Brightfield Software Connect API

Live PSD2/AIS bank connections (Distyra Connect). Fetch normalized transactions from a bank account on demand. Nothing is stored. `mode` says whose account it is: `own` (your organization’s), `end_user` (a customer of your product, for anyone embedding Connect in something they sell), or `applicant` (an underwriting applicant). Only `applicant` needs an Underwriting subscription. Billed per active connection per month. ### Connecting a bank account, start to finish **1. Ask for a link.** `POST /v1/connect/hosted-link` with the bank’s two-letter country code, e.g. `{ "country": "NL" }`. For a customer’s account also send `mode: "end_user"`, your own `external_ref` to identify them, and a `return_url`. Returns `{ url, token, expires_at }`. **2. Send the account holder to that `url`.** They pick their bank and log in on the bank’s own site. Neither you nor we see their credentials. The bank returns them to your `return_url`. **3. Wait to be told it worked.** Listen for `connect.connection.activated`, or poll `GET /v1/connect/connections` for one with `status` `active`. Do not treat the `return_url` redirect as success: they may have cancelled. **4. See what you got.** `GET /v1/connect/connections/{id}/accounts`. One consent often covers several accounts. **5. Fetch transactions.** `GET /v1/connect/connections/{id}/transactions`. First call: no dates, and you get all the history the bank will give, which can be years; make it soon after the connection activates, because many banks give long history only then. Every later call without dates gives 90 days. After the first call pass `since=` the previous response’s `next_cursor`, and de-duplicate on transaction `id` because the boundary day can overlap. `history=recent` limits any call, the first included, to 90 days. `?enrich=true` adds merchant names, logos and categories. Every call fetches from the bank, so poll on the schedule your product needs rather than in a loop. **6. Let them disconnect.** `POST /v1/connect/connections/{id}/revoke-link` returns a short-lived, keyless URL to put behind a Disconnect button. `DELETE /v1/connect/connections/{id}` does the same from your backend. **Consent expires** on a date set by the account holder’s bank, and banks differ. Each connection’s `consent_expires_at` gives the exact date, and `max_consent_days` on `GET /v1/connect/aspsps` gives a bank’s limit before anyone connects. If you need one number to plan around, use 90 days: no bank we connect to allows less. An `applicant` connection closes after 7 days. For `own` and `end_user` you get `connect.connection.reconsent_required` before it lapses, and every connection sends `connect.connection.expired` after. Reconnect by repeating step 1 with the same `external_ref`, which is what keeps your records pointing at the right customer.