bound): return only rows whose `createdSeq` is greater than the given value, ordered by `createdSeq` ascending. Unlike `sinceSeq`, a row appears on this feed exactly once — server-side modifications never re-deliver it. Combinable ONLY with `limit`; mutually exclusive with `sinceSeq`. Continue via the returned `nextCursor` or the last item's `createdSeq`; gaps are normal.\n", "type": "text/plain" }, "key": "sinceCreatedSeq", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) Account ID as returned by `GET /v2/connections/{connectionId}/accounts`.", "type": "text/plain" }, "type": "any", "value": "", "key": "accountId" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Client ID obtained from `POST /v2/clients`. Required on client-scoped endpoints.", "type": "text/plain" }, "key": "X-Client-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "X-Request-Id", "value": "" }, { "disabled": true, "description": { "content": "", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"application_not_active\",\n \"message\": \"\"\n },\n \"requestId\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] } ], "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "X-Api-Key", "type": "string" }, { "key": "value", "value": "{{BB_API_KEY}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "event": [], "variable": [ { "key": "PARTNER_API_URL", "value": "https://aisp-partner.bbapi.io" } ], "info": { "_postman_id": "659cb2b9-e5c7-4303-9f95-60982761b1e0", "name": "BudgetBakers Partner AISP API v2", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "description": { "content": "Account and transaction **data plane** of the partner AISP API for contracted\npartners: providers, clients, connection records, accounts and transactions,\nplus connect sessions and partner capability discovery.\n\nConnection lifecycle actions - create, refresh, reconnect, revoke and delete -\nexist only on `/v1` (see the Partner API v1.1 reference). Connect sessions,\npartner config, providers, clients and all reads have their home on `/v2`\n(this reference); the `/v1` connect-session and partner-config paths are\ntransitional aliases. Both path sets are served on the same host with the same\nAPI key, so do not hardcode a shared version prefix.\n\nSandbox and live mode are selected by the API key prefix (`bb_test_…` /\n`bb_live_…`), never by the host. Guides:\nhttps://aisp-docs.bbapi.io/guide/getting-started\n\nThe contract evolves additively: new endpoints, optional fields, envelope\nfields and enum values may be added without notice, and clients must ignore\nwhat they do not recognize.\n\n## Conventions (v2, normative)\n- **Envelopes.** Every 2xx body is an object: single resources are wrapped\n as `{\"data\": …}`, lists as `{\"limit\": …, \"nextCursor\": …, \"data\": […]}`.\n New envelope fields may be added without notice; unknown fields must be\n ignored.\n- **Money is a decimal string** with two fraction digits (`\"816.00\"`,\n `\"-2326.00\"`), or three where the third digit carries value\n (`\"1.005\"`) — the upstream store keeps three-decimal precision. Never\n parse as binary float.\n- **Ordering is guaranteed and documented per endpoint.** Where sorting is\n configurable, `id` is the tiebreaker in the same direction as `order`.\n- **Cursors are opaque keysets** (base64url). A cursor is only valid\n together with the *identical* `sort`, `order` and filter parameters it\n was produced with; any mismatch is rejected with `validation_error`.\n Keyset cursors are stable under concurrent inserts — a page walk never\n skips or duplicates rows because new rows arrived mid-walk.\n\n## Authentication\nIdentical to v1: every request requires `X-Api-Key`. Client-scoped\nendpoints (accounts, transactions, connection read, client\nget/delete) additionally require `X-Client-Id`; partner-scoped ones\n(client create/lookup, providers) do not. Traffic passes our API\ngateway with per-partner rate limits.\n\n## Errors (v2)\nSame machine-readable model as v1.1 - `{\"error\": {\"code\", \"message\"},\n\"requestId\"}` with a stable `error.code` - but the v1.1 `errorDesc`\nstring is **not** part of v2 responses. Branch on `error.code` only.\nResources outside the caller's partner + client scope are indistinguishable\nfrom absent ones: both return `404 not_found`.\n\n\nContact Support:\n Email: integration@budgetbakers.com", "type": "text/plain" } } }