Operate / Operator API reference

Operator API reference

The setup & administration endpoints an operator or workspace admin uses to stand a tenant up and keep it running — bank connections and channel activation, approvals, users, workspace/company admin, and session sign-in. These are session-authenticated (an X-API-Key gets 403); the day-to-day integration surface is in the API reference.

Download the spec: openapi.json · openapi.yaml — the full spec covers both tracks.

Connections

Bank connection setup, channel activation, and EBICS onboarding (session-authenticated, Admin only)

GET/connectivity/profiles

List connectivity profiles (channel info per bank)

Read-only metadata: which channel each bank uses (sftp / danske-ws / nordea-ca / bankconnect / ebics), its pre-known server/endpoint details, and SFTP wizard config. No auth required.

Responses

Status	Description
200	Connectivity profiles

Example response (200)

{
  "items": [
    {
      "bankKey": "string",
      "bankName": "string",
      "channelType": "sftp",
      "wsVariant": "string",
      "bankPgpPublicKey": "string",
      "bankPgpKeySlug": "string",
      "sshKeyType": "string"
    }
  ]
}

GET/connections

List bank connections for a company

Parameters

Name	In	Required	Description
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	Connection list
401	Sign in required

Example response (200)

{
  "items": [
    {
      "id": "string",
      "platformId": "string",
      "companyId": "string",
      "bankKey": "string",
      "bankName": "string",
      "coveredBankKeys": [
        "string"
      ],
      "status": "setup",
      "deliveryMode": "converted-only",
      "environment": "test",
      "channelType": "sftp",
      "sftp": {
        "host": "string",
        "port": 0,
        "username": "string",
        "uploadPath": "string",
        "downloadPath": "string",
        "downloadHost": "string",
        "answers": {},
        "filename": "string",
        "hostFingerprint": "string",
        "downloadHostFingerprint": "string",
        "allowPlaintext": false,
        "expectedInboundEncryption": "pgp",
        "tietoevry": {
          "code": "string",
          "orgNo": "string",
          "custId": "string",
          "bankId": "string",
          "env": "test"
        },
        "demo": {
          "outcome": "accepted",
          "delaySeconds": 0,
          "rejectReason": "string",
          "auto": false
        }
      },
      "webservice": {
        "wsVariant": "danske",
        "endpoint": "string",
        "pkiEndpoint": "string",
        "customerId": "string",
        "senderId": "string",
        "functionId": "string",
        "targetId": "string",
        "receiverId": "string",
        "environment": "TEST",
        "signingCertFingerprint": "string",
        "bankCertAdded": false
      },
      "ebics": {
        "url": "string",
        "hostId": "string",
        "partnerId": "string",
        "userId": "string",
        "protocolVersion": "string",
        "subscriberMode": "technical",
        "signatureVersion": "A005",
        "state": "created",
        "lettersPostedAt": "string",
        "modulusLength": 0,
        "subscriberId": "string",
        "subscriberSignatureCertPem": "string",
        "subscriberAuthCertPem": "string",
        "subscriberEncryptionCertPem": "string",
        "bankAuthPublicKeyPem": "string",
        "bankEncryptionPublicKeyPem": "string",
        "bankKeyHashesPinned": {
          "authentication": "string",
          "encryption": "string"
        },
        "perUserActivation": {
          "required": 0,
          "active": 0
        },
        "signatureProfile": "T",
        "keyManagement": "key",
        "veuOnly": false,
        "uploaderUserId": "string",
        "hev": {
          "checkedAt": "string",
          "versions": [],
          "h005Supported": false,
          "ok": false,
          "message": "string",
          "source": "connection"
        },
        "discovery": {
          "via": "HTD",
          "customerName": "string",
          "hostId": "string",
          "accounts": [],
          "orderInfo": [],
          "users": [],
          "fetchedAt": "string"
        },
        "stagedRenewal": {
          "subscriberMode": "technical",
          "userId": "string",
          "ebicsUserId": "string",
          "signatureVersion": "A005",
          "modulusLength": 0,
          "signatureCertPem": "string",
          "authCertPem": "string",
          "encryptionCertPem": "string",
          "signatureKeyEnc": "string",
          "authKeyEnc": "string",
          "encryptionKeyEnc": "string",
          "startedAt": "string",
          "ambiguous": false
        }
      },
      "pgpFingerprint": "string",
      "pgpPublicKey": "string",
      "pgpExpiresAt": "string",
      "bankPgpPublicKey": "string",
      "usePlatformBankKey": false,
      "bankKeyFingerprintPin": "string",
      "bankPgpKeyInfo": {
        "keyId": "string",
        "fingerprint": "string",
        "userId": "string",
        "algorithm": "string",
        "createdAt": "string",
        "expiresAt": "string"
      },
      "sshPublicKey": "string",
      "sshPublicKeyArmored": "string",
      "sshFingerprint": "string",
      "sshKeyType": "ed25519",
      "approverUserIds": [
        "string"
      ],
      "steps": {
        "introEmailSent": false,
        "pgpGenerated": false,
        "bankPublicKeyAdded": false,
        "serverInfoAdded": false,
        "sftpUserAdded": false,
        "wsConfigAdded": false,
        "bankCertAdded": false,
        "certsIssued": false,
        "hevChecked": false,
        "ebicsKeysGenerated": false,
        "ebicsIniHiaSent": false,
        "ebicsLetterSent": false,
        "ebicsBankKeysFetched": false,
        "approversAssigned": false
      },
      "ingestedFiles": [
        "string"
      ],
      "productionVerifiedAt": "string",
      "connectedAt": "string",
      "testChannelSupported": false,
      "signingCertExpiresAt": "string",
      "tlsPins": [
        "string"
      ],
      "wsCertExpiresAt": "string",
      "certAlertSent": {},
      "pollIntervalSeconds": 0,
      "lastPolledAt": "string",
      "consecutivePollFailures": 0,
      "pollFailureAlertSentAt": "string",
      "sendsPaused": false,
      "sendsPausedAt": "string",
      "sendsPausedReason": "string",
      "createdAt": "string",
      "updatedAt": "string",
      "signingCertSubject": "string",
      "signingCertExpiry": "string",
      "inboundHealth": {
        "status": "live",
        "consecutiveFailures": 0,
        "threshold": 0,
        "reasons": [
          "string"
        ]
      }
    }
  ]
}

POST/connections

Create (or find existing) bank connection: starts the setup wizard

Creates a bank connection for the given company, or returns the existing one if already set up. Platform-admin note: if you are authenticated as a workspace (platform) admin, you must enter a company context first via POST /auth/company-context before calling this endpoint. Without it you will receive: "select a company context first."

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	yes
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
201	Connection created
400	Invalid request
401	Sign in required
403	Admin required

Example response (201)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

GET/connections/{id}

Get a single connection + readiness

Parameters

Name	In	Required	Description
`id` string	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	Connection + readiness
404	Not found

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "sftpWizard": [],
  "platformBankKey": {
    "available": false,
    "fingerprint": "string",
    "validTo": "string",
    "uid": "string",
    "usable": false,
    "unusableReason": "string"
  }
}

DELETE/connections/{id}

Delete a bank channel (Admin) — irreversible

Deletes this bank channel. The channel's stored credentials are destroyed and cannot be recovered — its private PGP/SSH keys, SFTP password and every Web Services signing and encryption key and certificate. Every cross-organisation grant of the connection is revoked, so a subsidiary sharing it stops sending immediately. Payments already approved but not yet delivered over this channel will FAIL delivery; new payments to this bank are refused with 422 validation_failed until a channel is set up again from scratch. What is NOT destroyed: the payment, statement and audit history stays intact and still resolves — the connection survives as a tombstone precisely so it does. If this was the bank's last channel, the bank is also taken off "Your banks".

⚠️ A production channel, or one that is currently live, additionally requires ?confirm=<bankKey>; without it the request is refused with 400 confirmation_required. Any EBICS download transactions the bank still holds open cannot be receipted from here once the keys are gone — the response reports how many there were.

Parameters

Name	In	Required	Description
`id` string	path	yes
`confirm` string	query	no	The connection's own `bankKey`. REQUIRED when the channel is production or live; ignored otherwise.
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	Channel deleted — the body is the receipt (what was destroyed, and what survived)
400	Confirmation required — re-send with ?confirm=<bankKey>
401	Sign in required
403	Admin required
404	Not found (unknown connection, or one that was already deleted)

Example response (200)

{
  "deleted": false,
  "bankKey": "string",
  "environment": "test",
  "secretsDestroyed": 0,
  "grantsRevoked": 0,
  "inboundAttemptsCleared": 0,
  "openEbicsTransactions": 0,
  "bankUnselected": false
}

GET/connections/{id}/health

Channel health for one connection

The three health facts the channel dashboard renders: payments the bank accepted (a count over the last windowDays days plus when the most recent acceptance landed, and how many were rejected), statements received (a count plus the newest one's ISO document type and the format the bank actually sent), and the inbound endpoint (this connection's poll cadence and when it was last polled). Also carries the derived inboundHealth — the same live/degraded/down judgement, on one shared failure threshold, that every connection read and the operator channel-health board make — and the connection's own lifecycle connectionStatus, so a channel that has never been activated is not mistaken for one that is failing. Each count is windowed on the same event as the timestamp beside it — paymentsAccepted counts the acceptances and rejections that HAPPENED in the last windowDays days, statementsReceived counts the statements that ARRIVED in them — while the last… timestamps themselves are not windowed, so a channel that went quiet reports when it last worked rather than null.

Parameters

Name	In	Required	Description
`id` string	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	Channel health
404	Not found

Example response (200)

{
  "connectionId": "string",
  "bankKey": "string",
  "environment": "test",
  "connectionStatus": "setup",
  "status": "live",
  "inboundHealth": {
    "status": "live",
    "consecutiveFailures": 0,
    "threshold": 0,
    "reasons": [
      "string"
    ]
  },
  "windowDays": 0,
  "paymentsAccepted": {
    "count": 0,
    "lastAcceptedAt": "string",
    "rejectedCount": 0
  },
  "statementsReceived": {
    "count": 0,
    "lastReceivedAt": "string",
    "lastType": "string",
    "lastSourceFormat": "string"
  },
  "endpoint": {
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string"
  }
}

GET/connections/{id}/test-files

The SFTP test round's files, grouped by country

The test files this connection has to get through before it goes live, grouped by the COUNTRY each belongs to. The countries are the connection's own claimed coverage (coveredBankKeys — a country belongs to exactly one connection per company and environment), and each country's file list comes from that country's bank: a bank offering no domestic rail simply has fewer files, so the n of m counter's denominator is per country and never a constant.

Each row's state is DERIVED from the payment it describes and is stored nowhere — a pain.002 coming back advances that payment's own status on ingest, and this read follows it, so a row can never disagree with the payment. The exception, and the reason this endpoint exists at all, is accepted-by-person: plenty of banks send no pain.002 at all and confirm a test round by email, by phone, or by simply switching the channel on, so a named human marking a file accepted is a first-class path. 🔴 accepted-by-bank and accepted-by-person are SEPARATE states and are never collapsed into one accepted — 'the bank confirmed' and 'a person said the bank confirmed' carry different weight the first time a test round is disputed. Where both exist, the bank's verdict decides state and the person's record is still served beside it.

items is one entry per country (total counts countries); fileCount / acceptedCount at the top level count files across all of them.

Parameters

Name	In	Required	Description
`id` string	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	The test files, grouped by country
404	Not found

Example response (200)

{
  "connectionId": "string",
  "bankKey": "string",
  "environment": "test",
  "items": [
    {
      "country": "string",
      "countryName": "string",
      "bankKeys": [
        "string"
      ],
      "files": [
        {
          "bankKey": "string",
          "scenario": "string",
          "label": "string",
          "description": "string",
          "amount": "string",
          "currency": "string",
          "paymentType": "string",
          "state": "ready",
          "accepted": false,
          "payment": {},
          "acceptance": {},
          "withdrawal": {}
        }
      ],
      "acceptedCount": 0,
      "fileCount": 0
    }
  ],
  "total": 0,
  "acceptedCount": 0,
  "fileCount": 0
}

POST/connections/{id}/test-files/acceptance

Record — or withdraw — that a person accepted a test file

Records that a named person confirmed the bank accepted one test file, out of band. Admin only, and audited: the stored entry carries WHO (user id and the name as it stood at the time) and WHEN, the same triple the maker-checker approval trail uses, because this is the evidence behind a go-live decision and a bare boolean would have lost the person.

It is not silently reversible. The log is APPEND-ONLY. action: "withdraw" appends a second entry naming who withdrew it and when; it never deletes, rewrites or hides the original acceptance, and no route can. A withdrawn row falls back to whatever its payment says, and the withdrawal stays readable beside it.

And it is not ambiguous. A file's current standing is the LAST entry for its (bankKey, scenario) pair — one thing, never a set. Accepting a file that is already accepted returns 409 test_file_already_accepted; withdrawing one nobody accepted returns 409 test_file_not_accepted. A (bankKey, scenario) pair that is not a test file on this connection — a country it does not cover, or a scheme this bank does not offer — is refused with 422 unknown_test_file rather than stored where nothing could render or withdraw it.

Nothing here can un-say what the BANK said: where a pain.002 has arrived the row's state is derived from the payment, and this route cannot reach it. Answers the same body as GET /connections/{id}/test-files, refreshed.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	yes
`bankKey`	string	yes	The covered bankKey the file belongs to — the country, in the connection's own coverage model.
`scenario`	string	yes	The test scenario id, as `GET /connections/{id}/test-files` reports it.
`action`	enum	yes
`note`	string	no	Optional free text kept with the record — how the bank confirmed, or why an acceptance was withdrawn.

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "scenario": "string",
  "action": "accept",
  "note": "string"
}

Responses

Status	Description
200	Recorded — the refreshed test-file view
404	Not found
409	Already accepted, or nothing to withdraw
422	Not a test file on this connection

Example response (200)

{
  "connectionId": "string",
  "bankKey": "string",
  "environment": "test",
  "items": [
    {
      "country": "string",
      "countryName": "string",
      "bankKeys": [
        "string"
      ],
      "files": [
        {
          "bankKey": "string",
          "scenario": "string",
          "label": "string",
          "description": "string",
          "amount": "string",
          "currency": "string",
          "paymentType": "string",
          "state": "ready",
          "accepted": false,
          "payment": {},
          "acceptance": {},
          "withdrawal": {}
        }
      ],
      "acceptedCount": 0,
      "fileCount": 0
    }
  ],
  "total": 0,
  "acceptedCount": 0,
  "fileCount": 0
}

PUT/connections/{id}/signing-cert

Pin the bank's published signing certificate

Stores the bank's PUBLISHED X.509 signing certificate (PEM or base64-DER) on the connection so inbound Web Services signatures are verified against it (fail-closed on any mismatch). Admin only. Validates the cert parses (400 on bad input). Returns the cert subject + expiry so the operator can confirm they pinned the right cert; the raw PEM is never returned. GET /connections/{id} then surfaces signingCertSubject / signingCertExpiry.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`cert`	string	yes	The bank's published signing certificate — PEM (-----BEGIN CERTIFICATE-----) or base64-DER.

Example

{
  "platformId": "string",
  "companyId": "string",
  "cert": "string"
}

Responses

Status	Description
200	Pinned
400	Bad certificate or non-WS connection
401	Sign in required
403	Admin required

Example response (200)

{
  "connectionId": "string",
  "certSubject": "string",
  "certExpiry": "string"
}

POST/connections/{id}/generate-pgp

Generate our PGP key pair (SFTP channel)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	PGP key pair generated
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/generate-abn-xmldsig-key

Generate our ABN AMRO Access Direct XML-Signature key (SFTP channel, ABN AMRO only)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Signing key generated
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/bank-key

Save the bank's PGP public key (SFTP channel)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	yes	ASCII-armored PGP public key block.
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Bank key saved
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/server-info

Save SFTP server info (host, port, paths, fingerprint)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	yes
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Server info saved
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/sftp-user

Set SFTP username and generate SSH key pair (single combined call)

Sets the SFTP username AND generates the SSH key pair in one call: you cannot pre-generate the key before you have the username. The username must be obtained from the bank first; only then can you call this endpoint. The response includes the connection + readiness state, from which you can retrieve the generated SSH public key to send to the bank for whitelisting.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	yes	SFTP username assigned by the bank. Required: the SSH key generation and username registration are a single atomic operation.
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Username set + SSH key generated
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/approvers

Assign approver users to a connection

Assigns which users may approve payments on this connection. Approvers and approval policy are separate: the policy (under POST /approvals/policies) defines the rule (how many approvers, any amount thresholds); this endpoint assigns the eligible users per connection. Both must be in place for a connection to reach go-live. Note: users must first exist in the company: create them with POST /users before assigning them as approvers.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	yes	User IDs of company members with the Approver role. Must already exist in the company. Max 200 (enforced server-side): each id costs a user lookup, so the list is bounded rather than unbounded input behind admin auth.
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Approvers assigned
401	Sign in required
403	Admin required
422	One or more user IDs are not valid approvers in this company

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "pendingPolicyChange": {
    "id": "string",
    "proposedBy": {
      "userId": "string",
      "name": "string"
    },
    "status": "pending",
    "cosigns": [
      {
        "adminId": "string",
        "name": "string",
        "at": "string"
      }
    ],
    "requiredCosigns": 0,
    "weakening": [
      {
        "field": "string",
        "from": "string",
        "to": "string",
        "why": "string"
      }
    ],
    "blastRadius": {
      "banks": 0,
      "exact": false,
      "label": "string"
    },
    "createdAt": "string",
    "activatedAt": "string",
    "cancelledAt": "string",
    "kind": "string",
    "basePolicyId": "string",
    "draftPolicyId": "string"
  }
}

POST/connections/{id}/activate

Mark SFTP connection active (after the bank has whitelisted the SSH key)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Connection activated
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/intro-email-sent

Mark intro email as sent (tracks wizard progress)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Updated
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "introEmailAutoSent": false
}

POST/connections/{id}/ws-environment

Toggle a Web Services connection between TEST and PRODUCTION (development servers only)

Requires an already-activated connection (certificates issued); does not re-run PKI. DEVELOPMENT-ONLY: a production or deployed-sandbox server refuses this call with 403 ws_environment_toggle_disabled. A connection transmits under the environment its own immutable environment field declares, which is fixed when the connection is created.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	yes
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Environment updated
401	Sign in required
403	Admin required, or the toggle is disabled on this server (development-only)

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/covered-banks

Set which member banks a shared connection covers

For a shared (group) connection. The store clamps the set to the bank's group and always includes the connection's own bank.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	yes	Bank keys this connection serves (clamped to the bank's group).
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Covered banks updated
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

GET/connections/{id}/intro-email

Render the bank intro email (draft to send to the bank contact)

Parameters

Name	In	Required	Description
`id` string	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	Rendered email (subject + body)
404	Not found

Example response (200)

{
  "email": {
    "to": "string",
    "subject": "string",
    "body": "string"
  }
}

GET/connections/{id}/capability-sheet

Download the host-to-host capability sheet (PDF, base64-encoded)

The 2-page sheet attached to the agreement-request email: the payment schemes we offer through this bank in each country it covers, the pain.001 version and packaging we send, the files we need back, and how we connect. Every value is resolved from the bank registry and the payment-type catalog, never hand-written. A value we cannot source is OMITTED from the document and named in unknowns.

Parameters

Name	In	Required	Description
`id` string	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	PDF as base64, plus the fields the sheet could not state
404	Connection not found
409	The bank agreement pins a pain.001 version this bank does not support

Example response (200)

{
  "pdfBase64": "string",
  "filename": "string",
  "unknowns": [
    "string"
  ]
}

GET/banks/{bankKey}/setup-info

Per-bank setup descriptor for the wizard UI

Returns the channel kind, requirements text, field definitions, pre-known server/endpoint details, and SFTP wizard screens for a bank. Used by the setup wizard to render the correct flow.

Parameters

Name	In	Required	Description
`bankKey` BankKey	path	yes

Responses

Status	Description
200	Setup descriptor
404	Unknown bank

Example response (200)

{
  "bankKey": "string",
  "bankName": "string",
  "countryCode": "string",
  "painVersion": "string",
  "painVersions": [
    "string"
  ],
  "channelType": "string",
  "wsVariant": "string",
  "kind": "string",
  "requirementsText": "string",
  "wizard": {
    "kind": "string",
    "screens": [
      {
        "id": "string",
        "phase": "prepare",
        "title": "string",
        "short": "string",
        "intro": "string",
        "bullets": [
          "string"
        ],
        "notice": "string",
        "steps": [
          {}
        ],
        "unnumbered": false
      }
    ],
    "turns": [
      {
        "id": "prepare",
        "title": "string",
        "short": "string",
        "intro": "string",
        "bullets": [
          "string"
        ],
        "notice": "string",
        "steps": [
          {}
        ],
        "gate": {
          "unlocksAt": "created",
          "awaitsBankAt": "created",
          "resumesAt": "created",
          "completesAt": "created",
          "terminal": false
        }
      }
    ]
  },
  "bankPgpPublicKeyKnown": false,
  "sshKeyType": "string",
  "supportsEnvironmentToggle": false,
  "generalSettingsEnabled": false,
  "locked": false,
  "unlockOn": "string",
  "lockNote": "string"
}

POST/banks/{bankKey}/guide-feedback

Report that a bank's setup guide is wrong

Sends the customer's note about a bank's setup guide to BankConnector. The bank, its data central, the company and the platform are attached server-side from the route + session — the body carries only the message, so a caller cannot file feedback as another company.

Parameters

Name	In	Required	Description
`bankKey` BankKey	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`message`	string	yes	What was confusing, or what the bank did differently.

Example

{
  "platformId": "string",
  "companyId": "string",
  "message": "string"
}

Responses

Status	Description
200	Feedback sent
400	Empty or over-long message
401	Not signed in
404	Unknown bank
502	The feedback could not be mailed — retry

Example response (200)

{
  "sent": false
}

POST/banks/{bankKey}/setup-telemetry

Record one setup-card measurement

Setup-card telemetry (ADR-0110 §4). Three measurements, three event names, and they are NEVER summed: card-active is how long the customer worked on one card, bank-wait is how long the bank held that turn, and premature-advance counts a customer settling a turn the bank has not handed back. ms accompanies the first two and must be omitted for the third. environment (test or production) is required — a bank-wait reading is only a fact about a real bank when it came from the production connection, and the operator aggregate groups on it for that reason. The payload is the bank, the channel, the environment, the served turn id and one duration — nothing a setup step collected travels here. Readable only on the operator plane, never by a tenant or a platform admin.

Parameters

Name	In	Required	Description
`bankKey` BankKey	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`event`	enum	yes
`channel`	enum	yes
`environment`	enum	yes
`turnId`	string	yes
`ms`	integer	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "event": "card-active",
  "channel": "sftp",
  "environment": "test",
  "turnId": "string",
  "ms": 0
}

Responses

Status	Description
202	Measurement accepted (recording is fire-and-forget)
400	Unknown event, malformed turn id, or a duration the event cannot carry
401	Not signed in
404	Unknown bank

Example response (202)

{
  "accepted": false
}

GET/banks/{bankKey}/settings

Get per-company settings for a specific bank

Parameters

Name	In	Required	Description
`bankKey` BankKey	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	Bank settings (null if none saved)

Example response (200)

{
  "settings": {
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "agreementId": "string",
    "debtorAgreementId": "string",
    "chargeBearer": "DEBT",
    "executionDateOffsetDays": 0,
    "approvalPolicyId": "string",
    "painVersion": "pain.001.001.03",
    "batchBooking": false,
    "authorisationCode": "AUTH",
    "authorisationProprietary": "string",
    "noApproverAuthReference": "string",
    "noApproverAuthVendor": "string",
    "noApproverAuthMethod": "string",
    "selected": false,
    "setupStep": "string",
    "updatedAt": "string"
  }
}

PATCH/banks/{bankKey}/settings

Update per-company settings for a specific bank (partial patch)

Payment-affecting fields (agreementId, debtorAgreementId, chargeBearer, executionDateOffsetDays, approvalPolicyId, painVersion, batchBooking, authorisationCode, authorisationProprietary) require Admin. The selected pin is open to any member. debtorAgreementId is the bank's second agreement identifier (e.g. the Nordea CAW/CCM agreement number) — auto-filled into payments[i].debtor.organisationId (scheme BANK) when the payment omits it; agreementId fills initiatingParty.organisationId (scheme CUST). batchBooking and the authorisation pair are per-AGREEMENT pain.001 facts (PmtInf/BtchBookg and GrpHdr/Authstn): omit or send null to keep the bank profile's default. authorisationCode (ISO Authorisation1Code) and authorisationProprietary are mutually exclusive — sending both is a 400.

Parameters

Name	In	Required	Description
`bankKey` BankKey	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`agreementId`	object	no
`debtorAgreementId`	object	no
`chargeBearer`	object	no
`executionDateOffsetDays`	object	no
`approvalPolicyId`	object	no
`painVersion`	object	no
`batchBooking`	object	no
`authorisationCode`	object	no
`authorisationProprietary`	object	no
`noApproverAuthReference`	object	no
`noApproverAuthVendor`	object	no
`noApproverAuthMethod`	object	no
`selected`	boolean	no
`setupStep`	object	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "agreementId": "string",
  "debtorAgreementId": "string",
  "chargeBearer": "string",
  "executionDateOffsetDays": 0,
  "approvalPolicyId": "string",
  "painVersion": "string",
  "batchBooking": false,
  "authorisationCode": "string",
  "authorisationProprietary": "string",
  "noApproverAuthReference": "string",
  "noApproverAuthVendor": "string",
  "noApproverAuthMethod": "string",
  "selected": false,
  "setupStep": "string"
}

Responses

Status	Description
200	Settings saved
202	Settings saved, but the approval-policy re-bind needs a second Admin's co-sign
401	Sign in required
403	Admin required for payment-affecting fields

Example response (200)

{
  "settings": {
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "agreementId": "string",
    "debtorAgreementId": "string",
    "chargeBearer": "DEBT",
    "executionDateOffsetDays": 0,
    "approvalPolicyId": "string",
    "painVersion": "pain.001.001.03",
    "batchBooking": false,
    "authorisationCode": "AUTH",
    "authorisationProprietary": "string",
    "noApproverAuthReference": "string",
    "noApproverAuthVendor": "string",
    "noApproverAuthMethod": "string",
    "selected": false,
    "setupStep": "string",
    "updatedAt": "string"
  }
}

GET/bank-settings

List all per-company bank settings in one call

Parameters

Name	In	Required	Description
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	All saved bank settings for this company

Example response (200)

{
  "settings": [
    {
      "platformId": "string",
      "companyId": "string",
      "bankKey": "string",
      "agreementId": "string",
      "debtorAgreementId": "string",
      "chargeBearer": "DEBT",
      "executionDateOffsetDays": 0,
      "approvalPolicyId": "string",
      "painVersion": "pain.001.001.03",
      "batchBooking": false,
      "authorisationCode": "AUTH",
      "authorisationProprietary": "string",
      "noApproverAuthReference": "string",
      "noApproverAuthVendor": "string",
      "noApproverAuthMethod": "string",
      "selected": false,
      "setupStep": "string",
      "updatedAt": "string",
      "setupStepInfo": {
        "index": 0,
        "total": 0,
        "label": "string"
      }
    }
  ]
}

POST/connections/{id}/activate-danske

Activate Danske EDI Web Services (automated cert enrolment)

Calls the Danske bxd.fi activation endpoint with the one-time PIN, self-issues the signing + encryption certificates, and marks the connection active. Admin only.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`userId`	string	yes	Agreement number (User ID) from Danske.
`pin`	string	yes	One-time transfer key from Danske.

Example

{
  "platformId": "string",
  "companyId": "string",
  "userId": "string",
  "pin": "string"
}

Responses

Status	Description
200	Activated
400	Activation failed (wrong PIN, network, etc.)
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  }
}

POST/connections/{id}/activate-nordea

Activate Nordea Corporate Access (HMAC cert enrolment via SMS code)

Generates a Nordea-format signing CSR, sends the HMAC-signed enrolment request to Nordea's Corporate Access endpoint using the SMS activation code, and stores the issued certificate. Admin only.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`holderName`	string	yes	Certificate-holder name (CN) as printed in the Nordea agreement.
`username`	string	no
`signerId`	string	yes	Signer ID from the agreement.
`senderId`	string	no
`country`	string	yes
`activationCode`	string	yes	10-digit SMS activation code from Nordea.

Example

{
  "platformId": "string",
  "companyId": "string",
  "holderName": "string",
  "username": "string",
  "signerId": "string",
  "senderId": "string",
  "country": "string",
  "activationCode": "string"
}

Responses

Status	Description
200	Activated
400	Activation failed
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  }
}

POST/connections/{id}/activate-bankconnect

Activate Bank Connect (DK gateway: automated cert enrolment)

Enrols the signing certificate with the Bank Connect data central (BD/BEC/SDC), stores the issued certificate and bank public key, and marks the connection active. Data central and country are pre-filled from the bank profile. Admin only.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`dataCentral`	string	no
`organisationId`	string	yes	Bank registration number.
`functionId`	string	yes	Per-agreement routing code from the bank.
`holderName`	string	no
`signerId`	string	no
`country`	string	no
`activationCode`	string	yes	One-time activation code from the bank.

Example

{
  "platformId": "string",
  "companyId": "string",
  "dataCentral": "string",
  "organisationId": "string",
  "functionId": "string",
  "holderName": "string",
  "signerId": "string",
  "country": "string",
  "activationCode": "string"
}

Responses

Status	Description
200	Activated
400	Activation failed or bank has no Bank Connect data central
401	Sign in required
403	Admin required
404	Connection not found

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  }
}

POST/connections/{id}/renew-danske

Renew the Danske EDI Web Services certificates

Issues fresh signing + encryption keypairs/CSRs to Danske's PKI via RenewCertificate — the request is enveloped-signed with the current signing certificate and XML-encrypted to the bank certificate (PKI WS spec §7) — and commits the new keys + certificates atomically on success. Run before the 2-year certificate expiry (the cert-expiring alerts fire at 30/14/7 days). A failed renewal leaves the current credentials untouched. Admin only.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Renewed
400	Renewal failed (current credentials left untouched)
401	Sign in required
403	Admin required
404	Connection not found

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  }
}

POST/connections/{id}/renew-op

Renew the OP (Finland) Web Services signing certificate

Issues a fresh keypair + CSR (same subject as the current certificate: CN=WS username, C=FI) to OP's Certificate Service — the CertApplicationRequest is signed with the CURRENT key (guide §4.1.4), so NO transfer key is needed while the current certificate is valid — and commits the new key + certificate atomically on success, refusing a certificate whose public key does not match the CSR (OP silently returns copies of prior certificates). Run before the ~2-year expiry (alerts at 30/14/7 days; the daily auto-renew sweep also acts inside the 30-day horizon): a LAPSED OP certificate cannot be renewed at all — the customer starts over with a NEW transfer key from OP. Admin only.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Renewed
404	Connection not found

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  }
}

POST/connections/{id}/renew-nordea

Renew the Nordea Corporate Access signing certificate

Issues a fresh keypair + CSR (same subject as the current certificate) to Nordea's Certificate Service — the CertApplicationRequest is signed with the current certificate in place of the HMAC (Certificate Management §3.1.2), so no new SMS activation code is needed while the current certificate is valid — and commits the new key + certificate atomically on success. Run before the 2-year expiry (alerts at 30/14/7 days). A failed renewal leaves the current credentials untouched. Admin only.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Renewed
400	Renewal failed (current credentials left untouched)
401	Sign in required
403	Admin required
404	Connection not found

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  }
}

POST/connections/{id}/renew-bankconnect

Renew the Bank Connect customer certificate

Issues a fresh keypair + CSR (CN=functionId) to the Bank Connect data central via renewCustomerCertificate, signed with the current certificate, and commits the new key + certificate atomically on success. Run before the 3-year certificate expiry (the cert-expiring alerts fire at 30/14/7 days); the bank revokes the previous certificate 48 hours after a successful renewal. Admin only.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Renewed
400	Renewal failed (current credentials left untouched)
401	Sign in required
403	Admin required
404	Connection not found

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  }
}

POST/connections/{id}/ebics-params

Save EBICS connection parameters (Host ID, Partner ID, User ID, …)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	yes	EBICS server URL.
`hostId`	string	yes	Bank-assigned Host ID.
`partnerId`	string	yes	Customer ID (PartnerID) from the bank.
`userId`	string	yes	Subscriber ID (UserID) from the bank.
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no	One shared technical subscriber, or one EBICS subscriber per approver.
`veuOnly`	boolean	no	Per-user only: this agreement routes every order through VEU (refuses multi-signature uploads) — delivery uploads one ES and adds the rest via HVE.
`uploaderUserId`	string	no	Per-user only: DESIGNATED uploader (app user id) — which subscriber transports payment uploads and acts for VEU orders. Must be a user in this company; the subscriber must be ACTIVE at delivery time (delivery fails with a clear error otherwise). Empty string clears the designation (default: first active subscriber). May be a non-approver transport-class subscriber for veuOnly agreements.
`signatureProfile`	enum	no	The signature profile this agreement was CONTRACTED on (the French T vs TS), from the bank agreement — not a preference. "TS" (default) means the electronic signature travelling with an order authorises it inside EBICS. "T" means transport only: the order is authorised on a separate channel, so the signature it carries grants no authorisation and the order omits the EBICS signature flag. A "T" subscriber still holds a signature keypair and still completes INI. Omit to leave the stored value unchanged.
`keyManagement`	enum	no	Which bytes of the bank's key material this agreement's fingerprints are taken over — a property of the AGREEMENT, not of the bank (one bank can offer both). "key" (default) is the SHA-256 of the RSA public key (exponent, blank, modulus); "certificate" is the SHA-256 of the DER-encoded X.509 certificate. The two hash different objects, so CHANGING this clears the "bank keys fetched" step: HPB must be re-run to take a fingerprint in the new mode before the connection can be activated again. Omit to leave the stored value unchanged.
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A006",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	EBICS params saved
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/ebics-generate-keys

Generate EBICS subscriber keys (authentication, encryption, signature)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Keys generated
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test"
}

POST/connections/{id}/ebics-fetch-htd

Fetch the bank's record of the EBICS agreement (HTD/HKD) and store the discovery snapshot

Runs EBICS HTD (technical subscriber) or HKD (per-user mode) against the bank and persists the result on the connection: accounts on the agreement, permitted order types/BTFs with bank-side signature quorums, and each subscriber's bank-side status + signature class. Requires the bank keys (run ebics-fetch-hpb first). Pre-activation returns notActivatedYet instead of failing, so it can be polled as an activation check. In per-user mode, approvers the bank reports as ready are advanced to active automatically.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Discovery result (fetched flag, message, and the parsed agreement data when available)
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "discovery": {
    "fetched": false,
    "notActivatedYet": false,
    "code": "string",
    "message": "string",
    "data": {
      "via": "HTD",
      "customerName": "string",
      "hostId": "string",
      "accounts": [
        {
          "id": "string",
          "iban": "string",
          "accountNumber": "string",
          "currency": "string",
          "description": "string",
          "usageOrderTypes": []
        }
      ],
      "orderInfo": [
        {
          "adminOrderType": "string",
          "service": {},
          "description": "string",
          "numSigRequired": 0
        }
      ],
      "users": [
        {
          "ebicsUserId": "string",
          "status": 0,
          "statusLabel": "string",
          "name": "string",
          "permissions": []
        }
      ]
    }
  }
}

POST/connections/{id}/ebics-renew

Rotate the EBICS subscriber keys in-band (HCS)

Sends an HCS order: the NEW three keys (signature/authentication/encryption), authorised by the CURRENT signature key — no new INI letter or bank re-activation. Two-phase and key-loss safe: the new keyset is staged before sending and promoted only on a confirmed accept; an ambiguous (post-commit) outcome keeps both keysets and the next call resolves automatically by probing which keyset the bank accepts. Per-user mode rotates one approver at a time (pass userId).

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no	Per-user mode: the approver whose subscriber to rotate.
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Renewal outcome (renewed \| ambiguous \| resolved-kept-old \| resolved-promoted \| unresolved)
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "renewal": {
    "status": "renewed",
    "message": "string"
  }
}

POST/connections/{id}/ebics-veu-pending

List the orders pending signature at the bank (EBICS VEU / HVU)

Read-only: queries the bank's VEU queue via HVU using the first active per-user subscriber as transport. Returns order type + order number, signature progress (done/required), and whether each order is still signable. Per-user connections only. Normally empty - payments arrive fully signed; a veuOnly agreement or an interrupted co-sign parks orders here.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Pending orders (veuPending array on the connection response)
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "veuPending": [
    {
      "orderType": "string",
      "orderId": "string",
      "dataDigest": "string",
      "requiredSignatures": 0,
      "doneSignatures": 0,
      "signable": false
    }
  ]
}

POST/connections/{id}/ebics-suspend

Emergency-suspend the subscriber's EBICS access (SPR)

Sends an authenticated SPR order telling the bank to immediately suspend this subscriber's access — the compromised-key kill switch. One-directional: restoring access requires re-onboarding (new INI/HIA + letter). Also deactivates the connection locally so polling/delivery stops. Per-user mode suspends the named (or first active) approver.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no	Per-user mode: the approver to suspend.
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no
`orderId`	string	no
`orderDigest`	string	no
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Suspend result (bank return code + message)
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "suspend": {
    "code": "string",
    "message": "string"
  }
}

POST/connections/{id}/ebics-veu-complete

Complete an interrupted VEU co-sign for a pending order (HVE)

Re-drives the remaining approvers' HVE signatures for an order the bank is holding. Identify the payment by documentId, or by the pending order's dataDigest (matched server-side to the sent pain.001). Digest re-checked via HVD before signing — never co-signs a mismatched order.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`bankKey`	string	no
`environment`	string	no
`armoredKey`	string	no
`username`	string	no
`host`	string	no
`port`	number	no
`uploadPath`	string	no
`downloadPath`	string	no
`downloadHost`	string	no
`answers`	object	no
`filename`	string	no
`hostFingerprint`	string	no
`downloadHostFingerprint`	string	no
`userIds`	string[]	no
`url`	string	no
`hostId`	string	no
`partnerId`	string	no
`userId`	string	no
`protocolVersion`	enum	no
`signatureVersion`	enum	no
`subscriberMode`	enum	no
`veuOnly`	boolean	no
`uploaderUserId`	string	no
`signatureProfile`	enum	no
`keyManagement`	enum	no
`documentId`	string	no	The sent payment (its frozen pain.001 is signed).
`orderId`	string	no	The bank order number to select the pending order.
`orderDigest`	string	no	The pending order's dataDigest, to resolve the payment.
`ebicsUserId`	string	no
`state`	string	no
`coveredBankKeys`	string[]	no
`supported`	boolean	no
`use`	boolean	no
`fingerprintPin`	string	no
`demoOutcome`	enum	no
`demoDelaySeconds`	integer	no
`demoAuto`	boolean	no
`demoRejectReason`	string	no
`introEmailTo`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "bankKey": "string",
  "environment": "string",
  "armoredKey": "string",
  "username": "string",
  "host": "string",
  "port": 0,
  "uploadPath": "string",
  "downloadPath": "string",
  "downloadHost": "string",
  "answers": {},
  "filename": "string",
  "hostFingerprint": "string",
  "downloadHostFingerprint": "string",
  "userIds": [
    "string"
  ],
  "url": "string",
  "hostId": "string",
  "partnerId": "string",
  "userId": "string",
  "protocolVersion": "H005",
  "signatureVersion": "A005",
  "subscriberMode": "technical",
  "veuOnly": false,
  "uploaderUserId": "string",
  "signatureProfile": "T",
  "keyManagement": "key",
  "documentId": "string",
  "orderId": "string",
  "orderDigest": "string",
  "ebicsUserId": "string",
  "state": "string",
  "coveredBankKeys": [
    "string"
  ],
  "supported": false,
  "use": false,
  "fingerprintPin": "string",
  "demoOutcome": "accepted",
  "demoDelaySeconds": 0,
  "demoAuto": false,
  "demoRejectReason": "string",
  "introEmailTo": "string"
}

Responses

Status	Description
200	Co-sign results (per approver) + executionReady
401	Sign in required
403	Admin required

Example response (200)

{
  "connection": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "bankKey": "string",
    "bankName": "string",
    "coveredBankKeys": [
      "string"
    ],
    "status": "setup",
    "deliveryMode": "converted-only",
    "environment": "test",
    "channelType": "sftp",
    "sftp": {
      "host": "string",
      "port": 0,
      "username": "string",
      "uploadPath": "string",
      "downloadPath": "string",
      "downloadHost": "string",
      "answers": {},
      "filename": "string",
      "hostFingerprint": "string",
      "downloadHostFingerprint": "string",
      "allowPlaintext": false,
      "expectedInboundEncryption": "pgp",
      "tietoevry": {
        "code": "string",
        "orgNo": "string",
        "custId": "string",
        "bankId": "string",
        "env": "test"
      },
      "demo": {
        "outcome": "accepted",
        "delaySeconds": 0,
        "rejectReason": "string",
        "auto": false
      }
    },
    "webservice": {
      "wsVariant": "danske",
      "endpoint": "string",
      "pkiEndpoint": "string",
      "customerId": "string",
      "senderId": "string",
      "functionId": "string",
      "targetId": "string",
      "receiverId": "string",
      "environment": "TEST",
      "signingCertFingerprint": "string",
      "bankCertAdded": false
    },
    "ebics": {
      "url": "string",
      "hostId": "string",
      "partnerId": "string",
      "userId": "string",
      "protocolVersion": "string",
      "subscriberMode": "technical",
      "signatureVersion": "A005",
      "state": "created",
      "lettersPostedAt": "string",
      "modulusLength": 0,
      "subscriberId": "string",
      "subscriberSignatureCertPem": "string",
      "subscriberAuthCertPem": "string",
      "subscriberEncryptionCertPem": "string",
      "bankAuthPublicKeyPem": "string",
      "bankEncryptionPublicKeyPem": "string",
      "bankKeyHashesPinned": {
        "authentication": "string",
        "encryption": "string"
      },
      "perUserActivation": {
        "required": 0,
        "active": 0
      },
      "signatureProfile": "T",
      "keyManagement": "key",
      "veuOnly": false,
      "uploaderUserId": "string",
      "hev": {
        "checkedAt": "string",
        "versions": [
          {}
        ],
        "h005Supported": false,
        "ok": false,
        "message": "string",
        "source": "connection"
      },
      "discovery": {
        "via": "HTD",
        "customerName": "string",
        "hostId": "string",
        "accounts": [
          {}
        ],
        "orderInfo": [
          {}
        ],
        "users": [
          {}
        ],
        "fetchedAt": "string"
      },
      "stagedRenewal": {
        "subscriberMode": "technical",
        "userId": "string",
        "ebicsUserId": "string",
        "signatureVersion": "A005",
        "modulusLength": 0,
        "signatureCertPem": "string",
        "authCertPem": "string",
        "encryptionCertPem": "string",
        "signatureKeyEnc": "string",
        "authKeyEnc": "string",
        "encryptionKeyEnc": "string",
        "startedAt": "string",
        "ambiguous": false
      }
    },
    "pgpFingerprint": "string",
    "pgpPublicKey": "string",
    "pgpExpiresAt": "string",
    "bankPgpPublicKey": "string",
    "usePlatformBankKey": false,
    "bankKeyFingerprintPin": "string",
    "bankPgpKeyInfo": {
      "keyId": "string",
      "fingerprint": "string",
      "userId": "string",
      "algorithm": "string",
      "createdAt": "string",
      "expiresAt": "string"
    },
    "sshPublicKey": "string",
    "sshPublicKeyArmored": "string",
    "sshFingerprint": "string",
    "sshKeyType": "ed25519",
    "approverUserIds": [
      "string"
    ],
    "steps": {
      "introEmailSent": false,
      "pgpGenerated": false,
      "bankPublicKeyAdded": false,
      "serverInfoAdded": false,
      "sftpUserAdded": false,
      "wsConfigAdded": false,
      "bankCertAdded": false,
      "certsIssued": false,
      "hevChecked": false,
      "ebicsKeysGenerated": false,
      "ebicsIniHiaSent": false,
      "ebicsLetterSent": false,
      "ebicsBankKeysFetched": false,
      "approversAssigned": false
    },
    "ingestedFiles": [
      "string"
    ],
    "productionVerifiedAt": "string",
    "connectedAt": "string",
    "testChannelSupported": false,
    "signingCertExpiresAt": "string",
    "tlsPins": [
      "string"
    ],
    "wsCertExpiresAt": "string",
    "certAlertSent": {},
    "pollIntervalSeconds": 0,
    "lastPolledAt": "string",
    "consecutivePollFailures": 0,
    "pollFailureAlertSentAt": "string",
    "sendsPaused": false,
    "sendsPausedAt": "string",
    "sendsPausedReason": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "signingCertSubject": "string",
    "signingCertExpiry": "string",
    "inboundHealth": {
      "status": "live",
      "consecutiveFailures": 0,
      "threshold": 0,
      "reasons": [
        "string"
      ]
    }
  },
  "readiness": {
    "ready": false,
    "missing": [
      "string"
    ]
  },
  "group": {
    "groupId": "string",
    "groupName": "string",
    "members": [
      "string"
    ],
    "suggestedCoveredBankKeys": [
      "string"
    ]
  },
  "productionState": "test",
  "veuComplete": {
    "results": [
      {
        "userId": "string",
        "ebicsUserId": "string",
        "ok": false,
        "error": "string"
      }
    ],
    "executionReady": false
  }
}

GET/connections/{id}/ebics-letter

Download the EBICS initialisation letter (PDF, base64-encoded)

Returns the signed INI/HIA initialisation letter as a base64-encoded PDF. Print, sign, and send to the bank to complete EBICS subscriber activation.

Parameters

Name	In	Required	Description
`id` string	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	PDF as base64
404	Not found or keys not yet generated

Example response (200)

{
  "pdfBase64": "string",
  "filename": "string"
}

Approvals

Maker-checker approval policies + the pending-approval queue (session, Admin/Approver)

GET/approvals/pending

List payments awaiting approval

Parameters

Name	In	Required	Description
`companyId` string	query	yes

Responses

Status	Description
200	Pending approval requests
401	Sign in required

Example response (200)

{
  "items": [
    {
      "id": "string",
      "platformId": "string",
      "companyId": "string",
      "documentId": "string",
      "paymentRef": "string",
      "makerUserId": "string",
      "makerName": "string",
      "maxTransaction": "string",
      "journalTotal": "string",
      "currency": "string",
      "currencies": [
        "string"
      ],
      "payeeName": "string",
      "payeeCount": 0,
      "policyVersionId": "string",
      "requiredApprovals": 0,
      "allowSelfApproval": false,
      "requireOneFromEachGroup": false,
      "orderedApproval": false,
      "groups": [
        {
          "id": "string",
          "name": "string",
          "userIds": []
        }
      ],
      "approverUserIds": [
        "string"
      ],
      "approvals": [
        {
          "userId": "string",
          "userName": "string",
          "at": "string",
          "identity": {},
          "ebicsEs": {}
        }
      ],
      "rejections": [
        {
          "userId": "string",
          "userName": "string",
          "at": "string",
          "identity": {},
          "ebicsEs": {},
          "reason": "string"
        }
      ],
      "status": "pending",
      "createdAt": "string",
      "updatedAt": "string",
      "evaluation": {
        "satisfied": false,
        "missing": [
          "string"
        ],
        "approverCount": 0
      },
      "twoFactorRequired": false
    }
  ],
  "nextCursor": "string"
}

POST/approvals/{id}/approve

Approve a pending payment (maker ≠ checker enforced)

An approver other than the maker approves the request; once the policy's required approvals are met the payment proceeds to delivery. May require a 2FA code/backup code if step-up is configured.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`reason`	string	no
`code`	string	no	2FA TOTP code (if step-up required).
`backupCode`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "reason": "string",
  "code": "string",
  "backupCode": "string"
}

Responses

Status	Description
200	Approval recorded (and payment dispatched if fully approved)
401	Sign in required
404	No approval request with this id (`not_found`)
409	The decision conflicts with the request's state or the caller's role in it: `maker_checker_conflict` (maker cannot approve own payment), `approver_not_designated`, `already_approved`, `not_pending`, `approval_out_of_order`
500	The decision could not be recorded (`internal_error`)

Example response (200)

{
  "request": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "documentId": "string",
    "paymentRef": "string",
    "makerUserId": "string",
    "makerName": "string",
    "maxTransaction": "string",
    "journalTotal": "string",
    "currency": "string",
    "currencies": [
      "string"
    ],
    "payeeName": "string",
    "payeeCount": 0,
    "policyVersionId": "string",
    "requiredApprovals": 0,
    "allowSelfApproval": false,
    "requireOneFromEachGroup": false,
    "orderedApproval": false,
    "groups": [
      {
        "id": "string",
        "name": "string",
        "userIds": [
          "string"
        ]
      }
    ],
    "approverUserIds": [
      "string"
    ],
    "approvals": [
      {
        "userId": "string",
        "userName": "string",
        "at": "string",
        "identity": {
          "approverUserId": "string",
          "approverName": "string",
          "approvedAt": "string",
          "authMethod": "totp",
          "ssnLast4": "string",
          "approvalReference": "string"
        },
        "ebicsEs": {
          "signatureVersion": "A005",
          "signatureB64": "string",
          "ebicsUserId": "string",
          "orderSha256B64": "string"
        }
      }
    ],
    "rejections": [
      {
        "userId": "string",
        "userName": "string",
        "at": "string",
        "identity": {
          "approverUserId": "string",
          "approverName": "string",
          "approvedAt": "string",
          "authMethod": "totp",
          "ssnLast4": "string",
          "approvalReference": "string"
        },
        "ebicsEs": {
          "signatureVersion": "A005",
          "signatureB64": "string",
          "ebicsUserId": "string",
          "orderSha256B64": "string"
        },
        "reason": "string"
      }
    ],
    "status": "pending",
    "createdAt": "string",
    "updatedAt": "string"
  },
  "evaluation": {
    "satisfied": false,
    "missing": [
      "string"
    ],
    "approverCount": 0
  }
}

POST/approvals/{id}/reject

Reject a pending payment

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`reason`	string	no
`code`	string	no
`backupCode`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "reason": "string",
  "code": "string",
  "backupCode": "string"
}

Responses

Status	Description
200	Rejection recorded
401	Sign in required
404	No approval request with this id (`not_found`)
409	The decision conflicts with the request's state or the caller's role in it: `maker_checker_conflict`, `approver_not_designated`, `already_approved`, `not_pending`, `approval_out_of_order`
500	The decision could not be recorded (`internal_error`)

Example response (200)

{
  "request": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "documentId": "string",
    "paymentRef": "string",
    "makerUserId": "string",
    "makerName": "string",
    "maxTransaction": "string",
    "journalTotal": "string",
    "currency": "string",
    "currencies": [
      "string"
    ],
    "payeeName": "string",
    "payeeCount": 0,
    "policyVersionId": "string",
    "requiredApprovals": 0,
    "allowSelfApproval": false,
    "requireOneFromEachGroup": false,
    "orderedApproval": false,
    "groups": [
      {
        "id": "string",
        "name": "string",
        "userIds": [
          "string"
        ]
      }
    ],
    "approverUserIds": [
      "string"
    ],
    "approvals": [
      {
        "userId": "string",
        "userName": "string",
        "at": "string",
        "identity": {
          "approverUserId": "string",
          "approverName": "string",
          "approvedAt": "string",
          "authMethod": "totp",
          "ssnLast4": "string",
          "approvalReference": "string"
        },
        "ebicsEs": {
          "signatureVersion": "A005",
          "signatureB64": "string",
          "ebicsUserId": "string",
          "orderSha256B64": "string"
        }
      }
    ],
    "rejections": [
      {
        "userId": "string",
        "userName": "string",
        "at": "string",
        "identity": {
          "approverUserId": "string",
          "approverName": "string",
          "approvedAt": "string",
          "authMethod": "totp",
          "ssnLast4": "string",
          "approvalReference": "string"
        },
        "ebicsEs": {
          "signatureVersion": "A005",
          "signatureB64": "string",
          "ebicsUserId": "string",
          "orderSha256B64": "string"
        },
        "reason": "string"
      }
    ],
    "status": "pending",
    "createdAt": "string",
    "updatedAt": "string"
  },
  "evaluation": {
    "satisfied": false,
    "missing": [
      "string"
    ],
    "approverCount": 0
  }
}

GET/approvals/policies

List approval policies for a company

Parameters

Name	In	Required	Description
`companyId` string	query	yes

Responses

Status	Description
200	Policies — the standard { items } envelope, one row per policy version
401	Sign in required

Example response (200)

{
  "items": [
    {
      "id": "string",
      "isDefault": false,
      "name": "string",
      "template": "single",
      "enabled": false,
      "requiredApprovals": 0,
      "allowSelfApproval": false,
      "perTransactionLimit": "string",
      "perJournalLimit": "string",
      "perTransactionMax": "string",
      "requireOneFromEachGroup": false,
      "orderedApproval": false,
      "groups": [
        {
          "id": "string",
          "name": "string",
          "userIds": []
        }
      ],
      "version": 0,
      "status": "draft",
      "predecessorId": "string",
      "supersededById": "string",
      "createdBy": "string",
      "locked": false,
      "lockedAt": "string",
      "lockedBy": "string",
      "revisionRequired": false,
      "activeApprovers": 0,
      "requiredApprovers": 0,
      "selfApprovalCappedByOrgSetting": false
    }
  ]
}

POST/approvals/policies

Create an approval policy (Admin)

Defines required approver count + amount thresholds. Admin only.

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`id`	string	no
`name`	string	yes
`template`	string	no
`approvers`	string[]	no
`isDefault`	boolean	no
`enabled`	boolean	no
`requiredApprovals`	number	no
`allowSelfApproval`	boolean	no
`approverLimits`	object	no
`perTransactionLimit`	object	no
`perJournalLimit`	object	no
`perTransactionMax`	object	no
`requireOneFromEachGroup`	boolean	no
`orderedApproval`	boolean	no
`groups`	object[]	no
`locked`	boolean	no
`lockedAt`	string	no
`lockedBy`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "id": "string",
  "name": "string",
  "template": "string",
  "approvers": [
    "string"
  ],
  "isDefault": false,
  "enabled": false,
  "requiredApprovals": 0,
  "allowSelfApproval": false,
  "approverLimits": {},
  "perTransactionLimit": "string",
  "perJournalLimit": "string",
  "perTransactionMax": "string",
  "requireOneFromEachGroup": false,
  "orderedApproval": false,
  "groups": [
    {
      "id": "string",
      "name": "string",
      "userIds": [
        "string"
      ]
    }
  ],
  "locked": false,
  "lockedAt": "string",
  "lockedBy": "string"
}

Responses

Status	Description
201	Policy created
401	Sign in required
403	Admin required

Example response (201)

{
  "policy": {
    "id": "string",
    "isDefault": false,
    "name": "string",
    "template": "single",
    "enabled": false,
    "requiredApprovals": 0,
    "allowSelfApproval": false,
    "perTransactionLimit": "string",
    "perJournalLimit": "string",
    "perTransactionMax": "string",
    "requireOneFromEachGroup": false,
    "orderedApproval": false,
    "groups": [
      {
        "id": "string",
        "name": "string",
        "userIds": [
          "string"
        ]
      }
    ],
    "version": 0,
    "status": "draft",
    "predecessorId": "string",
    "supersededById": "string",
    "createdBy": "string",
    "locked": false,
    "lockedAt": "string",
    "lockedBy": "string"
  },
  "pending": false,
  "selfApprovalCappedByOrgSetting": false
}

POST/approvals/policies/{id}

Edit a DRAFT approval policy (Admin)

Edit a policy's name / required approver count / thresholds. Works only on a DRAFT version — an Active version is immutable (409); change it via /approvals/policies/{id}/propose then co-sign.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`id`	string	no
`name`	string	no
`template`	string	no
`approvers`	string[]	no
`isDefault`	boolean	no
`enabled`	boolean	no
`requiredApprovals`	number	no
`allowSelfApproval`	boolean	no
`approverLimits`	object	no
`perTransactionLimit`	object	no
`perJournalLimit`	object	no
`perTransactionMax`	object	no
`requireOneFromEachGroup`	boolean	no
`orderedApproval`	boolean	no
`groups`	object[]	no
`locked`	boolean	no
`lockedAt`	string	no
`lockedBy`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "id": "string",
  "name": "string",
  "template": "string",
  "approvers": [
    "string"
  ],
  "isDefault": false,
  "enabled": false,
  "requiredApprovals": 0,
  "allowSelfApproval": false,
  "approverLimits": {},
  "perTransactionLimit": "string",
  "perJournalLimit": "string",
  "perTransactionMax": "string",
  "requireOneFromEachGroup": false,
  "orderedApproval": false,
  "groups": [
    {
      "id": "string",
      "name": "string",
      "userIds": [
        "string"
      ]
    }
  ],
  "locked": false,
  "lockedAt": "string",
  "lockedBy": "string"
}

Responses

Status	Description
200	Saved and IN FORCE now (a tightening applies immediately as a new version)
202	Accepted — NOT in force; `change` is the request a second Admin must co-sign
401	Sign in required
403	Admin required
409	Version is not a draft / conflict

Example response (200)

{
  "policy": {
    "id": "string",
    "isDefault": false,
    "name": "string",
    "template": "single",
    "enabled": false,
    "requiredApprovals": 0,
    "allowSelfApproval": false,
    "perTransactionLimit": "string",
    "perJournalLimit": "string",
    "perTransactionMax": "string",
    "requireOneFromEachGroup": false,
    "orderedApproval": false,
    "groups": [
      {
        "id": "string",
        "name": "string",
        "userIds": [
          "string"
        ]
      }
    ],
    "version": 0,
    "status": "draft",
    "predecessorId": "string",
    "supersededById": "string",
    "createdBy": "string",
    "locked": false,
    "lockedAt": "string",
    "lockedBy": "string"
  },
  "pending": false,
  "supersededId": "string",
  "affectedBanks": [
    "string"
  ],
  "resumedBanks": [
    "string"
  ],
  "selfApprovalCappedByOrgSetting": false
}

POST/approvals/policies/{id}/lock

Activate (lock) a draft approval policy (Admin)

Locks a DRAFT version → Active and immutable. Runs the quorum check (a dual policy needs ≥2 named approvers); fails 409 if it can't be met. An Active version is changed only via propose + co-sign.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`id`	string	no
`name`	string	no
`template`	string	no
`approvers`	string[]	no
`isDefault`	boolean	no
`enabled`	boolean	no
`requiredApprovals`	number	no
`allowSelfApproval`	boolean	no
`approverLimits`	object	no
`perTransactionLimit`	object	no
`perJournalLimit`	object	no
`perTransactionMax`	object	no
`requireOneFromEachGroup`	boolean	no
`orderedApproval`	boolean	no
`groups`	object[]	no
`locked`	boolean	no
`lockedAt`	string	no
`lockedBy`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "id": "string",
  "name": "string",
  "template": "string",
  "approvers": [
    "string"
  ],
  "isDefault": false,
  "enabled": false,
  "requiredApprovals": 0,
  "allowSelfApproval": false,
  "approverLimits": {},
  "perTransactionLimit": "string",
  "perJournalLimit": "string",
  "perTransactionMax": "string",
  "requireOneFromEachGroup": false,
  "orderedApproval": false,
  "groups": [
    {
      "id": "string",
      "name": "string",
      "userIds": [
        "string"
      ]
    }
  ],
  "locked": false,
  "lockedAt": "string",
  "lockedBy": "string"
}

Responses

Status	Description
200	Policy activated
202	Accepted — NOT active; `change` is the request a second Admin must co-sign
401	Sign in required
403	Admin required
409	Quorum not met / conflict

Example response (200)

{
  "policy": {
    "id": "string",
    "isDefault": false,
    "name": "string",
    "template": "single",
    "enabled": false,
    "requiredApprovals": 0,
    "allowSelfApproval": false,
    "perTransactionLimit": "string",
    "perJournalLimit": "string",
    "perTransactionMax": "string",
    "requireOneFromEachGroup": false,
    "orderedApproval": false,
    "groups": [
      {
        "id": "string",
        "name": "string",
        "userIds": [
          "string"
        ]
      }
    ],
    "version": 0,
    "status": "draft",
    "predecessorId": "string",
    "supersededById": "string",
    "createdBy": "string",
    "locked": false,
    "lockedAt": "string",
    "lockedBy": "string"
  },
  "pending": false,
  "supersededId": "string",
  "affectedBanks": [
    "string"
  ],
  "resumedBanks": [
    "string"
  ],
  "selfApprovalCappedByOrgSetting": false
}

POST/approvals/policies/{id}/propose

Propose a change to an Active policy (Admin)

Clones the Active version to an editable draft v(n+1). Edit the draft (POST /approvals/policies/{draftId}), then submit it for activation via POST /approvals/changes/{changeId}/submit and have a second Admin co-sign via POST /approvals/changes/{changeId}/cosign. The old version is retained forever once superseded.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`id`	string	no
`name`	string	no
`template`	string	no
`approvers`	string[]	no
`isDefault`	boolean	no
`enabled`	boolean	no
`requiredApprovals`	number	no
`allowSelfApproval`	boolean	no
`approverLimits`	object	no
`perTransactionLimit`	object	no
`perJournalLimit`	object	no
`perTransactionMax`	object	no
`requireOneFromEachGroup`	boolean	no
`orderedApproval`	boolean	no
`groups`	object[]	no
`locked`	boolean	no
`lockedAt`	string	no
`lockedBy`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "id": "string",
  "name": "string",
  "template": "string",
  "approvers": [
    "string"
  ],
  "isDefault": false,
  "enabled": false,
  "requiredApprovals": 0,
  "allowSelfApproval": false,
  "approverLimits": {},
  "perTransactionLimit": "string",
  "perJournalLimit": "string",
  "perTransactionMax": "string",
  "requireOneFromEachGroup": false,
  "orderedApproval": false,
  "groups": [
    {
      "id": "string",
      "name": "string",
      "userIds": [
        "string"
      ]
    }
  ],
  "locked": false,
  "lockedAt": "string",
  "lockedBy": "string"
}

Responses

Status	Description
201	Draft version created
401	Sign in required
403	Admin required
409	Base not Active / change already in progress

Example response (201)

{
  "policy": {
    "id": "string",
    "isDefault": false,
    "name": "string",
    "template": "single",
    "enabled": false,
    "requiredApprovals": 0,
    "allowSelfApproval": false,
    "perTransactionLimit": "string",
    "perJournalLimit": "string",
    "perTransactionMax": "string",
    "requireOneFromEachGroup": false,
    "orderedApproval": false,
    "groups": [
      {
        "id": "string",
        "name": "string",
        "userIds": [
          "string"
        ]
      }
    ],
    "version": 0,
    "status": "draft",
    "predecessorId": "string",
    "supersededById": "string",
    "createdBy": "string",
    "locked": false,
    "lockedAt": "string",
    "lockedBy": "string"
  }
}

GET/approvals/bank-rosters

Who may approve payments on each covered bank

One row per COVERED BANK (danske-dk) — never per connection: one connection may serve several country banks. bound: false means the bank inherits the company default (which is also what a bank added tomorrow gets); sharedWith names the other banks in the query that resolve to the same policy.

Parameters

Name	In	Required	Description
`companyId` string	query	yes
`bankKeys` string	query	yes	Comma-separated covered bank keys (repeatable).

Responses

Status	Description
200	One roster row per covered bank
400	No bank keys named
401	Sign in required

Example response (200)

{
  "items": [
    {
      "bankKey": "string",
      "policyId": "string",
      "policyName": "string",
      "builtIn": false,
      "bound": false,
      "approverUserIds": [
        "string"
      ],
      "requiredApprovals": 0,
      "sharedWith": [
        "string"
      ]
    }
  ]
}

POST/approvals/bank-rosters

Set who may approve payments on covered banks (Admin)

ALL-OR-NOTHING across the set: the ratchet judges each bank, but if ANY bank's roster shrinks nothing moves until a second Admin co-signs the one request naming them all. 200 = in force now; 202 = accepted and NOT in force, change is the request awaiting that signature. No policy is ever edited in place — each bank is moved to a policy carrying the wanted roster on its current rule, so a policy shared with other banks is left untouched.

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`targets`	object[]	yes

Example

{
  "platformId": "string",
  "companyId": "string",
  "targets": [
    {
      "bankKey": "string",
      "approverUserIds": [
        "string"
      ]
    }
  ]
}

Responses

Status	Description
200	In force now
202	Accepted — NOT in force; awaiting a second Admin's co-sign
400	Malformed roster set
401	Sign in required
403	Admin required
409	Refused by the ratchet (e.g. only one Admin) / a change is already awaiting co-sign

Example response (200)

{
  "banks": [
    {
      "bankKey": "string",
      "approverUserIds": [
        "string"
      ],
      "fromPolicyId": "string",
      "toPolicyId": "string"
    }
  ],
  "pending": false
}

GET/approvals/changes

List approval-policy change requests (Admin)

The dual-co-sign change requests for the company. ?status=pending (default) | activated | cancelled.

Parameters

Name	In	Required	Description
`status` enum	query	no

Responses

Status	Description
200	Change requests — the standard { items } envelope
401	Sign in required
403	Admin required

Example response (200)

{
  "items": [
    {
      "id": "string",
      "proposedBy": {
        "userId": "string",
        "name": "string"
      },
      "status": "pending",
      "cosigns": [
        {
          "adminId": "string",
          "name": "string",
          "at": "string"
        }
      ],
      "requiredCosigns": 0,
      "weakening": [
        {
          "field": "string",
          "from": "string",
          "to": "string",
          "why": "string"
        }
      ],
      "blastRadius": {
        "banks": 0,
        "exact": false,
        "label": "string"
      },
      "createdAt": "string",
      "activatedAt": "string",
      "cancelledAt": "string",
      "kind": "string",
      "basePolicyId": "string",
      "draftPolicyId": "string"
    }
  ]
}

POST/approvals/changes/{changeId}/{action}

Submit / co-sign / cancel a policy change (Admin)

action=submit — the proposer submits the draft for activation (counts as the FIRST of 2 co-signs). action=cosign — a SECOND, distinct Admin co-signs: the new version goes Active, the base is Superseded, and attached banks re-point to the new version. action=cancel — any Admin cancels a pending change (the draft is discarded; the base stays Active). A 2nd co-sign by the same Admin is refused (409).

Parameters

Name	In	Required	Description
`changeId` string	path	yes
`action` enum	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	Change updated — one shape per outcome; `change` is always present
401	Sign in required
403	Admin required
409	Same-admin co-sign / conflict

Example response (200)

{
  "change": {
    "id": "string",
    "proposedBy": {
      "userId": "string",
      "name": "string"
    },
    "status": "pending",
    "cosigns": [
      {
        "adminId": "string",
        "name": "string",
        "at": "string"
      }
    ],
    "requiredCosigns": 0,
    "weakening": [
      {
        "field": "string",
        "from": "string",
        "to": "string",
        "why": "string"
      }
    ],
    "blastRadius": {
      "banks": 0,
      "exact": false,
      "label": "string"
    },
    "createdAt": "string",
    "activatedAt": "string",
    "cancelledAt": "string",
    "kind": "string",
    "basePolicyId": "string",
    "draftPolicyId": "string"
  },
  "policy": {
    "id": "string",
    "isDefault": false,
    "name": "string",
    "template": "single",
    "enabled": false,
    "requiredApprovals": 0,
    "allowSelfApproval": false,
    "perTransactionLimit": "string",
    "perJournalLimit": "string",
    "perTransactionMax": "string",
    "requireOneFromEachGroup": false,
    "orderedApproval": false,
    "groups": [
      {
        "id": "string",
        "name": "string",
        "userIds": [
          "string"
        ]
      }
    ],
    "version": 0,
    "status": "draft",
    "predecessorId": "string",
    "supersededById": "string",
    "createdBy": "string",
    "locked": false,
    "lockedAt": "string",
    "lockedBy": "string"
  },
  "supersededId": "string",
  "affectedBanks": [
    "string"
  ],
  "resumedBanks": [
    "string"
  ]
}

OAuth

OAuth 2.0 authorization server for ERP add-ons (RFC 6749/7636/8252): authorization code + PKCE, rotating refresh tokens. The /oauth plane is snake_case on the wire by spec (ADR-0068).

POST/oauth/token

OAuth 2.0 token endpoint (authorization_code + PKCE, refresh_token)

RFC 6749 token endpoint for native-app add-ons (RFC 8252). application/x-www-form-urlencoded only. Public clients — no client secret exists in this flow: possession of the single-use authorization code plus its PKCE code_verifier (S256, mandatory) is the authentication. grant_type=refresh_token rotates the refresh token on every use, with reuse detection: replaying an already-rotated token revokes the whole token family. Errors are the flat RFC 6749 §5.2 bodies (invalid_request, invalid_client, invalid_grant, unsupported_grant_type), not this API's usual error envelope. Rate-limited per IP and per client+IP; responses are never cacheable (Cache-Control: no-store).

Responses

Status	Description
200	The token pair. `access_token` (`bc_oat_…`, opaque, 1 hour) is sent as `Authorization: Bearer` against the product API; `refresh_token` (`bc_ort_…`, rotating, 180 days) returns here.
400	RFC 6749 §5.2 error body: `{ error, error_description }`.
429	Over the per-IP or per-client throttle. `Retry-After` is set.

Example response (200)

{
  "access_token": "string",
  "token_type": "string",
  "expires_in": 0,
  "refresh_token": "string",
  "scope": "string"
}

GET/oauth/authorize

Describe an authorization request for the consent screen

The session-authenticated authorization endpoint (RFC 8252: the add-on opens the system browser here). Validates the request — registered client, exact loopback redirect (http://127.0.0.1, any port, the registered path; localhost is always refused), mandatory S256 PKCE, delegable scopes — and returns it as data for the consent screen. Query parameters are the RFC 6749 §4.1.1 set: response_type=code, client_id, redirect_uri, scope (space-delimited), state, code_challenge, code_challenge_method=S256. Refusals that arrive AFTER the redirect target is validated are answered as a redirectTo carrying the RFC error parameters; an unknown client or an unmatched redirect_uri is a dead-end 400, never a redirect.

Responses

Status	Description
200	The validated request, or a redirectable refusal.
400	Unknown client, or a redirect_uri that fails exact loopback matching.

Example response (200)

{
  "status": "string",
  "client": {
    "clientId": "string",
    "name": "string"
  },
  "scopes": [
    "string"
  ],
  "redirectUri": "string",
  "state": "string",
  "codeChallenge": "string",
  "codeChallengeMethod": "string",
  "requestedFromIp": "string",
  "requestedAt": "string",
  "grantLifetimeYears": 0
}

POST/oauth/authorize/decision

Record the consent decision and mint the authorization code

The consent screen's post-back (Admin session). Approval creates the pairing's grant material and answers redirectTo — the validated loopback redirect carrying the single-use code (10-minute TTL) and state. Decline answers redirectTo with error=access_denied. The organisation is the deciding admin's own; it is never read from the request.

Request body required

Property	Type	Required
`clientId`	string	yes
`redirectUri`	string	yes
`scope`	string	yes
`state`	string	no
`codeChallenge`	string	yes
`codeChallengeMethod`	string	yes
`approve`	boolean	yes
`twofaCode`	string	no
`backupCode`	string	no

Example

{
  "clientId": "string",
  "redirectUri": "string",
  "scope": "string",
  "state": "string",
  "codeChallenge": "string",
  "codeChallengeMethod": "string",
  "approve": false,
  "twofaCode": "string",
  "backupCode": "string"
}

Responses

Status	Description
200	Where to send the browser next.
400	Validation failed (unknown client, unmatched redirect, bad PKCE parameters).
403	Not an Admin session, or no company context selected.

Example response (200)

{
  "redirectTo": "string"
}

POST/oauth/revoke

Revoke an access or refresh token (RFC 7009)

Public, like /oauth/token — the caller identifies itself with client_id (no secret exists in this flow). Always answers 200, including for an already-revoked, expired, unknown, or wrong-client token: RFC 7009 §2.2 requires this so the endpoint cannot be used to probe which tokens exist. token_type_hint only narrows which token table is tried first; an absent or wrong hint still finds the token. Revoking a refresh token revokes every access token from the same authorization grant (RFC 7009 §2.1); revoking a bare access token does not touch its refresh token.

Responses

Status	Description
200	The token has been revoked, or was already invalid — RFC 7009 does not distinguish.
400	Malformed request: `token` or `client_id` missing.

GET/.well-known/oauth-authorization-server

OAuth 2.0 Authorization Server Metadata (RFC 8414)

The discovery document a standard OAuth client fetches to learn this server's endpoints and capabilities, rather than being told them out of band. Every field is derived from what this server actually enforces — scopes_supported and grant_types_supported are the SAME arrays the authorization and token endpoints validate against, so this document cannot advertise a capability the server does not have. Public by definition (RFC 8414 §3): no tenant data, no internal hostnames, nothing that varies by caller.

Responses

Status	Description
200	The metadata document.

Example response (200)

{
  "issuer": "string",
  "authorization_endpoint": "string",
  "token_endpoint": "string",
  "revocation_endpoint": "string",
  "scopes_supported": [
    "string"
  ],
  "response_types_supported": [
    "string"
  ],
  "grant_types_supported": [
    "string"
  ],
  "token_endpoint_auth_methods_supported": [
    "string"
  ],
  "revocation_endpoint_auth_methods_supported": [
    "string"
  ],
  "code_challenge_methods_supported": [
    "string"
  ]
}

Auth

POST/auth/login

PUBLIC. Exchanges email + password for a signed session, delivered ONLY as the httpOnly bc_session cookie (the raw token is never in the response body; programmatic callers should use API keys). The email address identifies the account on its own — it is unique across the whole service — so there is no workspace to name. If 2FA is enabled, returns a step-up challenge instead (complete it at POST /auth/2fa).

Request body required

Property	Type	Required	Description
`email`	string	yes
`password`	string	yes

Example

{
  "email": "string",
  "password": "string"
}

Responses

Status	Description
200	Logged in (session cookie set) OR a 2FA step-up challenge
401	Invalid credentials

Example response (200)

{
  "twofaRequired": false,
  "twofaToken": "string",
  "forcedEnroll": false,
  "expiresAt": "string",
  "user": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "email": "string",
    "name": "string",
    "roles": [
      "admin"
    ],
    "status": "active",
    "settings": {
      "locale": "string",
      "timezone": "string",
      "dateFormat": "iso",
      "notifications": {
        "paymentNeedsApproval": false,
        "paymentApproved": false,
        "paymentRejected": false,
        "statementReceived": false
      }
    },
    "totpEnabledAt": "string",
    "createdAt": "string"
  },
  "csrfToken": "string"
}

Code samples

curl -X POST https://your-host/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"subdomain":"demo","email":"you@acme.com","password":"…"}'

const res = await fetch("https://your-host/api/auth/login", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"subdomain":"demo","email":"you@acme.com","password":"…"}),
});
const data = await res.json();

import requests

resp = requests.request(
  "POST", "https://your-host/api/auth/login",
  json={"subdomain":"demo","email":"you@acme.com","password":"…"},
)
resp.raise_for_status()
data = resp.json()

POST/2fa/setup

Begin 2FA enrollment (signed-in user) — returns a TOTP secret + otpauth URI

Generates a NOT-yet-active TOTP secret for the signed-in user and returns its otpauth:// URI (render as a QR). Activate it with POST /2fa/confirm. Session-only.

Responses

Status	Description
200	Pending secret + otpauth URI
401	Sign in first

Example response (200)

{
  "secret": "string",
  "otpauthUri": "string",
  "issuer": "string"
}

POST/2fa/confirm

Confirm 2FA enrollment with a TOTP code — returns one-time backup codes

Verifies a code against the pending secret and activates 2FA. The backup codes are returned EXACTLY ONCE — surface + warn. Session-only; throttled per user.

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no
`code`	string	yes	6-digit TOTP code
`backupCode`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "code": "string",
  "backupCode": "string"
}

Responses

Status	Description
200	Enabled + one-time backup codes
400	Setup not started
409	Already enabled
422	Code didn't match
429	Too many attempts (Retry-After)

Example response (200)

{
  "enabled": false,
  "backupCodes": [
    "string"
  ],
  "csrfToken": "string"
}

POST/2fa/disable

Disable 2FA (requires a fresh code; blocked when the company forces 2FA)

Turns off the signed-in user's 2FA after verifying a fresh TOTP or backup code; refused (403) when the company requires 2FA. Revokes the user's OTHER sessions. Session-only; throttled.

Request body required

Property	Type	Required
`platformId`	string	no
`companyId`	string	no
`code`	string	no
`backupCode`	string	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "code": "string",
  "backupCode": "string"
}

Responses

Status	Description
200	Disabled
403	Company requires 2FA
409	Not enabled
422	A valid code is required
429	Too many attempts (Retry-After)

Example response (200)

{
  "enabled": false
}

POST/company/require-2fa

Admin: set the company-wide 2FA requirement

Admin-only. When enabled, every user in the company must enroll in 2FA. Distinct from the per-user enabled state — the response field is require2fa (company policy).

Request body required

Property	Type	Required
`platformId`	string	no
`companyId`	string	no
`enabled`	boolean	yes

Example

{
  "platformId": "string",
  "companyId": "string",
  "enabled": false
}

Responses

Status	Description
200	Updated company policy
403	Admin role required

Example response (200)

{
  "require2fa": false
}

PUT/company/registration-number

Admin: set the company's national registration number

Admin-only. Records the number the national business register issues — CVR (DK), Y-tunnus (FI), organisationsnummer (SE/NO) — which every bank asks for when it opens an agreement file. Send null to clear it; omit the field and the request is refused as nothing_to_update. The value is stored unstructured (the format varies by country) and is read back on GET /auth/me as companyRegistrationNumber.

Request body required

Property	Type	Required
`platformId`	string	no
`companyId`	string	no
`registrationNumber`	object	yes

Example

{
  "platformId": "string",
  "companyId": "string",
  "registrationNumber": "string"
}

Responses

Status	Description
200	The company's registration number after the write
400	Nothing to update, or a value longer than the bound
403	Admin role required

Example response (200)

{
  "registrationNumber": "string"
}

GET/auth/me

Current principal (who am I)

Responses

Status	Description
200	The signed-in user + roles + company
401	Not signed in

Example response (200)

{
  "user": {
    "id": "string",
    "email": "string",
    "name": "string",
    "roles": [
      "admin"
    ],
    "platformId": "string",
    "kind": "platform-admin",
    "companyId": "string",
    "userId": "string",
    "companyName": "string",
    "activeCompanyId": "string",
    "activeName": "string",
    "sandboxOnly": false,
    "settings": {
      "locale": "string",
      "timezone": "string",
      "dateFormat": "iso",
      "notifications": {
        "paymentNeedsApproval": false,
        "paymentApproved": false,
        "paymentRejected": false,
        "statementReceived": false
      }
    },
    "twoFactor": {
      "enrolled": false,
      "companyRequired": false
    },
    "companyRegistrationNumber": "string"
  }
}

POST/auth/logout

Log out (invalidates the session)

Responses

Status	Description
200	Logged out

Example response (200)

{
  "ok": false
}

GET/auth/platform-info

Public platform branding for the login page

Returns the branding for the platform resolved from the request's subdomain (no auth — called before login). On a known subdomain: the platform's display name + subdomain. Otherwise the generic BankConnector branding. logoUrl is reserved for a later phase (null for now).

Responses

Status	Description
200	Platform branding

Example response (200)

{
  "platformId": "string",
  "displayName": "string",
  "subdomain": "string",
  "logoUrl": "string"
}

POST/auth/2fa

Complete a 2FA login step-up (PUBLIC)

PUBLIC. Submits the TOTP (or backup) code against the challenge from POST /auth/login to obtain the session (delivered ONLY as the httpOnly bc_session cookie — the raw token is never in the response body).

Request body required

Property	Type	Required	Description
`twofaToken`	string	yes	The `twofaToken` returned by POST /auth/login.
`code`	string	yes
`backupCode`	string	no

Example

{
  "twofaToken": "string",
  "code": "string",
  "backupCode": "string"
}

Responses

Status	Description
200	Session granted (session cookie set)
401	Invalid code

Example response (200)

{
  "expiresAt": "string",
  "user": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "email": "string",
    "name": "string",
    "roles": [
      "admin"
    ],
    "status": "active",
    "settings": {
      "locale": "string",
      "timezone": "string",
      "dateFormat": "iso",
      "notifications": {
        "paymentNeedsApproval": false,
        "paymentApproved": false,
        "paymentRejected": false,
        "statementReceived": false
      }
    },
    "totpEnabledAt": "string",
    "createdAt": "string"
  },
  "csrfToken": "string",
  "backupCodes": [
    "string"
  ]
}

User Management

Create, invite, and manage users within a company. Also covers workspace (platform) admin accounts.

GET/platforms/{platformId}/admins

List workspace admins for a platform

Returns all workspace (platform) admin accounts. Workspace-admin session required.

Parameters

Name	In	Required	Description
`platformId` string	path	yes

Responses

Status	Description
200	Workspace admins
403	Not a workspace admin

Example response (200)

{
  "items": [
    {
      "id": "string",
      "platformId": "string",
      "companyId": "string",
      "email": "string",
      "name": "string",
      "roles": [
        "admin"
      ],
      "status": "active",
      "settings": {
        "locale": "string",
        "timezone": "string",
        "dateFormat": "iso",
        "notifications": {
          "paymentNeedsApproval": false,
          "paymentApproved": false,
          "paymentRejected": false,
          "statementReceived": false
        }
      },
      "totpEnabledAt": "string",
      "createdAt": "string"
    }
  ],
  "nextCursor": "string"
}

POST/platforms/{platformId}/admins

Create a workspace admin

Creates a new workspace (platform) admin account with a password. Bootstrap note: when the server is running in open/unauthenticated mode (no BANKCONNECTOR_API_KEYS set, e.g. first-time setup), this endpoint is accessible without a session: use it to create the very first admin. Once auth is enabled, an existing workspace-admin session is required.

Parameters

Name	In	Required	Description
`platformId` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no
`email`	string	yes
`name`	string	yes
`password`	string	yes	Initial password. Minimum 8 characters.
`roles`	string[]	no

Example

{
  "platformId": "string",
  "companyId": "string",
  "email": "admin@acme.com",
  "name": "Alice Admin",
  "password": "string",
  "roles": [
    "string"
  ]
}

Responses

Status	Description
201	Admin created
400	Invalid request or duplicate email
403	Not a workspace admin (when auth is enabled)

Example response (201)

{
  "id": "string",
  "platformId": "string",
  "companyId": "string",
  "email": "string",
  "name": "string",
  "roles": [
    "admin"
  ],
  "status": "active",
  "settings": {
    "locale": "string",
    "timezone": "string",
    "dateFormat": "iso",
    "notifications": {
      "paymentNeedsApproval": false,
      "paymentApproved": false,
      "paymentRejected": false,
      "statementReceived": false
    }
  },
  "totpEnabledAt": "string",
  "createdAt": "string"
}

GET/users

List users in a company

Returns all users in the company (name, email, roles, status). Readable by any authenticated company member.

Parameters

Name	In	Required	Description
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	Company users
401	Sign in required

Example response (200)

{
  "items": [
    {
      "id": "string",
      "email": "string",
      "name": "string",
      "roles": [
        "admin"
      ],
      "status": "active",
      "totpEnabledAt": "string"
    }
  ]
}

POST/users

Create or invite a company user

Company admin only. Two modes:

With password: creates the user immediately (active). Use for programmatic provisioning.
Without password: sends an invite email. The user receives a link to /auth/set-password where they set their own password.

The user must be given at least one role (admin, approver, and/or viewer). Users who will be assigned as payment approvers need the approver role.

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	yes
`email`	string	yes
`name`	string	yes
`password`	string	no	If omitted, an invite email is sent and the user sets their own password.
`roles`	string[]	yes

Example

{
  "platformId": "string",
  "companyId": "string",
  "email": "approver@acme.com",
  "name": "Bob Approver",
  "password": "string",
  "roles": [
    "approver"
  ]
}

Responses

Status	Description
201	User created or invite sent
400	Invalid request, duplicate email, or no valid roles
403	Company admin required

Example response (201)

{
  "id": "string",
  "platformId": "string",
  "companyId": "string",
  "email": "string",
  "name": "string",
  "roles": [
    "admin"
  ],
  "status": "active",
  "settings": {
    "locale": "string",
    "timezone": "string",
    "dateFormat": "iso",
    "notifications": {
      "paymentNeedsApproval": false,
      "paymentApproved": false,
      "paymentRejected": false,
      "statementReceived": false
    }
  },
  "totpEnabledAt": "string",
  "createdAt": "string",
  "invited": false,
  "emailDeliveryPending": false,
  "inviteLink": "string"
}

GET/users/{id}

Get a single user

Returns one user's record. Readable by any authenticated company member, but the response shape depends on who is asking (USER-DETAIL-READ-UNGATED-1, ADR-0114):

An API key, the subject themselves, or a session holding the admin role receive the whole record — settings, platformId, companyId and createdAt included.
Any other signed-in company member receives the narrower roster projection (id, email, name, roles, status, totpEnabledAt) — the same six fields GET /users publishes. A colleague's preferences are not theirs to read.

Both are a 200; the status code does not distinguish them, so read the 200 schema's two arms.

Parameters

Name	In	Required	Description
`id` string	path	yes
`platformId` string	query	no	Inferred from your API key, or from your session's context — a session caller may pass it explicitly.
`companyId` string	query	yes

Responses

Status	Description
200	The user — the WHOLE record for an API key / the subject / an admin session, the roster projection for any other company member. See the operation description; the schema's two arms are that condition, not a caller's free choice.
401	Sign in required
404	Unknown user in this company

Example response (200)

{
  "id": "string",
  "platformId": "string",
  "companyId": "string",
  "email": "string",
  "name": "string",
  "roles": [
    "admin"
  ],
  "status": "active",
  "settings": {
    "locale": "string",
    "timezone": "string",
    "dateFormat": "iso",
    "notifications": {
      "paymentNeedsApproval": false,
      "paymentApproved": false,
      "paymentRejected": false,
      "statementReceived": false
    }
  },
  "totpEnabledAt": "string",
  "totpLastStep": 0,
  "createdAt": "string"
}

POST/auth/set-password

Complete an invite: set password from email token (PUBLIC)

PUBLIC. Called when an invited user clicks their invite link. Validates the one-time token and sets the user's password. Any existing sessions for the user are revoked. The token comes from the invite email.

Request body required

Property	Type	Required	Description
`token`	string	yes	The one-time invite token from the email link.
`password`	string	yes	The user's chosen password.

Example

{
  "token": "string",
  "password": "string"
}

Responses

Status	Description
200	Password set
400	Invalid or expired token
429	Too many attempts: IP rate-limited

Example response (200)

{
  "ok": false,
  "email": "string"
}

Platform

Tenant dashboard + per-bank test payments

POST/client-errors

Report a browser-side crash

REACT-6(b) / docs/FEATURES.md (client-side error capture). The React island error boundary posts here when a render throws, so a crash on a payments or approvals screen is not invisible to the operator. Tenant-scoped by the SESSION — the body's tenant is never trusted.

ALWAYS answers 202, even when nothing is stored: a report is best-effort telemetry, the browser cannot act on the difference, and an error reporter that returns errors is a second failure on an already-broken screen. recorded says which happened.

ON BY DEFAULT. The operator can disable capture with BANKCONNECTOR_CLIENT_ERROR_CAPTURE=0, and while it is disabled the payload is not even parsed. Payloads are encrypted at rest, purged after 30 days, and readable only by an audited operator via GET /ops/client-errors. Credentials and national identity numbers are stripped before storage; other detail is retained deliberately, so a report identifies the record that broke.

PROBE FIRST (CLIENT-ERROR-REASON-1): POST an EMPTY body {} to ask whether capture is on. The answer carries capture: true only when capture is enabled AND the session could have a row recorded for it, and the browser transmits no report content until it sees that — so while an operator has capture switched off, nothing but the empty probe ever leaves the page.

Request body required

Property	Type	Required	Description
`island`	string	no	Island label from the mounter, e.g. "approvals-queue".
`route`	string	no	Route in view. Query string is dropped by client AND server.
`message`	string	no
`stack`	string	no
`componentStack`	string	no	React component stack.
`userAgent`	string	no

Example

{
  "island": "string",
  "route": "string",
  "message": "string",
  "stack": "string",
  "componentStack": "string",
  "userAgent": "string"
}

Responses

Status	Description
202	Accepted. `recorded` distinguishes stored from dropped (capture off, no session, empty).

Example response (202)

{
  "ok": false,
  "recorded": false,
  "capture": false
}

POST/client-absence

Report that a screen rendered NOTHING

OBS-SILENT-1. Errors are covered by POST /client-errors; ABSENCES were not. Nothing in the running app noticed 'this container was populated and is now empty with no navigation' or 'this mount point has had no root for N seconds', so a blank screen in front of a customer could coexist with every dashboard green.

PRIVACY SHAPE — the whole of it. The payload is a route TEMPLATE and a kind, and nothing else: no user id, no tenant id, no DOM content, no message, no stack, no user agent. The browser sends the request with credentials: "omit", so no session cookie arrives and the server cannot attribute the beacon even in principle; the handler reads no session. Route templates are identical for every tenant, and a concrete deep link is normalised to its pattern (/app/policy/edit/$id) before it leaves the browser. Nothing is stored: it increments the Prometheus counter client_absence_total{route,kind}, readable only through the ops-token-gated GET /metrics.

PUBLIC, deliberately: a front end that never rendered has no session to present, and that is exactly the case the signal exists for.

Both label values are validated against closed enumerations — an unrecognised route or kind is DROPPED, never bucketed, because an unbounded Prometheus label is a cardinality DoS. ALWAYS answers 202: the browser cannot act on the difference, and a telemetry sink that returns errors is a second failure on a screen that is already blank.

Request body required

Property	Type	Required	Description
`kind`	string	yes	Which invariant broke. `no-root-for-Ns` keeps the literal N: the threshold is a client constant, and baking its value in would re-key the series whenever it is tuned.
`route`	string	yes	A route TEMPLATE the SPA owns, e.g. `/app/approvals` or `/app/policy/edit/$id` — never a concrete URL, never a query string.

Example

{
  "kind": "string",
  "route": "string"
}

Responses

Status	Description
202	Accepted. `recorded` distinguishes counted from dropped (unknown route/kind, oversized, throttled).

Example response (202)

{
  "ok": false,
  "recorded": false
}

GET/bank-coverage-requests

List all bank coverage requests (Admin only)

Parameters

Name	In	Required	Description
`status` enum	query	no	BANKREQ-LIFECYCLE-1: narrow the list to one lifecycle state, so it reads as a worklist rather than an append-only pile. Narrowing only — the tenant scope is unaffected.
`limit` integer	query	no
`cursor` string	query	no

Responses

Status	Description
200	All bank coverage requests
401	Sign in required
403	Admin required

Example response (200)

{
  "items": [
    {
      "id": "string",
      "query": "string",
      "email": "string",
      "requestedByUserId": "string",
      "requestedByName": "string",
      "platformId": "string",
      "companyId": "string",
      "createdAt": "string",
      "status": "open",
      "statusChangedAt": "string",
      "statusNote": "string",
      "bankKey": "string",
      "notifiedAt": "string",
      "demandKey": "string"
    }
  ],
  "nextCursor": "string"
}

POST/bank-coverage-requests

Ask BankConnector to add coverage for a bank we don't support yet

Any signed-in user (or anonymous) can submit a BIC or bank name for a bank BankConnector does not yet cover. Not a request sent to the bank itself — it is queued for the development team.

Request body required

Property	Type	Required	Description
`query`	string	yes	BIC code or bank name.
`email`	object	no

Example

{
  "query": "string",
  "email": "string"
}

Responses

Status	Description
201	Request recorded
400	Empty query

Example response (201)

{
  "ok": false,
  "request": {
    "id": "string",
    "query": "string",
    "createdAt": "string"
  }
}

GET/bank-coverage-requests/demand

Which banks customers are waiting on, most-wanted first (system operator only)

BANKREQ-LIFECYCLE-1 — the roadmap signal. The per-request list answers "who asked what?"; this answers "what should we build next?". Requests are grouped by the operator-assigned bank where one exists, else by a database-generated fold of what the customer typed (case/punctuation folded; a BIC folded to its 8-character institution+country prefix). 🔒 The response carries NO requester PII — only counts, dates and the customer's own typed bank text — which is what makes a cross-tenant aggregate safe to serve at all. System operator only: a per-tenant slice of a cross-tenant count would let one tenant infer another's bank interest.

Parameters

Name	In	Required	Description
`limit` integer	query	no

Responses

Status	Description
200	Demand per bank, most-wanted first
401	Sign in required
403	System operator only

Example response (200)

{
  "items": [
    {
      "key": "string",
      "bankKey": "string",
      "bankLive": false,
      "sampleQuery": "string",
      "total": 0,
      "waiting": 0,
      "open": 0,
      "acknowledged": 0,
      "shipped": 0,
      "declined": 0,
      "companies": 0,
      "contactable": 0,
      "firstRequestedAt": "string",
      "lastRequestedAt": "string"
    }
  ]
}

PATCH/bank-coverage-requests/{id}

Move a bank coverage request's status, and optionally tell the requester (system operator only)

BANKREQ-LIFECYCLE-1 — open → acknowledged → shipped | declined. The status is the PROVIDER's roadmap state, so only the system operator moves it. bankKey links the request to a registry bank, which is what makes the demand aggregate countable and a notification possible.

notify: true sends the requester one message saying their bank is now supported. It is an explicit operator action, never automatic, and it is REFUSED (409) unless the request is shipped, is linked to a bank, that bank is connectivity-proven, and the row carries an address — and it can happen at most once per request.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`status`	enum	yes
`note`	string	no	Internal operator note. Never sent to the requester.
`bankKey`	string	no	Registry bank key, `<slug>-<cc>`.
`notify`	boolean	no	Tell the requester their bank shipped.

Example

{
  "status": "open",
  "note": "string",
  "bankKey": "string",
  "notify": false
}

Responses

Status	Description
200	Updated request; `notified` says whether a message actually went out
401	Sign in required
403	System operator only
404	No such request, or an unknown bankKey
409	Refused: not notifiable in this state, or already notified

Example response (200)

{
  "request": {
    "id": "string",
    "query": "string",
    "email": "string",
    "requestedByUserId": "string",
    "requestedByName": "string",
    "platformId": "string",
    "companyId": "string",
    "createdAt": "string",
    "status": "open",
    "statusChangedAt": "string",
    "statusNote": "string",
    "bankKey": "string",
    "notifiedAt": "string",
    "demandKey": "string"
  },
  "notified": false
}

Billing

GET/billing/packages

The public package catalogue (Starter / Growth / Scale)

Every publicly offered package, presentation-ordered, each merged with its live Stripe price. The amount, currency, billing interval and included-payment allowance are read from Stripe on every request (and cached — Stripe Prices are immutable) — never stored in this platform's own database, so the number shown here can never disagree with what Checkout actually charges.

Responses

Status	Description
200	List of packages

Example response (200)

{
  "items": [
    {
      "stripePriceId": "string",
      "displayName": "string",
      "marketingCopy": "string",
      "featureBullets": [
        "string"
      ],
      "sortOrder": 0,
      "mostPopular": false,
      "price": {
        "amount": "string",
        "currency": "string",
        "interval": "string"
      },
      "includedPayments": 0
    }
  ]
}

POST/billing/checkout

Start hosted Stripe Checkout for a package

Creates a hosted Stripe Checkout Session (mode: subscription) for the chosen package and returns its URL — redirect the browser there. The session carries BOTH the package's flat recurring Price and its metered overage Price, so the subscription is complete the moment Checkout does. Session-only (Admin); an API key cannot call this. stripePriceId must be one of the ids GET /billing/packages publishes.

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes
`stripePriceId`	string	yes	The chosen package's flat recurring Price id.

Example

{
  "platformId": "string",
  "companyId": "string",
  "stripePriceId": "string"
}

Responses

Status	Description
200	Hosted Checkout URL
404	Unknown or unavailable package
503	Billing is not configured on this deployment

Example response (200)

{
  "url": "string"
}

POST/billing/portal

Open the Stripe Customer Portal

Creates a hosted Stripe Customer Portal session and returns its URL — redirect the browser there. The Portal is configured to allow switching between all publicly offered packages (with Stripe-computed proration), cancellation and payment-method updates; nothing here is rendered by this application itself. Session-only (Admin). 409 when the company has never started Checkout, since there is then no Stripe Customer for the Portal to manage.

Request body required

Property	Type	Required	Description
`platformId`	string	yes
`companyId`	string	yes

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	Hosted Customer Portal URL
409	No billing account yet — start Checkout first
503	Billing is not configured on this deployment

Example response (200)

{
  "url": "string"
}

Workspace Admin

GET/platforms/{platformId}/companies

List the companies under a platform

Workspace (platform) admin only. The company list a workspace admin manages: drives the GUI company list + company-switcher (POST /auth/company-context).

Parameters

Name	In	Required	Description
`platformId` string	path	yes

Responses

Status	Description
200	Companies
403	Not a workspace admin

Example response (200)

{
  "items": [
    {
      "id": "string",
      "platformId": "string",
      "name": "string",
      "require2fa": false,
      "timezone": "string",
      "registrationNumber": "string",
      "legalHold": false,
      "legalHoldAt": "string",
      "legalHoldReason": "string",
      "legalHoldBy": "string",
      "createdAt": "string"
    }
  ],
  "nextCursor": "string"
}

POST/platforms/{platformId}/companies

Create a company under a platform

Workspace (platform) admin only. Creates a new company (tenant) under the platform. Requires a session (workspace-admin login): not an API key. After creation, use POST /auth/company-context to enter the company and make company-scoped calls.

Parameters

Name	In	Required	Description
`platformId` string	path	yes

Request body required

Property	Type	Required	Description
`name`	string	yes	Display name for the company.

Example

{
  "name": "Acme Payments Ltd"
}

Responses

Status	Description
201	Company created
400	Invalid request
403	Not a workspace admin

Example response (201)

{
  "id": "string",
  "platformId": "string",
  "name": "string",
  "require2fa": false,
  "timezone": "string",
  "registrationNumber": "string",
  "legalHold": false,
  "legalHoldAt": "string",
  "legalHoldReason": "string",
  "legalHoldBy": "string",
  "createdAt": "string"
}

POST/auth/company-context

Enter a company context (platform admin acts AS a company)

Workspace (platform) admin only. Sets the session's active company so the admin acts as an ADMIN of that company. The company must belong to the admin's platform. Cleared with DELETE.

Request body required

Property	Type	Required	Description
`companyId`	string	yes

Example

{
  "companyId": "string"
}

Responses

Status	Description
200	Context set
403	Not a workspace admin
404	Unknown company in your platform

Example response (200)

{
  "ok": false,
  "csrfToken": "string"
}

DELETE/auth/company-context

Exit the company context (back to pure platform-admin scope)

Responses

Status	Description
200	Context cleared
403	Not a workspace admin

Example response (200)

{
  "ok": false
}

Tenancy

PATCH/platforms/{platformId}/companies/{companyId}

Rename a company — workspace admin

Partial update: name renames the company. Platform-admin only. (The sandboxOnly flag this route also accepted is gone — whether a tenant can reach a real bank is decided by the DEPLOYMENT, not per company, so there is nothing to set.)

Parameters

Name	In	Required	Description
`platformId` string	path	yes
`companyId` string	path	yes

Request body required

Property	Type	Required	Description
`name`	string	no

Example

{
  "name": "string"
}

Responses

Status	Description
200	Updated company
400	Nothing to update
403	Not a workspace admin

Example response (200)

{
  "id": "string",
  "platformId": "string",
  "name": "string",
  "require2fa": false,
  "timezone": "string",
  "registrationNumber": "string",
  "legalHold": false,
  "legalHoldAt": "string",
  "legalHoldReason": "string",
  "legalHoldBy": "string",
  "createdAt": "string"
}

GET/company/approval-settings

Read this organisation's approval-governance settings

Readable by any authenticated member of the organisation — forbidSelfApproval decides whether the person who created a payment may approve it, so everyone subject to it can see it. Scope comes from the caller's own context (or explicit platformId+companyId query params for a per-request caller).

Responses

Status	Description
200	Approval settings

Example response (200)

{
  "approvalSettings": {
    "forbidSelfApproval": false,
    "updatedAt": "string",
    "updatedBy": "string"
  }
}

PATCH/company/approval-settings

Patch this organisation's approval-governance settings

Sanitised partial patch of forbidSelfApproval — the organisation-wide maker-checker rule, and the whole of the writable surface. Unknown fields are stripped; an empty effective patch is a 400. There is no way to turn approvals off: approvalMode / externalApprovalAuthority were removed from the product (owner ruling 2026-09-01), so a body naming them stores nothing and is answered 400 rather than 200. Requires a signed-in Admin of this organisation — an API key or an application install is refused, because an integration is usually the maker. Every write is journalled; clearing the ban carries weakening: true in the audit metadata.

Request body required

Responses

Status	Description
200	Updated settings
400	Nothing to update

Example response (200)

{
  "approvalSettings": {
    "forbidSelfApproval": false,
    "updatedAt": "string",
    "updatedBy": "string"
  }
}

GET/company/legal-identity

Read this organisation's legal identity (legal name, VAT number, registered address)

Who we invoice. An organisation that has never set it answers { legalIdentity: {} }.

Responses

Status	Description
200	Legal identity

Example response (200)

{
  "legalIdentity": {
    "legalName": "string",
    "vatNumber": "string",
    "registeredAddress": {
      "streetName": "string",
      "buildingNumber": "string",
      "postCode": "string",
      "townName": "string",
      "countrySubDivision": "string",
      "addressLines": [
        "string"
      ],
      "country": "string"
    },
    "updatedAt": "string",
    "updatedBy": "string"
  }
}

PATCH/company/legal-identity

Patch this organisation's legal identity

Sanitised partial patch of legalName / vatNumber / registeredAddress. Unknown fields are stripped; an empty effective patch is a 400. null clears a field. Requires a signed-in Admin of this organisation.

Request body required

Responses

Status	Description
200	Updated legal identity
400	Nothing to update

Example response (200)

{
  "legalIdentity": {
    "legalName": "string",
    "vatNumber": "string",
    "registeredAddress": {
      "streetName": "string",
      "buildingNumber": "string",
      "postCode": "string",
      "townName": "string",
      "countrySubDivision": "string",
      "addressLines": [
        "string"
      ],
      "country": "string"
    },
    "updatedAt": "string",
    "updatedBy": "string"
  }
}

GET/company/api-keys

List this organisation's API keys (metadata only: never the secret)

Requires a signed-in Admin of this organisation. Returns this organisation's active (non-revoked) self-service keys — id, label, createdAt, lastUsedAt. The raw key is NEVER returned here: it is shown once, at creation.

Responses

Status	Description
200	API keys (no secret)
403	Not an Admin of this organisation

Example response (200)

{
  "items": [
    {
      "id": "string",
      "label": "string",
      "createdAt": "string",
      "lastUsedAt": "string"
    }
  ],
  "nextCursor": "string"
}

POST/company/api-keys

Create an API key: the raw key is returned ONCE

Requires a signed-in Admin of this organisation. Mints a new key bound to this organisation; the raw key value appears ONLY in this 201 response and is never stored or retrievable again. Store it securely.

Request body required

Property	Type	Required	Description
`label`	string	yes	Human name, e.g. "Production ERP".

Example

{
  "label": "string"
}

Responses

Status	Description
201	Key created: raw key shown once
400	Invalid request
403	Not an Admin of this organisation

Example response (201)

{
  "id": "string",
  "key": "string",
  "label": "string",
  "createdAt": "string"
}

DELETE/company/api-keys/{keyId}

Revoke an API key

Requires a signed-in Admin of this organisation. Soft-revokes the key (it stays for audit but stops authenticating immediately).

Parameters

Name	In	Required	Description
`keyId` string	path	yes

Responses

Status	Description
200	Revoked
403	Not an Admin of this organisation
404	Unknown key for this organisation

GET/partner-access/requests

The CUSTOMER's own incoming partner-access requests

Every request made against the caller's own organisation, most recent first. Readable by any authenticated member — the same 'everyone governed by it may see it' posture /company/approval-settings uses.

Responses

Status	Description
200	Incoming requests

Example response (200)

{
  "items": [
    {
      "id": "string",
      "orgId": "string",
      "requestedBy": "string",
      "requestedLevel": "status",
      "status": "pending",
      "createdAt": "string",
      "decidedAt": "string",
      "decidedBy": "string"
    }
  ]
}

POST/partner-access/requests

A partner asks for an access level on a customer's organisation

The partner's own identity (a workspace/platform-admin login) asks for status / payments / administer on orgId — an organisation it may hold no live grant on at all. A pending, non-expired request for the SAME (organisation, requester, level) already existing is a 409; an orgId naming no organisation is a 404. Silently expires after 14 days and may be re-sent.

Request body required

Property	Type	Required	Description
`orgId`	string	yes
`level`	enum	yes

Example

{
  "orgId": "string",
  "level": "status"
}

Responses

Status	Description
201	Request recorded
404	No such organisation
409	A pending request for this (organisation, level) already exists

Example response (201)

{
  "request": {
    "id": "string",
    "orgId": "string",
    "requestedBy": "string",
    "requestedLevel": "status",
    "status": "pending",
    "createdAt": "string",
    "decidedAt": "string",
    "decidedBy": "string"
  }
}

GET/partner-access/my-requests

A partner's own outstanding asks, across every organisation

Every request the caller's own identity has ever made, most recent first — genuinely cross-organisation, since the whole point of asking is that the partner holds no scope on any of them yet.

Responses

Status	Description
200	The partner's own requests

Example response (200)

{
  "items": [
    {
      "id": "string",
      "orgId": "string",
      "requestedBy": "string",
      "requestedLevel": "status",
      "status": "pending",
      "createdAt": "string",
      "decidedAt": "string",
      "decidedBy": "string"
    }
  ]
}

POST/partner-access/requests/{id}/approve

The customer approves a partner-access request

Mints a live partner:<level> grant for the requesting identity on this organisation, revoking any partner-tier grant that identity already held here first. Requires a signed-in Admin of this organisation. A request that is already decided, or has read-time-expired past 14 days, is a 409.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	Approved
404	No such request in this organisation
409	Already decided, or expired

Example response (200)

{
  "request": {
    "id": "string",
    "orgId": "string",
    "requestedBy": "string",
    "requestedLevel": "status",
    "status": "pending",
    "createdAt": "string",
    "decidedAt": "string",
    "decidedBy": "string"
  }
}

POST/partner-access/requests/{id}/deny

The customer denies a partner-access request

Mints nothing. Requires a signed-in Admin of this organisation. Same 404/409 shape as approve.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	Denied
404	No such request in this organisation
409	Already decided, or expired

Example response (200)

{
  "request": {
    "id": "string",
    "orgId": "string",
    "requestedBy": "string",
    "requestedLevel": "status",
    "status": "pending",
    "createdAt": "string",
    "decidedAt": "string",
    "decidedBy": "string"
  }
}

POST/partner-access/grants/{userId}/revoke

The customer withdraws a partner's currently-live access outright

Revokes any live grant the named identity holds on this organisation. A no-op (never an error) when the identity held nothing to revoke. Requires a signed-in Admin of this organisation.

Parameters

Name	In	Required	Description
`userId` string	path	yes

Request body

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	Revocation outcome

Example response (200)

{
  "revoked": false
}

PATCH/users/{id}/settings

Update a user's settings blob (partial)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	yes
`companyId`	string	yes
`settings`	object	yes

Example

{
  "platformId": "string",
  "companyId": "string",
  "settings": {
    "locale": "string",
    "dateFormat": "iso",
    "timezone": "string",
    "notifications": {
      "paymentNeedsApproval": false,
      "paymentApproved": false,
      "paymentRejected": false,
      "statementReceived": false
    }
  }
}

Responses

Status	Description
200	Updated user

Example response (200)

{
  "id": "string",
  "platformId": "string",
  "companyId": "string",
  "email": "string",
  "name": "string",
  "roles": [
    "admin"
  ],
  "status": "active",
  "settings": {
    "locale": "string",
    "timezone": "string",
    "dateFormat": "iso",
    "notifications": {
      "paymentNeedsApproval": false,
      "paymentApproved": false,
      "paymentRejected": false,
      "statementReceived": false
    }
  },
  "totpEnabledAt": "string",
  "createdAt": "string"
}

PUT/users/{id}/roles

Replace a user's role set

PUT = full replacement of the role array (there is no partial role patch). Reports approval-quorum impact in both directions: approving is role-gated, so removing the Approver role from someone an approval policy names can block a bank's sends, and granting it can release one.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required
`platformId`	string	no
`companyId`	string	yes
`roles`	string[]	yes

Example

{
  "platformId": "string",
  "companyId": "string",
  "roles": [
    "string"
  ]
}

Responses

Status	Description
200	Updated user

Example response (200)

{
  "user": {
    "id": "string",
    "platformId": "string",
    "companyId": "string",
    "email": "string",
    "name": "string",
    "roles": [
      "admin"
    ],
    "status": "active",
    "settings": {
      "locale": "string",
      "timezone": "string",
      "dateFormat": "iso",
      "notifications": {
        "paymentNeedsApproval": false,
        "paymentApproved": false,
        "paymentRejected": false,
        "statementReceived": false
      }
    },
    "totpEnabledAt": "string",
    "createdAt": "string"
  },
  "sessionsRevoked": 0,
  "banksPaused": [
    "string"
  ],
  "banksResumed": [
    "string"
  ]
}

POST/users/{id}/deactivate

Deactivate a user (command — keeps data, revokes access)

A state command, deliberately POST (CONTRIBUTING.md (2a, the API conventions) keeps commands as POST): keeps PII for audit, revokes live sessions, and reports approval-quorum impact.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	User deactivated

Example response (200)

{
  "userId": "string",
  "deactivated": false,
  "banksPaused": [
    "string"
  ]
}

POST/users/{id}/reactivate

Reactivate a deactivated user (command — the inverse of deactivate)

A state command, deliberately POST (CONTRIBUTING.md (2a, the API conventions) keeps commands as POST). Restores a DEACTIVATED account to active (or to invited, when it never accepted its invite — no new token is minted, re-send the invite). An ERASED account is never restored, and is refused as a 404 alongside the unknown and not-deactivated cases. Reports approval-quorum impact in its resume direction.

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	User reactivated

Example response (200)

{
  "userId": "string",
  "reactivated": false,
  "status": "string",
  "banksResumed": [
    "string"
  ]
}

POST/users/{id}/reinvite

Re-send a user's invite (command)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	Invite re-sent

Example response (200)

{
  "id": "string",
  "platformId": "string",
  "companyId": "string",
  "email": "string",
  "name": "string",
  "roles": [
    "admin"
  ],
  "status": "active",
  "settings": {
    "locale": "string",
    "timezone": "string",
    "dateFormat": "iso",
    "notifications": {
      "paymentNeedsApproval": false,
      "paymentApproved": false,
      "paymentRejected": false,
      "statementReceived": false
    }
  },
  "totpEnabledAt": "string",
  "createdAt": "string",
  "invited": false,
  "emailDeliveryPending": false,
  "inviteLink": "string"
}

POST/users/{id}/reset-password

Trigger a password reset for a user (command)

Parameters

Name	In	Required	Description
`id` string	path	yes

Request body required

Property	Type	Required	Description
`platformId`	string	no
`companyId`	string	no

Example

{
  "platformId": "string",
  "companyId": "string"
}

Responses

Status	Description
200	Reset issued

Example response (200)

{
  "id": "string",
  "platformId": "string",
  "companyId": "string",
  "email": "string",
  "name": "string",
  "roles": [
    "admin"
  ],
  "status": "active",
  "settings": {
    "locale": "string",
    "timezone": "string",
    "dateFormat": "iso",
    "notifications": {
      "paymentNeedsApproval": false,
      "paymentApproved": false,
      "paymentRejected": false,
      "statementReceived": false
    }
  },
  "totpEnabledAt": "string",
  "createdAt": "string",
  "passwordReset": false,
  "emailDeliveryPending": false,
  "resetLink": "string"
}

Installs

GET/installs

List the organisation's application installs (Admin)

Every install belonging to the caller's organisation, each with its application's display name and its live (unrevoked, unexpired) grants. Keyset pagination: pass the previous page's nextCursor back as cursor. Credential secrets are never returned here — only POST /installs ever shows one, exactly once.

Parameters

Name	In	Required
`companyId` string	query	no
`platformId` string	query	no
`limit` integer	query	no
`cursor` string	query	no

Responses

Status	Description
200	The organisation's installs.
401	Sign in required
403	Admin required, or the grants:manage scope is missing

POST/installs

Mint an install and its show-once credential (Admin)

The ops fallback ADR-0067 names: an admin creates an install, its one root grant and a credential, and pastes the secret straight into the ERP — the path that exists for when the OAuth pairing flow is not available. The raw secret is returned exactly once, in this response, and never stored (only its digest is), the same shape POST /api-keys already uses. scopes must all be delegable: grants:manage and its three NON_DELEGABLE_SCOPES siblings are refused here, and the database's own grants_no_sideways_escalation_chk refuses them again.

Parameters

Name	In	Required	Description
`companyId` string	query	no
`platformId` string	query	no

Request body required

Property	Type	Required	Description
`applicationSlug`	string	no	The registered application to install.
`version`	string	no	The add-on's own version string.
`scopes`	string[]	no	Delegable scopes for the install's root grant. At least one is required.
`expiresAt`	string	no	When the grant ends. Optional: omit it and the grant is given the standard 5-year window. It may be brought FORWARD but not pushed out — a value in the past, or more than 5 calendar years ahead, is refused, and there is no way to ask for a grant that never expires.

Example

{
  "applicationSlug": "string",
  "version": "string",
  "scopes": [
    "string"
  ],
  "expiresAt": "string"
}

Responses

Status	Description
201	The new install, its grant, and the credential secret — shown here and never again.
400	No scope given, a non-delegable scope, or the write was refused.
401	Sign in required
403	Admin required, or the grants:manage scope is missing
404	Unknown or inactive application.

POST/installs/{id}/narrow

Remove scopes from a live grant, without revoking it (Admin)

The modify half of reviewing a granted consent (ASVS 10.7.3): an admin who wants an add-on to keep reading statements but stop submitting payments removes payments:submit and the integration keeps running — the alternative being to revoke the install and re-authorise from scratch, with the integration down in between. scopes is the full set the grant should keep, not a list to remove.

Narrowing only. The write refuses any set that is not a strict subset of what the grant already holds, so this endpoint can never add a scope: widening an app's access is what the consent screen at /oauth/authorize exists to authorise. A request that would widen answers 400 and names the offending scopes.

The change takes effect on the add-on's very next request — an access token carries no scopes of its own, so nothing needs revoking for the narrowing to bite.

Parameters

Name	In	Required
`id` string	path	yes
`companyId` string	query	no
`platformId` string	query	no

Request body required

Property	Type	Required	Description
`grantId`	string	no	Which of the install's live grants to narrow. May be omitted when the install has exactly one, which is every install either minter produces today.
`scopes`	string[]	no	The scopes to KEEP — a strict subset of what the grant holds. At least one is required; to remove them all, revoke the install instead.
`reason`	string	no	Recorded on the journal event.

Example

{
  "grantId": "string",
  "scopes": [
    "string"
  ],
  "reason": "string"
}

Responses

Status	Description
200	The grant's remaining scopes, and what was removed.
400	No scope given, a non-delegable scope, a set that would WIDEN the grant, or the set it already holds.
401	Sign in required
403	Admin required, or the grants:manage scope is missing
404	Unknown or revoked install, or unknown/revoked/expired grant.
409	This grant has live delegated grants beneath it — revoke those first.

POST/installs/{id}/revoke

Revoke an install, an installer's installs, or the whole organisation's (Admin)

Three of ADR-0067's four revocation shapes, chosen by scope and all fenced to the caller's own organisation by RLS: install (the default — just this one), installer (every install created by the same person, for an offboarding), and organisation (all of them, the break-glass). The fourth — suspending an application across every customer — is POST /system/applications/{slug}/suspend, a System-plane route, because a customer's admin must never suspend an app for other customers. Revocation is idempotent in effect: an already-revoked install answers 404 rather than revoking twice.

Parameters

Name	In	Required
`id` string	path	yes
`companyId` string	query	no
`platformId` string	query	no

Request body required

Property	Type	Required	Description
`scope`	enum	no	Which revocation shape to apply. Defaults to this install alone.
`reason`	string	no	Recorded on the journal event.

Example

{
  "scope": "install",
  "reason": "string"
}

Responses

Status	Description
200	How many installs were revoked, and under which shape.
400	Validation failed.
401	Sign in required
403	Admin required, or the grants:manage scope is missing
404	Unknown or already-revoked install.
409	scope=installer, but this install has no recorded installer to revoke by.