Cora website screenshot

Cora

Cora is a Brazilian digital bank (conta PJ) for small and medium businesses, offering fee-free business checking, Pix, boletos, transfers, payment initiation and financial management. Its developer platform exposes REST APIs for registered boleto and carnê issuance, Pix QR code generation, account data, balance and statement queries, payment and transfer initiation (including DARF and GPS tax payments), webhook notifications, and municipal service invoice (NFS-e) issuance. Cora offers two integration modalities — Direct Integration (mutual-TLS certificate plus OAuth2 client-credentials) and Cora Partnership — with a Stage sandbox for testing. Backed by QED Investors and Ribbit Capital.

Cora publishes 1 API on the APIs.io network. Tagged areas include Company, Banking, Brazil, Payments, and Pix.

The Cora catalog on APIs.io includes 1 event-driven AsyncAPI specification.

Cora’s developer surface includes documentation, API reference, getting-started guide, authentication, changelog, engineering blog, support, and 15 more developer resources.

🌐 Visit website 📡 Source on GitHub
44.2/100 developing ▬ flat Agent 35/100 agent ready Full breakdown ↓
scored 2026-08-10 · rubric v0.9.1
AccessSelf serve
1 APIs
CompanyBankingBrazilPaymentsPixBoletoInvoicingSMBFintechBanking-as-a-Service

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-08-10 · rubric v0.9.1
Composite quality — 44.2/100 · developing
Contract Quality 12.9 / 25
Developer Ergonomics 12.6 / 20
Commercial Clarity 6.3 / 20
Operational Transparency 3.1 / 13
Governance 1.5 / 12
Discoverability 8.7 / 10
Agent readiness — 35/100 · agent ready
Machine-Readable Contract 18 / 18
Agentic Access Contract 0 / 10
MCP Server 0 / 12
Machine-Readable Auth 10 / 10
Idempotency 9 / 9
Stable Error Semantics 0 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 0 / 7
Typed Event Surface 6 / 6
Agent Skills 0 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/cora: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 1

Individual APIs this provider publishes, each with its own machine-readable definition.

Cora API

Cora's transactional banking API for Direct Integration: registered boleto and carnê (installment) issuance, Pix QR codes, account data, balance and statement queries, payment a...

Event Specifications 1

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Cora Webhooks

ASYNCAPI

Security Posture 2

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Cora Authentication

oauth2/mutualTLS · 2 schemes

SECURITY

Cora Domain Security

TLSv1.3 · HSTS · DNSSEC · DMARC

SECURITY

Resources

Get Started 3

Portal, sign-up, and the first successful call

DeveloperPortal
DeveloperPortal
 GettingStarted
GettingStarted
 Sandbox
Sandbox

Documentation 2

Reference material describing how the API behaves

Documentation
Documentation
 APIReference
APIReference

Agent Surfaces 1

MCP servers, agent skills, and machine-readable catalogs

LLMsTxt
LLMsTxt

Design & Contract 5

Pagination, idempotency, versioning, errors, and events

Conventions
Conventions
 Idempotency
Idempotency
 Webhooks
Webhooks
 Lifecycle
Lifecycle
 Conformance
Conformance

Build 1

SDKs, sample code, and the tooling you integrate with

Postman
Postman

Access & Security 2

Authentication, authorization, and security posture

Authentication
Authentication
 DomainSecurity
DomainSecurity

Operate 3

Status, limits, changes, and where to get help

ChangeLog
ChangeLog
 Support
Support
 ChangeLog
ChangeLog

Commercial 3

Pricing, plans, and the legal terms of use

Pricing
Pricing
 TermsOfService
TermsOfService
 PrivacyPolicy
PrivacyPolicy

Company 2

The organization behind the API

Website
Website
 Blog
Blog

Source (apis.yml)

apis.yml Raw ↑ 
aid: cora
accessModel:
  pricing: unknown
  onboarding: self-serve
  trial: false
  try_now: false
  public: false
  label: Self-serve signup
  confidence: medium
  source:
  - authentication
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/cora.png
name: Cora
description: Cora is a Brazilian digital bank (conta PJ) for small and medium businesses, offering fee-free business checking,
  Pix, boletos, transfers, payment initiation and financial management. Its developer platform exposes REST APIs for registered
  boleto and carnê issuance, Pix QR code generation, account data, balance and statement queries, payment and transfer initiation
  (including DARF and GPS tax payments), webhook notifications, and municipal service invoice (NFS-e) issuance. Cora offers
  two integration modalities — Direct Integration (mutual-TLS certificate plus OAuth2 client-credentials) and Cora Partnership
  — with a Stage sandbox for testing. Backed by QED Investors and Ribbit Capital.
url: https://raw.githubusercontent.com/api-evangelist/cora/refs/heads/main/apis.yml
x-type: company
x-source: vc-portfolio
x-backed-by:
- qed-investors
- ribbit-capital
x-tier: stub
x-tier-reason: portfolio-lead
specificationVersion: '0.20'
created: '2026-07-17'
modified: '2026-07-18'
tags:
- Company
- Banking
- Brazil
- Payments
- Pix
- Boleto
- Invoicing
- SMB
- Fintech
- Banking-as-a-Service
apis:
- name: Cora API
  description: 'Cora''s transactional banking API for Direct Integration: registered boleto and carnê (installment) issuance,
    Pix QR codes, account data, balance and statement queries, payment and transfer initiation (DARF/GPS), webhook notification
    endpoints, and NFS-e municipal service invoicing. Authenticated with mutual TLS (client certificate + private key) and
    OAuth2 client-credentials bearer tokens.'
  humanURL: https://developers.cora.com.br/
  baseURL: https://matls-clients.api.cora.com.br
  tags:
  - Banking
  - Payments
  - Pix
  - Boleto
  - Invoicing
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: Website
  url: https://www.cora.com.br/
- type: DeveloperPortal
  url: https://developers.cora.com.br/
- type: Documentation
  url: https://developers.cora.com.br/docs/instrucoes-iniciais
- type: APIReference
  url: https://developers.cora.com.br/reference
- type: GettingStarted
  url: https://developers.cora.com.br/docs/instrucoes-iniciais
- type: Authentication
  url: authentication/cora-authentication.yml
- type: ChangeLog
  url: https://developers.cora.com.br/changelog/welcome-to-cora-api
- type: Blog
  url: https://www.cora.com.br/blog/
- type: Support
  url: https://meajuda.cora.com.br/
- type: Pricing
  url: https://www.cora.com.br/integracoes/
- type: TermsOfService
  url: https://www.cora.com.br/termos-e-condicoes-de-apis/
- type: PrivacyPolicy
  url: https://www.cora.com.br/politica-de-privacidade/
- type: Postman
  url: https://www.postman.com/corabank/cora-s-public-workspace/documentation/ppi1okk/api-cora
- type: LLMsTxt
  url: llms/cora-llms.txt
- type: Sandbox
  url: sandbox/cora-sandbox.yml
- type: Conventions
  url: conventions/cora-conventions.yml
- type: Idempotency
  url: conventions/cora-conventions.yml
- type: Webhooks
  url: asyncapi/cora-webhooks.yml
- type: Lifecycle
  url: lifecycle/cora-lifecycle.yml
- type: ChangeLog
  url: changelog/cora-changelog.yml
- type: Conformance
  url: conformance/cora-conformance.yml
- type: DomainSecurity
  url: security/cora-domain-security.yml
x-enrichment:
  date: '2026-07-19'
  status: backfilled
  pass: local-v1
  note: backfilled from .gitignore signal + verified work evidence