Qonto SEPA Transfers API

# Provenance: MODELED-FROM-DOCS (2026-07-17).
# Qonto publishes a first-party OpenAPI 3.x document at
# https://api-doc.qonto.com/docs/business-api/reference/openapi_v2.yml and per-endpoint
# OpenAPI fragments under https://docs.qonto.com/api-reference/ . Those hosts are served
# behind Cloudflare and returned HTTP 403 to automated fetches during authoring, so this
# document was MODELED from the public documentation index (https://docs.qonto.com/llms.txt),
# the per-endpoint markdown fragments, and the getting-started auth/rate-limit pages.
# Base URLs, security schemes, and the /v2/transactions and /v2/sepa/transfers paths were
# confirmed verbatim from the docs; the remaining paths are modeled from documented
# resource operations and should be reconciled against the first-party spec when reachable.
openapi: 3.1.0
info:
  title: Qonto Business API
  description: >-
    Business banking API for Qonto - programmatic access to business accounts, EUR
    transactions, SEPA and international transfers, cards, client and supplier invoices,
    SEPA Direct Debit, payment links, terminals, and webhooks. Authenticated with a
    login+secret-key API key or OAuth 2.0. Modeled from public documentation.
  version: v2
  contact:
    name: Qonto Developers
    url: https://docs.qonto.com/
  termsOfService: https://qonto.com/en/legal
servers:
  - url: https://thirdparty.qonto.com
    description: Production
  - url: https://thirdparty-sandbox.staging.qonto.co
    description: Sandbox
tags:
  - name: OAuth
  - name: Organizations & Accounts
  - name: Transactions & Statements
  - name: SEPA Transfers
  - name: International Transfers
  - name: Internal Transfers
  - name: Cards
  - name: Client Invoices
  - name: Supplier Invoices
  - name: SEPA Direct Debit
  - name: Payment Links
  - name: Terminals
  - name: Webhooks
paths:
  /oauth2/token:
    post:
      operationId: createOrRefreshTokens
      tags: [OAuth]
      summary: Create or refresh OAuth 2.0 tokens
      description: >-
        Exchange an authorization code (or a refresh token) for an access token
        (valid 1 hour), plus a refresh token (valid 90 days) when offline_access is
        requested and an ID token when openid is requested. Must be called from your
        backend so the client secret is never exposed.
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required: [grant_type, client_id, client_secret]
              properties:
                grant_type:
                  type: string
                  enum: [authorization_code, refresh_token]
                client_id: { type: string }
                client_secret: { type: string }
                code: { type: string }
                refresh_token: { type: string }
                redirect_uri: { type: string, format: uri }
      responses:
        '200':
          description: Token set
          content:
            application/json:
              schema: { $ref: '#/components/schemas/TokenSet' }
        '401': { $ref: '#/components/responses/Unauthorized' }
  /v2/organization:
    get:
      operationId: getOrganization
      tags: [Organizations & Accounts]
      summary: Retrieve the authenticated organization and list bank accounts
      description: 'OAuth scope: organization.read'
      responses:
        '200': { description: Organization with bank accounts }
        '401': { $ref: '#/components/responses/Unauthorized' }
        '429': { $ref: '#/components/responses/TooManyRequests' }
  /v2/memberships:
    get:
      operationId: listMemberships
      tags: [Organizations & Accounts]
      summary: List memberships
      description: 'OAuth scope: organization.read'
      parameters:
        - { $ref: '#/components/parameters/CurrentPage' }
        - { $ref: '#/components/parameters/PerPage' }
      responses:
        '200': { description: A paginated list of memberships }
        '429': { $ref: '#/components/responses/TooManyRequests' }
    post:
      operationId: createMembership
      tags: [Organizations & Accounts]
      summary: Create a membership
      description: 'OAuth scope: membership.write'
      responses:
        '201': { description: Membership created }
  /v2/labels:
    get:
      operationId: listLabels
      tags: [Organizations & Accounts]
      summary: List labels
      description: 'OAuth scope: organization.read'
      responses:
        '200': { description: A list of labels }
  /v2/teams:
    get:
      operationId: listTeams
      tags: [Organizations & Accounts]
      summary: List teams
      description: 'OAuth scope: team.read'
      responses:
        '200': { description: A list of teams }
    post:
      operationId: createTeam
      tags: [Organizations & Accounts]
      summary: Create a team
      description: 'OAuth scope: team.write'
      responses:
        '201': { description: Team created }
  /v2/transactions:
    get:
      operationId: listTransactions
      tags: [Transactions & Statements]
      summary: List transactions
      description: 'OAuth scope: organization.read'
      parameters:
        - { name: bank_account_id, in: query, schema: { type: string } }
        - { name: iban, in: query, schema: { type: string } }
        - name: status[]
          in: query
          schema: { type: array, items: { type: string, enum: [pending, declined, completed] } }
        - { name: updated_at_from, in: query, schema: { type: string, format: date-time } }
        - { name: settled_at_from, in: query, schema: { type: string, format: date-time } }
        - name: includes[]
          in: query
          schema: { type: array, items: { type: string } }
        - { $ref: '#/components/parameters/CurrentPage' }
        - { $ref: '#/components/parameters/PerPage' }
      responses:
        '200': { description: A paginated list of transactions }
        '401': { $ref: '#/components/responses/Unauthorized' }
        '429': { $ref: '#/components/responses/TooManyRequests' }
  /v2/transactions/{id}:
    get:
      operationId: getTransaction
      tags: [Transactions & Statements]
      summary: Retrieve a transaction
      description: 'OAuth scope: organization.read'
      parameters:
        - { name: id, in: path, required: true, schema: { type: string } }
      responses:
        '200': { description: A single transaction }
        '404': { description: Not found }
  /v2/statements:
    get:
      operationId: listStatements
      tags: [Transactions & Statements]
      summary: List statements
      description: 'OAuth scope: organization.read'
      responses:
        '200': { description: A list of account statements }
  /v2/cards:
    get:
      operationId: listCards
      tags: [Cards]
      summary: List cards
      description: 'OAuth scope: card.read'
      responses:
        '200': { description: A paginated list of cards }
    post:
      operationId: createCard
      tags: [Cards]
      summary: Create a card
      description: 'OAuth scope: card.write. Issues a virtual or physical card.'
      parameters:
        - { $ref: '#/components/parameters/IdempotencyKey' }
      responses:
        '201': { description: Card created }
  /v2/sepa/transfers:
    get:
      operationId: listSepaTransfers
      tags: [SEPA Transfers]
      summary: List SEPA transfers
      description: 'OAuth scope: organization.read'
      responses:
        '200': { description: A paginated list of SEPA transfers }
    post:
      operationId: createSepaTransfer
      tags: [SEPA Transfers]
      summary: Create a SEPA transfer
      description: >-
        OAuth scope: payment.write. Creates a single SEPA credit transfer in EUR
        (standard or instant). Sensitive; requires Strong Customer Authentication (SCA)
        unless the beneficiary is trusted (Embed partners only).
      parameters:
        - { $ref: '#/components/parameters/IdempotencyKey' }
        - { $ref: '#/components/parameters/ScaSessionToken' }
        - { $ref: '#/components/parameters/MfaHeader' }
      requestBody:
        required: true
        content:
          application/json:
            schema: { $ref: '#/components/schemas/SepaTransferRequest' }
      responses:
        '201': { description: Transfer created }
        '401': { $ref: '#/components/responses/Unauthorized' }
        '422': { description: Validation error (e.g. insufficient limits) }
  /v2/sepa/bulk_transfers:
    post:
      operationId: createSepaBulkTransfer
      tags: [SEPA Transfers]
      summary: Create a bulk SEPA transfer
      description: 'OAuth scope: payment.write'
      parameters:
        - { $ref: '#/components/parameters/ScaSessionToken' }
      responses:
        '201': { description: Bulk transfer created }
  /v2/beneficiaries:
    get:
      operationId: listBeneficiaries
      tags: [SEPA Transfers]
      summary: List SEPA beneficiaries
      description: 'OAuth scope: organization.read'
      responses:
        '200': { description: A list of SEPA beneficiaries }
  /v2/internal_transfers:
    post:
      operationId: createInternalTransfer
      tags: [Internal Transfers]
      summary: Create an internal transfer
      description: 'OAuth scope: internal_transfer.write'
      parameters:
        - { $ref: '#/components/parameters/IdempotencyKey' }
      responses:
        '201': { description: Internal transfer created }
  /v2/international_transfers/currencies:
    get:
      operationId: listInternationalCurrencies
      tags: [International Transfers]
      summary: Get available currencies for international transfers
      description: 'OAuth scope: organization.read'
      responses:
        '200': { description: A list of supported currencies }
  /v2/international_transfers:
    post:
      operationId: createInternationalTransfer
      tags: [International Transfers]
      summary: Create an international transfer
      description: 'OAuth scope: international_transfer.write'
      parameters:
        - { $ref: '#/components/parameters/ScaSessionToken' }
      responses:
        '201': { description: International transfer created }
  /v2/client_invoices:
    get:
      operationId: listClientInvoices
      tags: [Client Invoices]
      summary: List client invoices
      description: 'OAuth scope: client_invoices.read'
      responses:
        '200': { description: A paginated list of client invoices }
    post:
      operationId: createClientInvoice
      tags: [Client Invoices]
      summary: Create a client invoice
      description: 'OAuth scope: client_invoice.write'
      responses:
        '201': { description: Client invoice created }
  /v2/supplier_invoices:
    get:
      operationId: listSupplierInvoices
      tags: [Supplier Invoices]
      summary: List supplier invoices
      description: 'OAuth scope: supplier_invoice.read'
      responses:
        '200': { description: A paginated list of supplier invoices }
    post:
      operationId: createSupplierInvoices
      tags: [Supplier Invoices]
      summary: Create supplier invoices
      description: 'OAuth scope: supplier_invoice.write'
      responses:
        '201': { description: Supplier invoices created }
  /v2/attachments:
    post:
      operationId: uploadAttachment
      tags: [Supplier Invoices]
      summary: Upload an attachment
      description: 'OAuth scope: attachment.write'
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file: { type: string, format: binary }
      responses:
        '201': { description: Attachment uploaded }
  /v2/sepa/direct_debit_collections/mandates:
    post:
      operationId: createSddMandate
      tags: [SEPA Direct Debit]
      summary: Create a SEPA Direct Debit mandate
      description: 'OAuth scope: sepa_direct_debit.write'
      responses:
        '201': { description: Mandate created }
  /v2/sepa/direct_debit_collections:
    get:
      operationId: listSddCollections
      tags: [SEPA Direct Debit]
      summary: List SEPA Direct Debit collections
      description: 'OAuth scope: sepa_direct_debit.read'
      responses:
        '200': { description: A list of SDD collections }
  /v2/payment_links:
    get:
      operationId: listPaymentLinks
      tags: [Payment Links]
      summary: List payment links
      description: 'OAuth scope: payment_link.read'
      responses:
        '200': { description: A list of payment links }
    post:
      operationId: createPaymentLink
      tags: [Payment Links]
      summary: Create a payment link
      description: 'OAuth scope: payment_link.write'
      responses:
        '201': { description: Payment link created }
  /v2/terminals:
    get:
      operationId: listTerminals
      tags: [Terminals]
      summary: List terminals
      description: 'OAuth scope: terminal.read'
      responses:
        '200': { description: A list of terminals }
  /v2/terminal_payments:
    post:
      operationId: createTerminalPayment
      tags: [Terminals]
      summary: Create a terminal payment
      description: 'OAuth scope: terminal.write'
      responses:
        '201': { description: Terminal payment created }
  /v2/webhook_subscriptions:
    get:
      operationId: listWebhookSubscriptions
      tags: [Webhooks]
      summary: List webhook subscriptions
      description: 'OAuth scope: webhook'
      responses:
        '200': { description: A list of webhook subscriptions }
    post:
      operationId: createWebhookSubscription
      tags: [Webhooks]
      summary: Create a webhook subscription
      description: 'OAuth scope: webhook (plus the scope required for each subscribed event)'
      responses:
        '201': { description: Webhook subscription created }
  /v2/webhook_subscriptions/{id}:
    delete:
      operationId: deleteWebhookSubscription
      tags: [Webhooks]
      summary: Delete a webhook subscription
      description: 'OAuth scope: webhook'
      parameters:
        - { name: id, in: path, required: true, schema: { type: string } }
      responses:
        '204': { description: Deleted }
components:
  securitySchemes:
    SecretKey:
      type: apiKey
      in: header
      name: Authorization
      description: >-
        Qonto API key. Value is the organization sign-in and secret key concatenated
        with a colon - "Authorization: {sign-in}:{secret-key}". This resembles HTTP
        Basic auth but is NOT - the value is not Base64 encoded.
    OAuth:
      type: oauth2
      description: >-
        OAuth 2.0 authorization code flow. Access tokens are valid 1 hour; refresh
        tokens 90 days (offline_access). Bearer access token sent in the Authorization
        header.
      flows:
        authorizationCode:
          authorizationUrl: https://oauth.qonto.com/oauth2/auth
          tokenUrl: https://thirdparty.qonto.com/oauth2/token
          scopes:
            openid: OpenID Connect ID token
            offline_access: Issue a refresh token
            organization.read: Read organization, accounts, memberships, labels, transactions
            membership.read: Read the authenticated membership
            membership.write: Create memberships
            team.read: Read teams
            team.write: Create teams
            subscription.read: Read the organization subscription plan
            card.read: Read cards
            card.write: Manage cards
            payment.write: Create SEPA transfers and manage beneficiaries
            internal_transfer.write: Create internal transfers
            international_transfer.write: Create international transfers and beneficiaries
            beneficiary.trust: Trust SEPA beneficiaries
            attachment.read: Read attachments
            attachment.write: Upload attachments
            client.read: Read clients (customers)
            client.write: Manage clients (customers)
            client_invoices.read: Read client invoices, quotes, credit notes
            client_invoice.write: Manage client invoices, quotes, credit notes
            supplier_invoice.read: Read supplier invoices
            supplier_invoice.write: Manage supplier invoices
            product.read: Read products
            product.write: Manage products
            sepa_direct_debit.read: Read SEPA Direct Debit collections/mandates
            sepa_direct_debit.write: Manage SEPA Direct Debit mandates/subscriptions
            payment_link.read: Read payment links
            payment_link.write: Manage payment links
            terminal.read: Read terminals and terminal payments
            terminal.write: Create terminal payments
            einvoicing.read: Read e-invoicing settings
            insurance_contract.read: Read insurance contracts
            insurance_contract.write: Manage insurance contracts
            embed_auth_link.write: Create Embed Auth Links
            webhook: Manage webhook subscriptions
  parameters:
    CurrentPage:
      name: current_page
      in: query
      schema: { type: integer, minimum: 1, default: 1 }
    PerPage:
      name: per_page
      in: query
      schema: { type: integer, minimum: 1, maximum: 100, default: 100 }
    IdempotencyKey:
      name: X-Qonto-Idempotency-Key
      in: header
      description: Client-generated key to safely retry create requests without duplication.
      schema: { type: string }
    ScaSessionToken:
      name: X-Qonto-Sca-Session-Token
      in: header
      description: Strong Customer Authentication (SCA) session token for sensitive operations.
      schema: { type: string }
    MfaHeader:
      name: X-Qonto-MFA
      in: header
      description: Multi-factor authentication challenge header for sensitive operations.
      schema: { type: string }
    StagingToken:
      name: X-Qonto-Staging-Token
      in: header
      description: Sandbox-only staging token.
      schema: { type: string }
  responses:
    Unauthorized:
      description: Missing or invalid authentication
    TooManyRequests:
      description: >-
        Rate limit exceeded (1000 req/10s or 10000 req/10min per IP; or more than
        200 requests returning 401 within 1 hour).
  schemas:
    TokenSet:
      type: object
      properties:
        access_token: { type: string }
        token_type: { type: string, example: bearer }
        expires_in: { type: integer, example: 3600 }
        refresh_token: { type: string }
        id_token: { type: string }
        scope: { type: string }
    SepaTransferRequest:
      type: object
      required: [debit_iban, amount, currency]
      properties:
        debit_iban: { type: string }
        beneficiary_id: { type: string }
        amount: { type: string, example: '100.00' }
        currency: { type: string, enum: [EUR], default: EUR }
        reference: { type: string }
        instant: { type: boolean, default: false }
        scheduled_date: { type: string, format: date }
        attachment_ids:
          type: array
          items: { type: string }
security:
  - SecretKey: []
  - OAuth: []