Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
All 92 tools
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/ibanfirst-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no email required.
A second provider on the same verified email joins the account you already have.
openapi: 3.0.0
info:
version: 1.6.0
title: iBanFirst API
description: >-
iBanFirst API for cross-border payments, FX trades, account management,
beneficiaries, and webhooks.
**Try it out in Postman:** [View Postman
Collection](https://www.postman.com/productibf/ibanfirst-rest-api-workspace/collection/d24hl8d/ibanfirst-rest-api?action=share&creator=44872188)
---
## Authentication — X-WSSE
Every request must include an `X-WSSE` header. Plain HTTP calls will fail.
The token is **stateless and expires after ~5 minutes**, so it must be
computed fresh for each request.
### Header format
```
X-WSSE: UsernameToken Username="<username>", PasswordDigest="<digest>",
Nonce="<nonce_b64>", Created="<timestamp>"
```
### Fields
| Field | Description |
|---|---|
| `Username` | The username assigned during onboarding. |
| `Nonce` | A Base64-encoded random hex string (≥ 32 hex characters). |
| `Created` | Current UTC timestamp in ISO 8601: `YYYY-MM-DDTHH:MM:SSZ`. |
| `PasswordDigest` | `Base64( SHA-1( nonce_bytes ∥ created_bytes ∥
secret_bytes ) )` — SHA-1 **binary** digest, then Base64. |
### Algorithm (step-by-step)
1. Generate a random nonce: at least 32 lowercase hexadecimal characters
(e.g. `d36e3162829ed4c89851497a717f0001`).
2. Get the current UTC timestamp as an ISO-8601 string (e.g.
`2026-05-12T10:30:00Z`).
3. Encode the nonce string as UTF-8 bytes, the timestamp as UTF-8 bytes, and
the API secret as UTF-8 bytes.
4. Compute `SHA-1( nonce_bytes + created_bytes + secret_bytes )`. The hash
**must** be the raw binary digest (not hex).
5. `PasswordDigest` = `Base64( sha1_binary_digest )`
6. `Nonce` = `Base64( nonce_utf8_bytes )`
### Code samples
**Python**
```python
import base64, hashlib, os, binascii
from datetime import datetime, timezone
def generate_xwsse(username: str, secret: str) -> str:
nonce = binascii.b2a_hex(os.urandom(16)) # 32 hex bytes
created = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
digest = base64.b64encode(
hashlib.sha1(nonce + created.encode() + secret.encode()).digest()
).decode()
nonce_b64 = base64.b64encode(nonce).decode()
return f'UsernameToken Username="{username}", PasswordDigest="{digest}", Nonce="{nonce_b64}", Created="{created}"'
```
**JavaScript (Node.js)**
```javascript
const crypto = require('crypto');
function generateXWSSE(username, secret) {
const nonce = crypto.randomBytes(16);
const created = new Date().toISOString();
const digest = crypto.createHash('sha1')
.update(nonce)
.update(Buffer.from(created))
.update(Buffer.from(secret))
.digest('base64');
return `UsernameToken Username="${username}", PasswordDigest="${digest}", Nonce="${nonce.toString('base64')}", Created="${created}"`;
}
```
**PHP**
```php
function generateXWSSE(string $username, string $secret): string {
$nonce = bin2hex(random_bytes(16)); // 32 hex chars
$created = gmdate('Y-m-d\TH:i:s\Z');
$digest = base64_encode(sha1($nonce . $created . $secret, true));
return sprintf('UsernameToken Username="%s", PasswordDigest="%s", Nonce="%s", Created="%s"',
$username, $digest, base64_encode($nonce), $created);
}
```
### Environments
| Environment | Base URL |
|---|---|
| Demo (testing) | `https://api-demo.ibanfirst.com/api` |
| Live (production) | `https://api.ibanfirst.com/api` |
### Forbidden characters in input fields
The following characters are rejected in route parameters, query parameters,
and JSON bodies: `&` `<` `>` `%` `?` `\` `/` `|`
security:
- X-WSSE: []
tags:
- name: Accounts
description: >-
Each of your accounts has its own specific currency and IBAN. The API
allows you to get details and balances about each account in real time.
**Note :** ***accounts*** are also labelled as ***wallets*** in the iBanFirst API.
- name: Financial movements
description: |
The API allows you to retrieve all financial movements from your accounts.
- name: Beneficiaries
description: >-
A beneficiary can be either your own account in another bank or a third
party recipient account. Beneficiaries can be created or deleted through
the API.
**Note :** ***beneficiaries*** are also labelled as
***externalBankAccounts*** in the iBanFirst API.
- name: Payments
description: >
Sending funds from one of your iBanFirst accounts to your own external
bank account or a third-party recipient involves two steps:
1. Generate the payment object with the 'Create payment' method.
A unique id is assigned to each payment.
2. Use the 'Confirm Payment' method to send the payment for processing.
When you confirm a payment, make sure you have sufficient funds in your
account balance.
**Caution:** Payments are automatically rolled to the next closest working
days if not confirmed in the scheduled date of operation. If the balance
of your account is not sufficient to cover the payment amount, funds may
be locked-in by iBanFirst.
- name: Spot trades
description: >
The API provides a deliverable FX facility and deliverable FX liquidity.
You will become counterparty to iBanFirst and can market and sell
deliverable FX services to corporate and private clients as well as using
such services on their behalf.
FX trades are always made between two accounts of a unique counterparty.
iBanFirst will automatically debit the source account and credit the
delivery account at the date specified in the FX trade instructions. If
the delivery date has been scheduled, the delivery is automatically
processed in the morning before 00:30 am Paris time. If the delivery date
is today (TOD), the funds is available on your account by the next 20mn.
A FX trades also involves an amount, which includes both the numeric
amount and the currency in order to define if this amount is the nominal
to be bought or sold, for example: '100000.00+GBP'.
- name: Fixed forward payment contract
description: >-
Book a fixed forward payment contracts instantly on iBanFirst without
manual intervention.
- Available currency pairs:
- **EUR/USD**
- **EUR/GBP**
- **GBP/USD**
- Maturities: **up to 6 months**.
- Transaction limit: **1M EUR** equivalent per transaction.
Before using fixed forward, you must have:
- Credit approval.
- Collateral in place.
- Accepted the Autonomous Forward disclaimer.
The `deliveryDate` must satisfy the following conditions:
- **Minimum date**: current date + 3 business days.
- **Maximum date**: earlier between [current date + 6 months] and maximum maturity date allowed.
- name: Documents
description: >-
The API allows you to access your documents stored on the iBanFirst
platform through a one-time access link.
Documents must be generated on the platform before being available through the API.
- name: Webhook subscriptions
description: >-
**1. WHAT IS A WEBHOOK ?**
- Webhooks are events based real-time notifications providing updates on transactions and removing the need for periodic polling.
- Webhook notifications are sent as HTTPS POST requests to a URL of your choice.
**2. WEBHOOK SUBSCRIPTIONS**
- Each webhook subscription allows you to receive notifications for one or more event types :
- **Outgoing payment :**`PAYMENT_PLANIFIED` `PAYMENT_FINALIZED` `PAYMENT_WAITING_SIGNATURE` `PAYMENT_AWAITING_CONFIRMATION` `PAYMENT_CANCELED` `PAYMENT_BLOCKED` `PAYMENT_WAITING_JUSTIFICATION` `PAYMENT_INCOMING`
- **Spot trade** : `TRADE_PLANIFIED` `TRADE_FINALIZED` `TRADE_CANCELED` `TRADE_BLOCKED`
- You may have up to 10 active subscriptions at the same time.
**3. IMPLEMENTATION**
- **Delivery and retries**
- Webhook notifications may not be delivered in order, your implementation should not assume sequential delivery.
- If a notification delivery fails (HTTP status code 400 or 500), it will be retried twice, with a 60-second delay between attempts. This results in a maximum of three delivery attempts per event.
- **Acknowledgement**
- We recommend responding with a HTTP `204` code (No Content) to acknowledge receipt of a notification.
- **Whitelisting**
- To ensure webhook notifications reach your URL, you may need to whitelist the following IP (production and demo): **51.158.86.1**.
**4. SECURITY**
- Each webhook notification includes an HMAC-256 signature in the request
header to let you **validate its authenticity**.
- To verify the signature, recontruct the signed message by concatenating the exact timestamp and request raw body as received : `x-ibanfirst-timestamp.{Body}`.
- Compute an HMAC-SHA256 hash of this string using the subscription secret key and compare the result with the `x-ibanfirst-signature` provided in the notification header.
- You must **reject** the notification if the signatures do not match.
- Recommended best practices :
- Always validate the signature before processing any webhook notification.
- Webhook notification payloads must be stored on a private server to protect sensitive data.
**5. WEBHOOK NOTIFICATION CONTENT**
Notifications contain the relevant object as described in each reconciliation service.
- [Get payment details](https://docs.ibanfirst.com/api/clientapi/payments/paths/~1payments~1%7Bid%7D/get)
- [Get trade detail](https://docs.ibanfirst.com/api/clientapi/trades/paths/~1trades~1%7Bid%7D/get)
```json
{
"event": event_label,
"payload": {
see get payment details, get trade details
},
"webhookId": "e35b6e8d-67ef-4973-945d-c3190a60d0aa"
}
```
paths:
/wallets:
post:
summary: Create account
tags:
- Accounts
description: >
This request allows you to submit a new account.
**Caution :** The holder object in the parameters will only be
considered if you suscribed to the `Multi account per currency with
holder` account option.
requestBody:
content:
application/json:
schema:
type: object
required:
- currency
properties:
currency:
$ref: '#/components/schemas/Currency'
tag:
type: string
description: |
Custom data.
holder:
$ref: '#/components/schemas/Holder'
description: |
The account to create
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Wallet'
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
get:
summary: Get accounts list
tags:
- Accounts
description: >
This service allows you to retrieve the list of all your accounts hold
with iBanFirst. The object returned in the array is a simplified version
of the account details providing you main information about the
account.
parameters:
- name: page
in: query
description: |
Index of the page.
required: false
schema:
type: string
default: '1'
- name: per_page
in: query
description: |
Number of items returned.
required: false
schema:
type: string
default: '50'
- name: sort
in: query
description: |
Accounts are sorted by creation date.
required: false
schema:
type: string
enum:
- ASC
- DESC
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
wallets:
type: array
description: List of accounts
items:
type: object
description: |
A shorter version of the account
properties:
id:
$ref: '#/components/schemas/ID'
tag:
type: string
description: |
The custom wording of the account.
currency:
$ref: '#/components/schemas/Currency'
bookingAmount:
$ref: '#/components/schemas/Amount'
valueAmount:
$ref: '#/components/schemas/Amount'
dateLastFinancialMovement:
$ref: '#/components/schemas/Date'
'204':
description: No account found
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/wallets/{id}:
get:
summary: Get account details
tags:
- Accounts
description: |
Retrieve details about a specific account.
parameters:
- name: id
in: path
description: |
The unique id identifying your account.
**Note :** you may use the **Get account lists** service to get the unique id of your accounts.
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
wallet:
$ref: '#/components/schemas/Wallet'
'204':
description: No account found
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/wallets/{id}/balance/{date}:
get:
summary: Get account balance
tags:
- Accounts
description: >
This request allows you to see the details of an account balance at a
given date.
parameters:
- name: id
in: path
description: |
The unique id identifying your account.
Note : you may use the **Get accounts list** service to get the unique id of your accounts.
required: true
schema:
type: string
- name: date
in: path
description: |
The date used to retrieve the account balance.
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
wallet:
type: object
properties:
id:
$ref: '#/components/schemas/ID'
balance:
$ref: '#/components/schemas/Balance'
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/financialMovements:
get:
summary: Get financial movements
tags:
- Financial movements
description: >
Retrieve a list of financial movements that has been received or sent
for the last 12 months.
parameters:
- name: walletId
in: query
description: |
The unique id of an account.
required: false
schema:
type: string
- name: fromDate
in: query
description: |
The starting date to search financial movements on your accounts.
required: false
schema:
type: string
format: YYYY-MM-DD
- name: toDate
in: query
description: |
The ending date to search financial movements on your accounts.
required: false
schema:
type: string
format: YYYY-MM-DD
- name: page
in: query
description: |
Index of the page.
required: false
schema:
type: string
default: '1'
- name: per_page
in: query
description: |
Number of items returned.
required: false
schema:
type: string
default: '50'
- name: sort
in: query
description: |
A code representing the order of rendering objects.
required: false
schema:
type: string
enum:
- ASC
- DESC
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
financialMovements:
type: array
items:
type: object
properties:
id:
$ref: '#/components/schemas/ID'
bookingDate:
$ref: '#/components/schemas/Datetime'
walletId:
$ref: '#/components/schemas/ID'
valueDate:
$ref: '#/components/schemas/Date'
amount:
$ref: '#/components/schemas/Amount'
description:
description: Description of the financial movement.
type: string
maxLength: 76
'204':
description: No financial movements found
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/financialMovements/{id}:
get:
summary: Get financial movement details
tags:
- Financial movements
description: >-
Request information on a particular financial movement that has been
credited or debited to a wallet.
The `typeLabel` field may contain these values:
- **rejectOperation**: Payment returned by the bank counterparty
- **DebitForExchange**: Debit for an FX operation
- **DebitForTransfer**: Debit linked to a transfer
- **CreditForExchange**: Credit linked to an FX operation
- **Immobilize**: Payment registered but not debited on value date
- **ExternalCounterpartCredit**: Account credit
- **debitForAccountGuaranteeCredit**: Movement related to the deposit for forward exchange transaction
- **debitAccountGuarantee**: Movement related to the deposit for forward exchange transaction
- **internalGuaranteeTransfer**: Movement related to the deposit for forward exchange transaction
- **corrective**: Corrective
- **rejectCreditDepositAccount**: Rejection of a flow credited to the account / after liquidation
- **returnFund**: Payment returned by the recipient counterparty
- **rejectDebit**: Rejection of an automatic debit on iBanFirst account (SDD)
- **PrepaidCardDepositAccountDebit**: Initialization of a virtual payment card
- **PrepaidCardDepositAccountCredit**: Recredit funds stored on a virtual payment card that expires
- **clientFee**: Fees for using iBanFirst accounts
- **cancelClientFee**: Commercial gesture
- **DirectDebit**: Direct debit on iBanFirst account
parameters:
- name: id
in: path
description: |
The id referring the financial movement.
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
financialMovement:
$ref: '#/components/schemas/FinancialMovement'
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/externalBankAccounts:
post:
summary: Create beneficiary
tags:
- Beneficiaries
description: >
By submitting a new beneficiary, you must supply the relevant details in
order to execute a payment.
**Note :** each of your physical IBAN accounts hold with iBanFirst will be automatically created when subscribing with us.
The **Create beneficiary** service allows to reference external accounts
which can be either your own accounts in another bank or a third party
account.
Adding a beneficiary has some rules :
* If you have the BIC/SWIFT of the bank, just submit it, and we will
recover informations of the bank on our own.
* If you do not have the BIC/SWIFT of the bank, you have to refer at
least its clearing code type, its clearing code and its name.
* In both cases, if values are not mentionned above, they are not
required.
This service include verifications on the format of the account created.
The API has been made in order to accept local specification of
cross-boarder payments.
The API accepts the following formats of external bank accounts :
- Austrian Bankleitzahl
- Australian Bank State Branch
- German Bankleitzahl
- Canadian Payments Association Payment Routing Number
- Spanish Domestic Interbanking Code
- Fedwire Routing Number
- HEBIC (Hellenic Bank Identification Code)
- Bank Code of Hong Kong
- Irish National Clearing Code (NSC)
- Indian Financial System Code (IFSC)
- Italian Domestic Identification Code
- New Zealand National Clearing Code
- Polish National Clearing Code (KNR)
- Portuguese National Clearing Code
- Russian Central Bank Identification Code
- UK Domestic Sort Code
- Swiss Clearing Code
- South African National Clearing Code
requestBody:
content:
application/json:
schema:
type: object
required:
- accountNumber
- currency
- holderBank
- holder
properties:
accountNumber:
type: string
maxLength: 50
description: |
The recipient account number or IBAN.
currency:
$ref: '#/components/schemas/Currency'
holderBank:
$ref: '#/components/schemas/HolderBank'
holder:
$ref: '#/components/schemas/Holder'
contactEmail:
$ref: '#/components/schemas/Email'
tag:
type: string
maxLength: 50
description: |
Custom Data.
correspondentBic:
type: string
maxLength: 50
description: |
The intermediary bank identifier code.
verificationOfPayee:
type: boolean
description: >-
`true` to verify the beneficiary's IBAN, name and type. If
the verification fails, the beneficiary will not be created.
**Note** : the verification of payee process can take up to 8 seconds.
description: the account to post
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ExternalBankAccountVOP'
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorVOP'
get:
summary: Get beneficiaries list
tags:
- Beneficiaries
description: |-
Retrieve the list of all beneficiaries referenced with your accounts.
**Note :** you may use the **Retrieve beneficiaries** service to get the unique id of your accounts.
parameters:
- name: sort
in: query
description: >
A code representing the order of rendering external bank accounts
with their creation date.
required: false
schema:
type: string
enum:
- ASC
- DESC
- name: page
in: query
description: |
Index of the page.
required: false
schema:
type: string
default: '1'
- name: per_page
in: query
description: |
Number of items returned.
required: false
schema:
type: string
default: '50'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
accounts:
type: array
description: |
An array containing a list of beneficairies.
items:
$ref: '#/components/schemas/ExternalBankAccount'
'204':
description: No externalBankAccounts found
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/externalBankAccounts/{id}:
get:
summary: Get beneficiary details
tags:
- Beneficiaries
description: >
This request allows you to see the details related to a specific
beneficiary.
parameters:
- name: id
in: path
description: |
The unique id of the beneficiary.
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
account:
$ref: '#/components/schemas/ExternalBankAccount'
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
delete:
summary: Delete beneficiary
tags:
- Beneficiaries
parameters:
- name: id
in: path
description: |
The unique id of the beneficiary to be deleted.
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ProcessResult'
'204':
description: No externalBankAccounts found
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/payments/options/{walletId}/{externalBankAccountId}:
get:
summary: Get payment options
tags:
- Payments
description: >-
Before doing any payments, you may use this request to get priority and
fee options available for a given account and beneficiary.
You will also get fee cost for each `priorityPaymentOption` and
`feePaymentOption` combinations, and minimal source and target amount
for this combination.
**Note :** you may also use this request to estimate the cost of a payment.
parameters:
- name: walletId
in: path
description: |
The source account you want to put your payment debit on.
required: true
schema:
type: string
- name: externalBankAccountId
in: path
description: |
The beneficiary you want to put your payment credit on.
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PaymentOption'
default:
description: ERROR
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/payments:
post:
summary: Create payment
tags:
- Payments
description: |
You can use this request to schedule a new payment.
requestBody:
content:
application/json:
schema:
type: object
required:
- sourceWalletId
- externalBankAccountId
- amount
- desiredExecutionDate
- feeCurrency
- feePaymentOption
- priorityPaymentOption
properties:
sourceWalletId:
$ref: '#/components/schemas/ID'
externalBankAccountId:
$ref: '#/components/schemas/ID'
amount:
$ref: '#/components/schemas/Amount'
desiredExecutionDate:
$ref: '#/components/schemas/Date'
feeCurrency:
$ref: '#/components/schemas/Currency'
feePaymentOption:
description: >
A code representing the charges option to be applied to this
payment.
type: string
enum:
- BEN
- OUR
- SHARE
- SEPA
- DSP
- RTGS
priorityPaymentOption:
$ref: '#/components/schemas/paymentSpeedOption'
tag:
description: >
A custom reference that you want to link to this payment in
the system. This tag is not communicated to the beneficiary.
type: string
maxLength: 50
communication:
description: |
A free format string sent to the beneficiary.
type: string
maxLength: 76
verificationOfPayee:
type: boolean
description: >-
`true` to verify the beneficiary's IBAN, name and type. If
the verification fails, the payment will not be created.
**Note** : the verification of payee process can take up to 8 seconds.
description: |
The payment to post
required: true
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
payment
# --- truncated at 32 KB (101 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/ibanfirst/refs/heads/main/openapi/ibanfirst-clientapi-openapi.yml