Kanastra Authentication API

openapi: 3.0.3
info:
  title: Kanastra Banking Accounts Authentication API
  version: v1
  description: 'Kanastra Banking API — Brazilian banking-as-a-service and private-credit infrastructure: financial accounts, PIX (keys, transfers, deposits, QR Codes/BR Code), boleto (bank slip) issuance and CNAB return files, TED transfers, wallets, commercial notes (CCB) and guarantees, issuers, and beneficiary accounts. Derived from the provider-published public Postman collection.'
  contact:
    name: Kanastra Pagamentos
    email: pagamentos@kanastra.com.br
    url: https://banking-docs.kanastra.com.br/
  x-apis-json-derived-from: https://banking-docs.kanastra.com.br/ (public Postman collection 35321848/2sA3drHEUr)
servers:
- url: https://banking.kanastra.com.br
  description: Production
- url: https://banking-sandbox.kanastra.com.br
  description: Sandbox
security:
- bearerAuth: []
tags:
- name: Authentication
paths:
  /api/v1/auth/jwks:
    post:
      operationId: authenticationCreateJwks
      summary: Create JWKS
      tags:
      - Authentication
      description: 'For the public key, we use the ES512 algorithm. To generate this key, you can use OpenSSL as shown in the example below: openssl ecparam -name secp521r1 -genkey -noout -out ec-p512-private.pem openssl ec -in ec-p512-private.pem -pubout -out ec-p512-public.pem And send the content of the ec-p512-public.pem file in the publicKey attribute.'
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      responses:
        '201':
          description: Created
  /api/v1/auth/token:
    post:
      operationId: authenticationGenerateAuthorizationToken
      summary: Generate Authorization Token
      tags:
      - Authentication
      description: The clientId will be sent to the integrator during the initial setup. The clientAssertion will be generated in the pre-request script, but we also have this example below in PHP if you want create by yourself. $secretKey = 'YOUR_PRIVATE_KEY'; $alg = 'ES512'; $payload = [ 'iat' => Carbon::now()->timestamp, 'exp' => Carbon::now()->addDay()->timestamp, 'aud' => 'https://auth.kanastra.com.br/realms/{{realm_name}}/protocol/openid-connect/token', 'iss' => 'your-client-id', 'sub' => 'your-client-id', 'jti' => Uuid::uuid4()->toString(), ]; $jwt_signed = JWT::encode($payload, $secretKey, $alg); You should be authenticated after this steps, the post-request script will set the access_token on every api call, and if you have the scope permission to use you be able to test it.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
      responses:
        '200':
          description: Successful response
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT access token from POST /api/v1/auth/token. Register an ES512 public key via POST /api/v1/auth/jwks, then present a signed client assertion (private_key_jwt) to obtain a Bearer token.