Memo Bank Webhook API

openapi: 3.2.0
info:
  title: Memo Bank Webhook API
  description: '**Welcome!** You can use our [Premium Bank API](https://memo.bank/produit/api/)  to check your company’s accounts, fetch your transactions, make SEPA transfers,  initiate SEPA direct debit collections, create virtual IBANs, and access most of Memo Bank features.

    > info

    > If you are a **third-party payment service provider** complying with PSD2, you may be more interested in our [NextGenPSD2 API](https://docs-nextgenpsd2.api.memo.bank).

    '
  version: '2.0'
servers:
- url: https://api.memo.bank
  description: Production
- url: https://api.sandbox.memo.bank
  description: Sandbox
tags:
- name: Webhook
  description: "# Events\n\nWhen something interesting happens on your Memo Bank workspace, such as a new transaction being created, Memo Bank can reach out to your application so that you can take action (such as sending an e-mail alert about the transaction to your user) automatically.\n\nThe first step is to add a webhook to your application in the [`API`](https://client.memo.bank/api) section of your Memo Bank workspace. As part of this, you will have to provide a URL on your own servers. Memo Bank will then send HTTPS requests to that URL when there is an activity on your Memo Bank workspace.\n\nNote that even if webhooks are setup within an application, events will  be received even when they result from actions triggered on the Memo Bank  webapp or any other application.\n# Consuming events\nIndividual events do not contain very much information on their own. This is by design, as the API structure can remain extremely stable and avoid difficult webhook migrations in the future as the Memo Bank API changes. If you need additional metadata, such as the amount of the transaction in the above example, make a `GET` request to the API for that information. You can use the `resource_type` and `resource_id` to determine what resource to fetch from the API.\n# Failures and retries\nIf your application returns anything other than a 2xx HTTP status code,  if we do not receive a response before timing out or in the case of  a network failure, we will retry the event up to 8 times with exponentially increasing backoffs.  In your webhook endpoint implementation,  we recommend you place  inbound Events into your application's own queuing system  (such as Kafka, Resque, etc) for asynchronous event processing,  and returning a 200 response from your endpoint as quickly as possible.\n\nSince retries may occur, your webhook endpoint must be idempotent. You should handle the possibility of receiving the same event multiple times. We recommend using the event `id` field to detect and ignore duplicate events on your side.\n# Securing your webhook endpoint (recommended)\nMemo Bank will include an `Authorization` header in each webhook request. Inside of it, you will find `Bearer <token>` with the authentication token we provided when you created the webhook on the web interface. We recommend that you check this header and reject requests with invalid token, indicating a malicious request that would not have been issued by Memo Bank.\n\nWe also recommend that you restrict which IP addresses can call your  webhook. Here is the list of our IPv4 addresses:\n* Memo Bank Premium API (i.e. `api.memo.bank`):\n  * `34.38.96.206`\n  * `35.189.206.171`\n  * `35.241.129.224`\n  * `34.155.214.185`\n  * `34.155.206.98`\n  * `34.163.14.38`\n\n* Memo Bank Premium Sandbox API (i.e. `api.sandbox.memo.bank`):\n  * `34.155.60.111`\n  * `34.163.27.39`\n"
paths: {}
webhooks:
  event:
    post:
      tags:
      - Webhook
      summary: Handle an event
      operationId: handleEvent
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Event'
          application/vnd.memo-bank.v1+json:
            schema:
              $ref: '#/components/schemas/Event'
        required: true
      responses:
        '204':
          description: No content
components:
  schemas:
    Event:
      required:
      - date
      - event_type
      - id
      - resource_id
      - resource_type
      type: object
      properties:
        id:
          type: string
          description: 'ID of this event. Must be used for idempotence: an event with the same ID can be sent multiple times in case of error, but should only be processed once.'
          format: uuid
          example: ad8340e7-0675-4182-9c95-520e7c9a72a3
        date:
          type: string
          description: Event creation date, in ISO8601 format.
          format: date-time
        event_type:
          type: string
          description: Type of event. We may add additional possible types over time; your application should be able to handle such additions gracefully.
          enum:
          - account_created
          - account_updated
          - account_closed
          - attachment_created
          - attachment_deleted
          - collection_confirmed
          - collection_returned
          - collection_canceled
          - collection_failed
          - iban_created
          - iban_updated
          - iban_deleted
          - transaction_scheduled
          - transaction_authorized
          - transaction_confirmed
          - transaction_rejected
          - transaction_canceled
          - transfer_confirmed
          - transfer_returned
          - transfer_canceled
          - transfer_failed
          - wire_transfer_confirmed
          - wire_transfer_returned
          - wire_transfer_canceled
          - wire_transfer_failed
          - wire_transfer_attachment_required
          - bulk_transfers_completed
          - bulk_collections_completed
          - mandate_signature_request_sent
          - mandate_signature_request_expired
          - mandate_signature_request_completed
          - mandate_signature_request_deleted
          - account_assessment_failed
          - account_assessment_completed
        resource_type:
          type: string
          description: Type of the resource referenced by this event. We may add additional possible source types over time; your application should be able to handle such additions gracefully.
          enum:
          - account
          - attachment
          - collection
          - iban
          - transaction
          - transfer
          - wire_transfer
          - bulk_transfers
          - bulk_collections
          - mandate_signature_request
          - account_assessment
        resource_id:
          type: string
          description: ID of the resource referenced by this event.
          format: uuid
          example: 5400f1ad-788c-4bef-9ded-4d7afd8472d7
x-topics:
- title: Getting started
  content: 'To get started with our Premium Bank API, talk to your banker first. He or she needs  to activate the API feature on your Memo Bank workspace.


    Once your banker has granted you API access, you can then set up your authentication using our web interface. To do so, navigate to the  [`API`](https://client.memo.bank/api) section of your Memo Bank workspace.


    Owners and administrators can create applications and manage their permissions. They can also invite collaborators to an application, allowing them to manage certificates, IP allow-lists, and  webhooks.


    Once an application and a certificate have been created, you will have  three pieces of information allowing you to authenticate requests on  the API:

    1. a **certificate** and its SHA256 thumbprint;

    2. a **secret code**;

    3. a cryptographic **private key**.

    '
- title: Authentication
  content: "Our authentication is based on JSON Web Token ([JWT](https://datatracker.ietf.org/doc/html/rfc7519)) and JSON Web Signature ([JWS](https://datatracker.ietf.org/doc/html/rfc7515)).\n\nRegardless of which programming language you are using, there should be [a library](https://jwt.io/libraries) to handle the cryptographic part for you. All you need is to provide the correct header and payload claims. \n\n**In the JWT header:**\n- `alg` must be `RS256`, as we require an RSA-SHA256 signature. \n- `typ` must be `JWT`.\n- `x5t#S256` is the SHA256 thumbprint of the certificate, which you can find in the user interface.\n\n**In the JWT payload:**\n- `sub` must be the request method, followed by a space and the full path, including query parameters.\n- `aud` must be the domain to which you are making the request, e.g., `api.memo.bank`.\n- `iat` must be the timestamp at which you created the token. Note that we accept only a 5-second difference from the server time to mitigate clock skew.\n- `jti` must be a unique identifier for the token. It must be different for each request and follow the UUID format.\n- `sec` must be the secret information you obtained during the setup process in the user interface. This is a custom claim not covered by the JWT specification.\n- `dig#S256` must contain the base64url-encoded SHA-256 hash of the body (`base64url(sha256(body))`, see [`base64url`](https://datatracker.ietf.org/doc/html/rfc7515#appendix-C)). It must be provided only if the request has a body; for example, it is not necessary for `GET` requests. This is a custom claim not covered by the JWT specification.\n\nThe JWT must then be **signed with the private key** you generated during the setup (see [Getting started](#topic-getting-started)), and included in the HTTP headers of the request, as a standard bearer token `Authorization: Bearer <token>`.\n"
  example: "_Example JWT header and payload_\n```json\n{\n  \"alg\": \"RS256\",\n  \"typ\": \"JWT\",\n  \"x5t#S256\": \"3A14ZcxIaasp4RHaYReL7wevm3oDzn7ZqmgqScCMY74\"\n}\n{\n  \"sub\": \"POST /v1/transfers\",\n  \"aud\": \"api.memo.bank\",\n  \"iat\": 1657055009,\n  \"jti\": \"5525620b-9dcd-4562-8c6c-60984f46cb48\",\n  \"sec\": \"a2029d646c94406d2945b7a2b31e4fb3ff09a6d0ae29144380775b5471c4e846\",\n  \"dig#S256\": \"lW6N_kO2gPMsMkzXyn028gWwrnaN0kJaiy7FMJcR0Ek\"\n}\n```\n"
- title: Idempotent requests
  content: "Our Premium Bank API supports **idempotency** to safely retry requests without accidentally performing the same operation twice. This is useful when an API call is disrupted in transit and you do not receive a response. For example, if a request to create a transfer does not go through due to a network connection error, you can retry the request with the same  idempotency key to guarantee that only the single transfer originally  attempted is created.\n\nTo perform an idempotent request, provide an additional `Idempotency-Key` **request header**. We recommend using a **V4 UUID**. If the API call fails with a network error or responds with a  `5XX`, `409`, or `429` status code, we expect the caller to perform retries with the same `Idempotency-Key` header until it responds differently. For any other response code, especially other `4XX` errors, there is no point in attempting retries, as we will always return the same result. \n\nWhen a previous response is replayed, the response includes an  additional HTTP header: `Idempotent-Replayed: true`.\n\nIf an original request is still being processed when an idempotency key is reused, the API will return a `409 Conflict` error  (which is safe to retry).\n\nSubsequent requests must be identical to the original request, or the API  will return a `422 Unprocessable Entity` error. We do not support setting  an idempotency key on `GET` and `DELETE` requests, as these requests are inherently idempotent.\n"
  example: "```\ncurl --request POST \\\n  --url https://api.memo.bank/v1/transfers \\\n  --header 'Authorization: Bearer ***' \\\n  --header 'Idempotency-Key: 19b390d1-e7d4-4e27-abe2-49cac9b41ba1' \\\n  --header 'Content-Type: application/json' \\\n  --data '{...}'\n```\n"
- title: Errors
  content: 'Our Premium Bank API uses standard HTTP response codes to indicate the success or failure of requests. Codes in the `2xx` range indicate success; codes in the `4xx` and `5xx` ranges indicate errors. The format of error messages is unified and can be distinguished by their `code` key. The `message` provides a plain English explanation of the problem.

    '
  example: "```json\n{\n  \"code\": \"error_code\",\n  \"message\": \"Example error message.\",\n}\n```\n"
- title: Versioning and backwards compatibility
  content: 'Our Premium Bank API is versioned by path (`/v1/...`). When we introduce breaking changes, we will increase this version number. We will, of course, continually make backward-compatible changes without increasing the version number.


    Examples of changes we do **not** consider breaking include:

    * Adding new API resources.

    * Adding new optional request parameters to existing API methods.

    * Adding new properties to existing API responses. We will occasionally move response fields in the API and will continue to return the existing field in its previous location while removing it from this documentation.

    * Changing the order of properties in existing API responses.

    * Changing the length or format of opaque strings, such as object IDs, error messages, and other human-readable strings. Strings that are marked as const or enum in this documentation will not change.

    * Adding new `EventType` or `ResourceType` enum values for webhooks.

    * Adding new `TransactionSource` enum values for transactions.

    '
- title: Rate limiting
  content: "We enforce a rate limit on the number of HTTP requests that can be made in a  given period. When the limit is reached, our Premium Bank API will return a `429 Too Many Requests` error.\n\nTo allow you to handle this rate limiting programmatically, the following headers are sent with every response: \n- `RateLimit-Limit`: total number of available requests between two quota resets;\n- `RateLimit-Remaining`: number of available requests until the quota is reset;\n- `RateLimit-Reset`: time remaining (in seconds) until the quota is reset.\n"
- title: API recipes
  content: 'While our OpenAPI specification provides a comprehensive reference for the Memo Bank API, we''ve created  API recipes to give you practical, hands-on guides for common use cases. These recipes offer step-by-step  examples to help you quickly integrate and leverage our API. You can find them here:  [API Premium - Memo Bank](https://aide.memo.bank/category/349-api)

    '
- title: FAQ
  content: '### How do transactions differ from transfers and collections?

    Transfers and collections are types of transactions that you can initiate through the API. They have dedicated  endpoint resources to help you follow their detailed lifecycle. On the other hand,  transactions allow you to follow the lifecycle of all transactions, including those not initiated through  the API (incoming transactions, card transactions, etc). Since transfers and collections are a subset of  transactions, some webhook events will be triggered simultaneously (for instance, `transfer_confirmed` and  `transaction_confirmed`), and you can use either.

    ### Is creating a beneficiary or mandate mandatory before initiating transactions?

    Creating a beneficiary for transfers or a mandate for collections is not mandatory. When initiating a new  transfer or collection, you will provide the counterpart data directly in the initiating endpoint,  We will auto-create it, and you will be able to see it in the interface. For subsequent transfers/collections,  you will continue to provide the counterpart data, and we will match it with any existing beneficiary/mandate  in the interface.

    ### How can I reconcile a return with its original transfer or collection?

    The events `transfer_returned` and `collection_returned` received via webhook will inform you if a  return occurred on either a transfer or a collection. The `resource_id` in those events refers to the ID  of the original transfer/collection. The `return_transaction_id` field on those resources will reference  the return transaction, which is a new transaction typically with the same amount and opposite direction  compared to the original transaction. This new transaction will itself trigger a `transaction_confirmed`  webhook event. For such transactions, if you call [get the transaction](https://docs.api.memo.bank/operation/operation-gettransaction) and check the [source type](https://docs.api.memo.bank/operation/operation-gettransaction#operation-gettransaction-200-body-application-json-source-type),  it will either be `transfer_outgoing_return` or `collection_outgoing_return`.  The `returned_collection_id`/`returned_transfer_id` field will contain the ID of your original  collection/transfer that has been returned.

    ### How can I differentiate transaction types?

    To differentiate transaction types, you can use the [type](https://docs.api.memo.bank/operation/operation-gettransaction#operation-gettransaction-200-body-application-json-source-type) contained in the [source](https://docs.api.memo.bank/operation/operation-gettransaction#operation-gettransaction-200-body-application-json-source) object.

    ### How do I express amounts for different currencies?

    Amounts are always integers expressed in the smallest unit of their currency. When you [create a wire transfer](https://docs.api.memo.bank/operation/operation-createwiretransfer), the unit is determined by the `instructed_currency` you provide, so the same `instructed_amount` value represents a different sum depending on the currency:

    - `instructed_amount: 1234` with `instructed_currency: EUR` means 12.34 €, as the euro has two decimals;

    - `instructed_amount: 5000` with `instructed_currency: JPY` means 5,000 ¥, not 50 ¥, as the Japanese yen has no decimal;

    - `instructed_amount: 1500` with `instructed_currency: TND` means 1.500 TND, that is one and a half dinars and not 1,500 dinars, as the Tunisian dinar has three decimals.


    The number of decimals is defined by the ISO 4217 standard for each currency, rely on that standard rather than assuming two decimals.

    SEPA [transfers](#endpoint-transfers) and [collections](#endpoint-collections) are euro-only, so their `amount` is always a number of cents.

    ### What happens if my system is unavailable when Memo Bank sends webhooks?

    We will retry each webhook event independently 8 times following an exponential backoff. The intervals between retries are: 3 min, 10 min, 30 min, 1 hour, 6 hours, 12 hours, 1 day, and 3 days. After that, we will stop retrying, but  you will be able to manually trigger a retry through our interface.

    ### When using the `instant_if_available` strategy, will Memo Bank retry a failed instant transfer as a standard transfer?

    No, we will not retry failed instant transfers as standard transfers. However, we recommend that you do so. If an  instant transfer fails, retrying it or using a standard transfer is often the best course of action.  `instant_if_available` will only ensure that we process your transfer as standard if the counterparty bank does not support instant transfers.

    ### What is the difference between failed and cancelled transaction statuses?

    Your transaction will end up in a cancelled status when you choose to cancel it either through  our API or our interface. In some cases, your transaction may also end up in a cancelled status due  to internal processing reasons, but most of the time, for processing reasons, your transaction will end up  in a failed status. Both statuses are definitive, and if you did not initiate the cancellation, you can consider them equivalent in your development.

    ### Are webhooks triggered for transactions not initiated with the API?

    Yes, they are. Webhooks are triggered regardless of the channel you use to initiate your transaction.

    ### Is it possible to initiate a payment via API and have it validated by a human on the interface?

    No, it is not possible. Our API is designed for automated, human-free transactions at scale.

    ### How can I stay informed about the latest API updates?

    We provide an RSS feed that you can subscribe to. It is available at this [URL](https://docs.api.memo.bank/changes) when you click the `Get Updates` button at the top of the page.

    '
- title: Sandbox
  content: 'We offer a sandbox, allowing you to integrate your application with our API in a controlled environment. Get in touch with your banker to create an access.


    All the endpoints described in this specification can be used on the sandbox. We also offer some [sandbox only endpoints](#endpoint-sandbox), allowing you to simulate incoming transactions.


    The base URL for the sandbox API is https://api.sandbox.memo.bank and the URL for the sandbox web interface is https://client.sandbox.memo.bank.


    To get to know more about our sandbox behavior and features, please read [our dedicated help page](https://aide.memo.bank/article/398-api-sandbox).

    '