API docs by Redocly

Cumbuca Gateway API (1.0.0)

Download OpenAPI specification:

URL: https://cumbuca.com

API for accessing Open Finance Brazil data and managing consents.

This API exposes endpoints for:

  • Consent management (/consent-management)
  • OIDC authorization (/openid)
  • Open Finance Brazil data (/open-finance): accounts, credit cards, loans, financings, overdraft advances, invoice financings, investments, and customer data

The Open Finance data endpoints (/open-finance/*) expose aggregated financial data from transmitting institutions via Open Finance Brazil, providing a unified abstraction layer over connected account data.

On GET /open-finance/* reads, when the institution given in x-authorisation-server-id does not publish the requested API family and version in the Open Finance participants directory and the read fails, the gateway answers 422 with code ENDPOINT_NOT_SUPPORTED_BY_PARTICIPANT (header x-nexus-error-source: client) instead of the bank's generic error. Do not retry: the bank does not offer that API.

Authentication

Endpoint for obtaining access tokens via the OAuth 2.0 Client Credentials flow.

Request or refresh an access token.

Issues an OAuth 2.0 access token using either the Client Credentials or Refresh Token grant type.

  • client_credentials: exchange your client credentials for a new access token and refresh token.
  • refresh_token: exchange a previously issued refresh token for a new access token (and optionally a new refresh token) without re-presenting credentials.

Cache and reuse the access token until it expires, then call this endpoint again with grant_type=refresh_token.

Authorizations:
BasicAuth
Request Body schema: application/x-www-form-urlencoded
required
grant_type
required
string
Enum: "client_credentials" "refresh_token"

OAuth 2.0 grant type. Use client_credentials to obtain a new token pair; use refresh_token to renew an existing access token.

scope
string

Optional space-separated list of requested scopes. Applies to client_credentials only.

refresh_token
string

Required when grant_type is refresh_token. The refresh token returned by a previous token response.

Responses

Response samples

Content type
application/json
{
  • "access_token": "string",
  • "token_type": "Bearer",
  • "expires_in": 0,
  • "scope": "string",
  • "refresh_token": "string",
  • "refresh_expires_in": 0
}

Consent Management

Endpoints for creating and managing data-sharing consents.

Create a new consent request.

Creates a new data-sharing consent for the customer.

Open Finance - API Consentimento
Authorizations:
BearerAuth
header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

Request Body schema: application/json
required
object

Responses

Request samples

Content type
application/json
{
  • "data": {
    }
}

Response samples

Content type
application/json
{
  • "data": {}
}

Generate a new authorisation URL for the consent identified by consentId.

Generates a new authorisation redirect URL for a consent that failed or was not completed.

Authorizations:
BearerAuth
path Parameters
consentId
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

The consentId is the unique consent identifier and must be a URN (Uniform Resource Name), as defined in RFC 8141.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

Request Body schema: application/json
required
object

Responses

Request samples

Content type
application/json
{}

Response samples

Content type
application/json
{
  • "data": {}
}

Renew the consent identified by consentId.

Renews an existing consent. The consent can only be renewed if it is in an active state and within the allowed renewal window.

Authorizations:
BearerAuth
path Parameters
consentId
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

The consentId is the unique consent identifier and must be a URN (Uniform Resource Name), as defined in RFC 8141.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-customer-user-agent
required
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

x-fapi-customer-ip-address
required
string[\w\W\s]*

End user's IP address if they are currently logged in with the client.

Request Body schema: application/json
required
object

Responses

Request samples

Content type
application/json
{
  • "data": {
    }
}

Response samples

Content type
application/json
{
  • "data": {
    }
}

Get renewal history for the consent identified by consentId.

Returns details of all extensions (renewals) made to the specified consent.

Authorizations:
BearerAuth
path Parameters
consentId
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

The consentId is the unique consent identifier and must be a URN (Uniform Resource Name), as defined in RFC 8141.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

Responses

Response samples

Content type
application/json
{}

Get details of the consent identified by consentId.

Returns the full details of the specified consent.

Open Finance - API Consentimento
Authorizations:
BearerAuth
path Parameters
consentId
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

The consentId is the unique consent identifier and must be a URN (Uniform Resource Name), as defined in RFC 8141.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

Responses

Response samples

Content type
application/json
{
  • "data": {
    }
}

Revoke the consent identified by consentId.

Deletes or revokes the specified consent, terminating data-sharing authorisation.

Open Finance - API Consentimento
Authorizations:
BearerAuth
path Parameters
consentId
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

The consentId is the unique consent identifier and must be a URN (Uniform Resource Name), as defined in RFC 8141.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

Responses

Response samples

Content type
application/json
{
  • "errors": [
    ],
  • "meta": {
    }
}

List registered participants and their APIs.

Returns all institutions registered in the Open Finance Brazil directory, including their Authorisation Server identifiers and available API resources.

Open Finance - Funções regulatórias para mapeamentos OpenID e OAuth 2.0
Authorizations:
BearerAuth
query Parameters
role
string

Filter results to OrgDomainRoleClaims containing the specified role. Role types are subject to change.

familyType
string

Filter results to ApiResources containing the specified familyType.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Submit OIDC authorisation result.

Used in the App-to-App flow to exchange the authorisation code returned by the data provider for tokens, or to process an authorisation error.

Authorizations:
BearerAuth
Request Body schema: application/json
data
string

Responses

Request samples

Content type
application/json
{
  • "data": "code=LxSevzQNevQJM0yx4dhPo4oJHdYhAHG808ssYF2OlzC&id_token=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkVKU01fbW1UMV9qTTVieTM5aEttR01BSWNTM2lzQ3BPSlB5NVdnUmY3RUUifQ.eyJzdWIiOiJPRkMtNDkzOGI1ODIzZWQzNjMxNmQyZTVjYzY5M2YxNzljMTJjNTE0MjNlYTQ0NzJiYjgyZWI5YWYzNTE0NjEyYmI2MSIsImF1dGhfdGltZSI6MTY5NTY3NjE2MCwiYWNyIjoidXJuOmJyYXNpbDpvcGVuYmFua2luZzpsb2EyIiwibm9uY2UiOiIzNjE2YzM3NWFjMDZlODBjMTk3MjljMTkwOGEzYjkxMGQ3ODVlYzViZTkxOTZhN2YyZjllZjhmNDI1YmVlNWMxIiwiY19oYXNoIjoiRUVMd2FoU1FQUGt2WEZWZzJOZnRHUSIsInNfaGFzaCI6IndPN1hZbFB1c1FZMGtwOG1Ucmw3WVEiLCJhdWQiOiI1aUtkV3JCdlhFRjJHNWgwZ1RaMkMiLCJleHAiOjE2OTU2NzcwNjAsImlhdCI6MTY5NTY3NjE2MCwiaXNzIjoiaHR0cHM6Ly9vYmIucWEub29iLm9wdXMtc29mdHdhcmUuY29tLmJyLyJ9.SNBN_Buh_Y0iLuJGP4bgSHYnSKC_g76R0CpWEVRJua788RNoJpAzhAm6Ah6vOb2nD-H4Yq2MAjRy_Fkh7ruziBaJ4ebDexxQ2GAocBgrmQ2JwI-Q-1D4Xm1WuSS6OSm04Kk0CiV8MylidwxF_4XS40uWqxTJQcgG8dP4NC9-ty8S6a-6oGs0MekjOqm9mU0aFDwS8fRGZ8TU-8AT15hiMQ9sXsgNlfrci0MQi9Jb6t9o4c93mKCLhGypYswjs1MjVoXD3K6btZ2NSZYBQROtTK_tl9HkvW1uRVhNVZjzwDs1DJrvZpLP48es8YPxFtYAAKsuwiB8bza58MYKvvW81A&state=dXJuOmFtYXppbmdiYW5rOjdlOWYxMDhmLWE3MDktNDBlNi1iMzQ2LTNjNGZiMzBjNjcyNnwx"
}

Response samples

Content type
application/json
{
  • "error": "access_denied",
  • "error_description": "Error in user authentication"
}

Resources

Endpoints for listing resources linked to a consent, following Open Finance Brazil standards.

List consented resources.

Returns the list of resources held by the customer at the data provider and covered by the active consent.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Customer Data

Endpoints for querying customer registration data (individuals and businesses), following Open Finance Brazil standards.

Get personal customer identification records.

Returns the identification records for the individual customer held at the data provider.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "links": {},
  • "meta": {
    }
}

Get business customer identification records.

Returns the identification records for the business customer held at the data provider.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "links": {},
  • "meta": {
    }
}

Get personal customer qualification records.

Returns the qualification records (financial profile) for the individual customer held at the data provider.

Authorizations:
BearerAuth
header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get business customer qualification records.

Returns the qualification records (financial profile) for the business customer held at the data provider.

Authorizations:
BearerAuth
header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get personal customer financial relationships.

Returns the financial relationship records and authorised representatives for the individual customer at the data provider.

Authorizations:
BearerAuth
header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get business customer financial relationships.

Returns the financial relationship records and authorised representatives for the business customer at the data provider.

Authorizations:
BearerAuth
header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Credit Cards

Endpoints for querying credit card account data, following Open Finance Brazil standards.

List credit card accounts.

Returns the list of credit card (post-paid payment) accounts held by the customer at the data provider and covered by the active consent.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get credit card account details.

Returns the identification data for the credit card account identified by creditCardAccountId.

Authorizations:
BearerAuth
path Parameters
creditCardAccountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the credit card account, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get credit card account limits.

Returns the credit limits for the account identified by creditCardAccountId.

Authorizations:
BearerAuth
path Parameters
creditCardAccountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the credit card account, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List credit card transaction history.

Returns the historical transaction list (up to the last 12 months) for the credit card account identified by creditCardAccountId.

Authorizations:
BearerAuth
path Parameters
creditCardAccountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the credit card account, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

transactionType
string
Enum: "PAGAMENTO" "PAGAMENTO_FATURA" "TARIFA" "OPERACOES_CREDITO_CONTRATADAS_CARTAO" "ESTORNO" "CASHBACK" "OUTROS"

Filter by transaction type.

payeeMCC
number <int32> <= 9999
Example: payeeMCC=8299

Filter by payee's Merchant Category Code (MCC).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List recent credit card transactions (last 7 days).

Returns the recent transaction list (last 7 days) for the credit card account identified by creditCardAccountId.

Authorizations:
BearerAuth
path Parameters
creditCardAccountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the credit card account, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

transactionType
string
Enum: "PAGAMENTO" "PAGAMENTO_FATURA" "TARIFA" "OPERACOES_CREDITO_CONTRATADAS_CARTAO" "ESTORNO" "CASHBACK" "OUTROS"

Filter by transaction type.

payeeMCC
number <int32> <= 9999
Example: payeeMCC=8299

Filter by payee's Merchant Category Code (MCC).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List credit card bills.

Returns the list of bills for the credit card account identified by creditCardAccountId.

Authorizations:
BearerAuth
path Parameters
creditCardAccountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the credit card account, preserving immutability rules within the data provider.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

fromDueDate
string <date> <= 10 characters

Filter bills with due date from this date (YYYY-MM-DD).

toDueDate
string <date> <= 10 characters

Filter bills with due date up to this date (YYYY-MM-DD).

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List transactions for a specific bill.

Returns the list of transactions for the bill identified by billId on the credit card account identified by creditCardAccountId.

Authorizations:
BearerAuth
path Parameters
creditCardAccountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the credit card account, preserving immutability rules within the data provider.

billId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Identifies the bill.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

transactionType
string
Enum: "PAGAMENTO" "PAGAMENTO_FATURA" "TARIFA" "OPERACOES_CREDITO_CONTRATADAS_CARTAO" "ESTORNO" "CASHBACK" "OUTROS"

Filter by transaction type.

payeeMCC
number <int32> <= 9999
Example: payeeMCC=8299

Filter by payee's Merchant Category Code (MCC).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Accounts

Endpoints for querying payment and deposit account data, following Open Finance Brazil standards.

List consented accounts.

Returns the list of accounts consented by the customer.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

accountType
string
Enum: "CONTA_DEPOSITO_A_VISTA" "CONTA_POUPANCA" "CONTA_PAGAMENTO_PRE_PAGA"

Filter by account type.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get account details.

Returns the identification data for the account identified by accountId.

Authorizations:
BearerAuth
path Parameters
accountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Identifier for a demand deposit, savings, or prepaid payment account.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get account balances.

Returns the balance information for the account identified by accountId.

Authorizations:
BearerAuth
path Parameters
accountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Identifier for a demand deposit, savings, or prepaid payment account.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List account transaction history.

Returns the historical transaction list for the account identified by accountId.

Authorizations:
BearerAuth
path Parameters
accountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Identifier for a demand deposit, savings, or prepaid payment account.

query Parameters
fromBookingDate
string <date> <= 10 characters

Filter transactions from this booking date (YYYY-MM-DD).

toBookingDate
string <date> <= 10 characters

Filter transactions up to this booking date (YYYY-MM-DD).

creditDebitIndicator
string
Enum: "CREDITO" "DEBITO"

Filter by credit/debit indicator.

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List recent account transactions (last 7 days).

Returns the recent transaction list (last 7 days) for the account identified by accountId.

Authorizations:
BearerAuth
path Parameters
accountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Identifier for a demand deposit, savings, or prepaid payment account.

query Parameters
fromBookingDate
string <date> <= 10 characters

Filter transactions from this booking date (YYYY-MM-DD).

toBookingDate
string <date> <= 10 characters

Filter transactions up to this booking date (YYYY-MM-DD).

creditDebitIndicator
string
Enum: "CREDITO" "DEBITO"

Filter by credit/debit indicator.

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get account overdraft limits.

Returns the overdraft limits for the account identified by accountId.

Authorizations:
BearerAuth
path Parameters
accountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Identifier for a demand deposit, savings, or prepaid payment account.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get reserved balances (savings pots).

Returns the balances reserved in savings pots/reserves for the account identified by accountId. In scope: reserves without yield, used to set money aside for future spending, and reserves with yield that are not tied to an investment linked to the customer's CPF/CNPJ. When the institution offers the product but the customer has no reserve, the list comes back empty with HTTP 200. Institutions without the product return 404.

Authorizations:
BearerAuth
path Parameters
accountId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Identifier for a demand deposit, savings, or prepaid payment account.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Loans

Endpoints for querying loan credit operation data, following Open Finance Brazil standards.

List loan contracts.

Returns the list of loan contracts held by the customer at the data provider and covered by the active consent.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get loan contract details.

Returns the data for the loan contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

List loan contract warranties.

Returns the list of warranties linked to the loan contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get loan contract payment data.

Returns the payment data for the loan contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Get loan contract instalment schedule.

Returns the scheduled instalments for the loan contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Financings

Endpoints for querying financing credit operation data, following Open Finance Brazil standards.

List financing contracts.

Returns the list of financing contracts held by the customer at the data provider and covered by the active consent.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get financing contract details.

Returns the data for the financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

List financing contract warranties.

Returns the warranties linked to the financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get financing contract payment data.

Returns the payment data for the financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Get financing contract instalment schedule.

Returns the scheduled instalments for the financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Overdraft Advances

Endpoints for querying overdraft advance data, following Open Finance Brazil standards.

List consented overdraft advance contracts.

Returns the list of overdraft advance contracts consented by the customer.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get overdraft advance contract details.

Returns the data for the overdraft advance contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

List overdraft advance contract warranties.

Returns the warranties linked to the overdraft advance contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get overdraft advance contract payment data.

Returns the payment data for the overdraft advance contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Get overdraft advance contract instalment schedule.

Returns the scheduled instalments for the overdraft advance contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Invoice Financings

Endpoints for querying discounted credit rights (invoice financings) data, following Open Finance Brazil standards.

List consented invoice financing contracts.

Returns the list of invoice financing (receivables advance) contracts consented by the customer.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get invoice financing contract details.

Returns the data for the invoice financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

List invoice financing contract warranties.

Returns the warranties linked to the invoice financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get invoice financing contract payment data.

Returns the payment data for the invoice financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Get invoice financing contract instalment schedule.

Returns the scheduled instalments for the invoice financing contract identified by contractId.

Authorizations:
BearerAuth
path Parameters
contractId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Contract identifier for all types of credit operations.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

Investments - Bank Fixed Income

Endpoints for querying bank fixed income investment data, following Open Finance Brazil standards.

List bank fixed income investments.

Returns the list of bank fixed income investment positions held by the customer at the data provider.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get bank fixed income investment details.

Returns the data for the bank fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get bank fixed income investment position.

Returns the current balance/position for the bank fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List bank fixed income investment transactions.

Returns the transaction history for the bank fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List recent bank fixed income investment transactions.

Returns recent transactions (last 7 days) for the bank fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Investments - Credit Fixed Income

Endpoints for querying credit fixed income investment data, following Open Finance Brazil standards.

List credit fixed income investments.

Returns the list of credit fixed income investment positions held by the customer at the data provider.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get credit fixed income investment details.

Returns the data for the credit fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get credit fixed income investment position.

Returns the current balance/position for the credit fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List credit fixed income investment transactions.

Returns the transaction history for the credit fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List recent credit fixed income investment transactions.

Returns recent transactions (last 7 days) for the credit fixed income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Investments - Variable Income

Endpoints for querying variable income investment data, following Open Finance Brazil standards.

List variable income investments.

Returns the list of variable income (equity) investment positions held by the customer at the data provider.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get variable income investment details.

Returns the data for the variable income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get variable income investment position.

Returns the current balance/position for the variable income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List variable income investment transactions.

Returns the transaction history for the variable income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List recent variable income investment transactions.

Returns recent transactions (last 7 days) for the variable income investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get broker note details.

Returns the broker note identified by brokerNoteId.

Authorizations:
BearerAuth
path Parameters
brokerNoteId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the broker note, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Investments - Treasury Bonds

Endpoints for querying Tesouro Direto (Brazilian treasury bond) investment data, following Open Finance Brazil standards.

List Tesouro Direto investments.

Returns the list of Tesouro Direto (Brazilian treasury bond) investment positions held by the customer at the data provider.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get Tesouro Direto investment details.

Returns the data for the Tesouro Direto investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get Tesouro Direto investment position.

Returns the current balance/position for the Tesouro Direto investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List Tesouro Direto investment transactions.

Returns the transaction history for the Tesouro Direto investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List recent Tesouro Direto investment transactions.

Returns recent transactions (last 7 days) for the Tesouro Direto investment identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionDate
string <date> <= 10 characters

Filter transactions from this date (YYYY-MM-DD).

toTransactionDate
string <date> <= 10 characters

Filter transactions up to this date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Investments - Funds

Endpoints for querying investment fund data, following Open Finance Brazil standards.

List investment fund positions.

Returns the list of investment fund positions held by the customer at the data provider.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get investment fund position details.

Returns the data for the investment fund position identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get investment fund position balance.

Returns the current balance/position for the investment fund identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List investment fund transactions.

Returns the transaction history for the investment fund identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionConversionDate
string <date> <= 10 characters

Filter fund transactions from this conversion date (YYYY-MM-DD).

toTransactionConversionDate
string <date> <= 10 characters

Filter fund transactions up to this conversion date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

List recent investment fund transactions.

Returns recent transactions (last 7 days) for the investment fund identified by investmentId.

Authorizations:
BearerAuth
path Parameters
investmentId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Uniquely identifies the customer's relationship with the investment product, preserving immutability rules within the data provider.

query Parameters
fromTransactionConversionDate
string <date> <= 10 characters

Filter fund transactions from this conversion date (YYYY-MM-DD).

toTransactionConversionDate
string <date> <= 10 characters

Filter fund transactions up to this conversion date (YYYY-MM-DD).

page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Foreign Exchange

Endpoints for querying foreign exchange operation data, following Open Finance Brazil standards. They require the EXCHANGES_READ permission in the consent; if the institution does not publish the exchanges API in the Directory, the gateway returns 422 ENDPOINT_NOT_SUPPORTED_BY_PARTICIPANT.

List foreign exchange operations.

Returns the list of foreign exchange operations held by the customer at the data provider and covered by the active consent.

Authorizations:
BearerAuth
query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Get foreign exchange operation details.

Returns the data for the foreign exchange operation identified by operationId.

Authorizations:
BearerAuth
path Parameters
operationId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Foreign exchange operation identifier, obtained from the operations list.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{
  • "data": {
    },
  • "links": {},
  • "meta": {
    }
}

List foreign exchange operation events.

Returns the events of the foreign exchange operation identified by operationId.

Authorizations:
BearerAuth
path Parameters
operationId
required
string <= 100 characters ^[a-zA-Z0-9][a-zA-Z0-9\-]{0,99}$

Foreign exchange operation identifier, obtained from the operations list.

query Parameters
page
integer <int32> >= 1
Default: 1

Requested page number (1-indexed).

page-size
integer <int32> [ 1 .. 1000 ]
Default: 25

Number of records per page.

pagination-key
string <= 2048 characters [\w\W\s]*

Recall identifier defined by the regulation, used by the data provider so that pagination calls do not count towards the request limit. It is not a cursor and it is optional: when the data provider uses it, it comes in the links.next and links.prev URIs. Send the value back when requesting the next page through the gateway.

header Parameters
x-authorisation-server-id
required
string <uuid> (UUID) [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-...
Example: 556392bd-b4c2-4cc0-9abe-f2c77a5c5d8f

Authorisation Server identifier for the consent's data provider, obtained from the participants list.

x-consent-id
required
string <= 256 characters ^urn:[a-zA-Z0-9][a-zA-Z0-9-]{0,31}:[a-zA-Z0-9...
Example: urn:bancox:f865cd66-392a-420b-9ff0-1b6d7cc60ee0

Consent identifier to be used in this operation, obtained from the consent creation response.

x-fapi-customer-ip-address
string [ 1 .. 100 ] characters [\w\W\s]*

End user's IP address if they are currently logged in with the client.

x-customer-user-agent
string [ 1 .. 100 ] characters [\w\W\s]*

User-agent string of the end user.

Responses

Response samples

Content type
application/json
{}

Reciprocity

Receiving institution data reciprocity endpoints: registration of the institution's own account holders' identification records to serve Open Finance Brazil reciprocity queries, and retrieval of the redirect URL to the shared consent-management portal.

Register an account holder's personal identification records for reciprocity.

Registers the personal (individual) identification records of the receiving institution's own account holders, feeding the Open Finance Brazil reciprocity queries. The body is forwarded unchanged to the tenant's reciprocity repository, identified by the client_id present in the access token (never by header). The write is an idempotent upsert keyed by CPF; records submitted by the partner always take precedence over the records created automatically by the gateway after consent authorisation and are never overwritten by them.

The repository validates the presence of the top-level fields updateDateTime, personalId, brandName, civilName, birthDate, hasBrazilianNationality and contacts, plus documents.cpfNumber with exactly 11 digits. Additional fields are accepted but discarded on storage.

Authorizations:
BearerAuth
Request Body schema: application/json
required
updateDateTime
required
string <date-time>

Timestamp of the record's last update, per RFC-3339, UTC format.

personalId
required
any

Identifier of the natural person at the institution, per the Open Finance Brazil standard.

brandName
required
string

Brand name of the institution registering the account holder.

civilName
required
string

Full civil name of the natural person.

birthDate
required
string <date>

Date of birth of the natural person.

hasBrazilianNationality
required
boolean

Indicates whether the natural person holds Brazilian nationality.

required
object
required
object

Contact details of the natural person. The persisted subfields are postalAddresses (isMain, address, townName, postCode, country), phones (isMain, type, areaCode, number) and emails (isMain, email); other subfields are discarded on storage.

Responses

Request samples

Content type
application/json
{
  • "updateDateTime": "2021-05-21T08:30:00Z",
  • "personalId": null,
  • "brandName": "Organização AA",
  • "civilName": "Juan Kaique Cláudio Fernandes",
  • "birthDate": "1990-08-15",
  • "hasBrazilianNationality": true,
  • "documents": {
    },
  • "contacts": {
    }
}

Response samples

Content type
application/json
{
  • "data": {
    }
}

Register an account holder's business identification records for reciprocity.

Registers the business (legal-entity) identification records of the receiving institution's own account holders, feeding the Open Finance Brazil reciprocity queries. Applies only to institutions that serve legal-entity customers. The body is forwarded unchanged to the tenant's reciprocity repository, identified by the client_id present in the access token (never by header). The write is an idempotent upsert keyed by CNPJ.

Unlike the personal registration, the business registration has no precedence by origin: every write overwrites the previous one, whether it came from the partner or was created automatically by the gateway after consent authorisation.

The repository validates the presence of the top-level fields updateDateTime, businessId, brandName, companyName, incorporationDate, parties and contacts, plus cnpjNumber with exactly 14 digits. Note that the CNPJ is sent at the top level of the body, not inside documents as in the personal registration. Additional fields are accepted but discarded on storage.

Business qualification and financial-relations lookups have no registration endpoint of their own: the reciprocity repository derives both from this same body.

Authorizations:
BearerAuth
Request Body schema: application/json
required
updateDateTime
required
string <date-time>

Timestamp of the record's last update, per RFC-3339, UTC format.

businessId
required
string

Identifier of the legal entity at the institution, per the Open Finance Brazil standard.

brandName
required
string

Brand name of the institution registering the account holder.

companyName
required
string

Registered corporate name of the legal entity.

incorporationDate
required
string <date-time>

Date the company was incorporated, per RFC-3339.

cnpjNumber
required
string <= 14 characters ^\d{14}$

CNPJ of the legal entity, exactly 14 digits. Key of the record in the reciprocity repository. Sent at the top level of the body, not inside documents as in the personal registration.

required
Array of objects

Parties related to the legal entity (partners, administrators). The persisted subfields are personType, type, documentType and documentNumber; other subfields are discarded on storage.

required
object

Contact details of the legal entity. The persisted subfields are postalAddresses (isMain, townName, country, countryCode), phones (isMain, type, areaCode, number) and emails (isMain, email); other subfields are discarded on storage.

Responses

Request samples

Content type
application/json
{
  • "updateDateTime": "2021-05-21T08:30:00Z",
  • "businessId": "578-psd-71md6971kjh-2d414",
  • "brandName": "Organização A",
  • "companyName": "Luiza e Benjamin Assessoria Jurídica Ltda",
  • "incorporationDate": "2021-05-21T08:30:00Z",
  • "cnpjNumber": "12345678000199",
  • "parties": [
    ],
  • "contacts": {
    }
}

Response samples

Content type
application/json
{
  • "data": {
    }
}

Get the redirect URL to the shared consent-management portal.

Method for obtaining the redirect URL to the shared consent-management portal. The contract has two sides: the partner calls this endpoint on the gateway with Bearer authentication, providing the customer document; the gateway internally signs a PS256 JWT with the customer and brand data and sends it (Content-Type application/jwt) to the shared portal configured for the client, which responds with the redirect URL. The partner receives only the redirectUrl field (the JWT is never exposed to the partner) and must redirect the end user to that URL, where they can view and manage their consents.

Authorizations:
BearerAuth
Request Body schema: application/json
required
document
required
string

CPF (11 dígitos) ou CNPJ (14 dígitos) do cliente. Caracteres de formatação (pontos, traços e barras) são removidos antes da validação; o gateway valida apenas o comprimento resultante (11 ou 14 caracteres), sem verificar se são dígitos.

representativeCpf
string

CPF do representante legal, utilizado apenas quando document é um CNPJ.

Responses

Request samples

Content type
application/json
{
  • "document": "12345678901",
  • "representativeCpf": "12345678901"
}

Response samples

Content type
application/json
{}

Backoffice

Backoffice endpoints for querying and revoking out-of-band (OOB) consents. Requests are passed through transparently to the upstream consent service; the gateway attaches its own OIDC credential to the upstream call. The partner token is never forwarded.

List out-of-band (OOB) consents.

Method for listing out-of-band (OOB) consents. The request is passed through transparently to the upstream consent service: the gateway authenticates the partner with the usual Bearer token (no additional scope) and attaches its own OIDC credential to the upstream call; the partner token is never forwarded. The upstream response body is returned unchanged. Scalar query parameters (for example cpf and page-size) are passed through unchanged; array-style parameters (k[]=...) are silently discarded.

Availability depends on per-instance configuration: in production the flow returns 503 BACKOFFICE_DISABLED until the instance's backoffice OIDC credentials are provisioned by Cumbuca; in homologation it works by default.

Authorizations:
BearerAuth
query Parameters
cpf
string

Filter by CPF, passed through unchanged to the upstream service.

page-size
string

Page size, passed through unchanged to the upstream service.

Responses

Response samples

Content type
application/json
{ }

Get an out-of-band (OOB) consent by its identifier.

Method for retrieving an out-of-band (OOB) consent by its identifier. The request is passed through transparently to the upstream consent service, with the same authentication and the same per-instance availability as the listing. The consentId is a URN (for example urn:bancoex:C1DD33123) and must be sent raw; the gateway encodes the %, /, ? and # characters in the path segment and preserves the ':'.

Authorizations:
BearerAuth
path Parameters
consentId
required
string

Consent identifier in URN format (for example urn:bancoex:C1DD33123), sent raw in the path.

Responses

Response samples

Content type
application/json
{ }

Update (revoke) an out-of-band (OOB) consent.

Method for updating (revoking) an out-of-band (OOB) consent. The JSON body is passed through unchanged to the upstream consent service (plain JSON, no JWS and no data envelope); the state change happens entirely in the upstream service and the gateway stores nothing. Same authentication and same per-instance availability as the listing.

Warning: the gateway never retries PATCH requests on transport failures (only GETs are retried), so a 502 on this operation is indeterminate: the revocation may or may not have reached the upstream service. Confirm the consent state with GET /backoffice/open-banking/oob-consents/v1/consents/{consentId} before retrying.

Authorizations:
BearerAuth
path Parameters
consentId
required
string

Consent identifier in URN format (for example urn:bancoex:C1DD33123), sent raw in the path.

Request Body schema: application/json
required
object

Corpo JSON opaco; objetos são repassados sem alterações ao serviço upstream (JSON com raiz não-objeto é reempacotado pelo gateway sob a chave _json). O formato segue o contrato do serviço upstream de consentimentos OOB e não é validado pelo gateway.

Responses

Request samples

Content type
application/json
{
  • "revocation": {
    }
}

Response samples

Content type
application/json
{ }