# Payout Banklink API

One PSD2-based API for your users' accounts at their banks:

- Read account information and transactions
- Initiate payments
- Verify a user's identity through their bank account

The [Banklink guide](https://developers.payout.tech/guides/banklink.html) shows how the calls fit together.

**Amounts** are absolute values; `creditDebitIndicator` gives the sign or direction. Balance
amounts are JSON numbers (`1520.35`), transaction amounts are decimal strings (`"12.50"`) with
the precision the bank reports, and [Initiate payment](#payment_initialisation) takes
`instructedAmount.amount` as a decimal string (`"1.00"`).

## Environments

- Sandbox: `https://wap-sa.payout.one/api`
- Production: `https://wap.payout.one/api`

## Authentication

Call the API with an OAuth2 access token issued by [PayoutID](https://developers.payout.tech/api/payout-id.html), from the
`authorization_code` grant (on behalf of a user) or the `client_credentials` grant. Send it in
the `Authorization: Bearer <access_token>` header.

| Environment | Authorization endpoint                   | Token endpoint                       |
|-------------|------------------------------------------|--------------------------------------|
| Sandbox     | https://id-sa.payout.one/oauth/authorize | https://id-sa.payout.one/oauth/token |
| Production  | https://id.payout.one/oauth/authorize    | https://id.payout.one/oauth/token    |

Each endpoint requires one scope:

| Scope    | Grants | Endpoints |
|----------|--------|-----------|
| `BLAISP` | Read the user's bank accounts | [List accounts](#list_accounts), [Retrieve account details](#account_details), [Retrieve account details and balances](#account_information), [Retrieve account balances](#retrieve_account_balance), [List transactions](#transactions), [List accounts by consent](#consent_accounts) |
| `BLIBAN` | Verify that the user has access to a bank account | [Verify IBAN](#verify_iban) |
| `BLPISP` | Create payments on behalf of the user | [Initiate payment](#payment_initialisation), [Retrieve payment status](#payment_status) |
| `VERIFY` | Verify the user's identity. Request it with the `client_credentials` grant | [Create verification](#create_verification), [Retrieve verification status](#get_verification_status) |

[List integrations](#list_integrations) needs a valid access token but no specific scope.

A missing, invalid or expired token, or a token without the required scope, is rejected with
`403` and error code `UNAUTHORIZED`.

### Authorizing access to the bank account

When the account is not connected yet, or its authorization at the bank has expired, account
endpoints respond with `403` and a body with `consent_id` and `redirect_url`. Then:

1. Redirect the user to `redirect_url` with the query parameters `redirect_uri` (one of the
   redirect URIs registered for your application) and optionally `state`.
2. The user authorizes access at the bank and is redirected back to `redirect_uri` together
   with `state`.
3. Repeat the request. To get every account the user authorized, call
   [List accounts by consent](#consent_accounts) with `consent_id`.

Payments and verifications use the same redirect: `_links.sca.href` from
[Initiate payment](#payment_initialisation) and `redirect_url` from
[Create verification](#create_verification).


## Errors

Errors use HTTP status codes and return a `tppMessages` array:

```json
{
  "tppMessages": [
    {
      "category": "ERROR",
      "code": "INVALID_INPUT",
      "text": "Unsupported IBAN country",
      "xpath": "/debtorAccount/iban"
    }
  ]
}
```

`xpath` is present only for validation errors (`INVALID_INPUT`).

| HTTP | Code                      | Meaning |
|------|---------------------------|---------|
| 400  | `INVALID_REQUEST`         | Missing or invalid header or body |
| 400  | `INVALID_INPUT`           | A request body field failed validation, see `xpath` |
| 400  | `UNSUPPORTED_BANK`        | Bank could not be recognised from `iban` and `bank`, or unknown verification |
| 400  | `INVALID_PAYMENT_PRODUCT` | Unknown `payment_product` path parameter |
| 401  | `INVALID_TOKEN`           | Token does not identify the application (`aud`, `auu` claims) |
| 403  | `UNAUTHORIZED`            | Missing, invalid or expired token, or missing scope |
| 500  | `INTERNAL_SERVER_ERROR`   | Unexpected bank response or internal error |

The two authentication codes are the reverse of what their names suggest: an invalid or expired
token gets `403` with `UNAUTHORIZED`, while `401` with `INVALID_TOKEN` means a valid token whose
claims do not identify your application.

Two responses have a different body:

- A `403` from an account endpoint can carry `consent_id` and `redirect_url` instead, see
  [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
- An unknown payment in [Retrieve payment status](#payment_status) returns `404` with
  `{"errors": {"detail": "Not Found"}}`.


## List accounts

`POST https://wap-sa.payout.one/api/v1/accounts`

Lists the bank accounts the user has connected to Banklink. Banklink answers from its own
records and does not call the bank.

### Response 200

- `accounts` — object[]
  - `identification` — object
    - `iban` — string · IBAN of the account · e.g. `SK3112000000198742637541`
  - `name` — string · Account name · e.g. `Main account`
  - `baseCurrency` — string · Account currency (ISO 4217) · e.g. `EUR`
  - `providerName` — string · Name of the bank servicing the account · e.g. `tatrabanka`

### Responses

- `200` — Connected accounts
- `403` — Missing, invalid or expired access token, or missing scope (`UNAUTHORIZED`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/accounts' \
  -H "Authorization: Bearer $TOKEN"
```


## Retrieve account details

`POST https://wap-sa.payout.one/api/v1/accounts/details`

Retrieves the details of a connected account from the bank, without balances.

### Parameters

- `PSU-IP-Address` (header) — IP address the user is connected from
- `PSU-Presence` (header) — Whether the user triggered the request (default `false`)
  - `true` — The request is a direct result of a user action
  - `false` — Not a direct result of a user action
- `PSU-User-Agent` (header) — User agent of the user's browser

### Request body

- `iban` — string (required) · IBAN of the account · e.g. `SK3112000000198742637541`
- `bank` — string · Integration `name` from [List integrations](#list_integrations), for IBANs whose bank cannot be recognised from the IBAN alone · e.g. `tatrabanka`

### Response 200

- `identification` — object
  - `iban` — string · IBAN of the account · e.g. `SK3112000000198742637541`
- `name` — string · Account name · e.g. `Main account`
- `productName` — string · The bank's product name for the account · e.g. `superaccount`
- `type` — string · Account type, a code from the ISO 20022 `ExternalCashAccountType1Code` list ([external code sets](https://www.iso20022.org/catalogue-messages/additional-content-messages/external-code-sets)), for example `CACC` (current account) or `SVGS` (savings account). `OTHR` means another type · e.g. `CACC`
- `baseCurrency` — string · Account currency (ISO 4217) · e.g. `EUR`
- `authorizationExpiration` — string<date-time> · When the user's authorization of the account expires, in RFC 3339. Set to 90 days after the authorization was created · e.g. `2026-12-31T08:37:51+00:00`

### Responses

- `200` — Account details
- `400` — Missing or invalid header or body (`INVALID_REQUEST`), or the bank could not be recognised (`UNSUPPORTED_BANK`)
- `403` — Returned for two different reasons, told apart by the body:
  
    - **Bank authorization needed** – the account is not connected yet, or its authorization
      at the bank has expired. The body has `consent_id` and `redirect_url`; redirect the
      user, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
    - **Access token rejected** – the token is missing, invalid or expired, or lacks the
      scope. The body is an error with code `UNAUTHORIZED`.
- `500` — Unexpected bank response (`INTERNAL_SERVER_ERROR`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/details' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'
```


## Retrieve account details and balances

`POST https://wap-sa.payout.one/api/v1/accounts/information`

Retrieves a connected account's details and balances from the bank in one call. `account`
is the same object [Retrieve account details](#account_details) returns; the balances are
those of [Retrieve account balances](#retrieve_account_balance) without their `type`.

### Parameters

- `PSU-IP-Address` (header) — IP address the user is connected from
- `PSU-Presence` (header) — Whether the user triggered the request (default `false`)
  - `true` — The request is a direct result of a user action
  - `false` — Not a direct result of a user action
- `PSU-User-Agent` (header) — User agent of the user's browser

### Request body

- `iban` — string (required) · IBAN of the account · e.g. `SK3112000000198742637541`
- `bank` — string · Integration `name` from [List integrations](#list_integrations), for IBANs whose bank cannot be recognised from the IBAN alone · e.g. `tatrabanka`

### Response 200

- `account` — object
  - `identification` — object
    - `iban` — string · IBAN of the account · e.g. `SK3112000000198742637541`
  - `name` — string · Account name · e.g. `Main account`
  - `productName` — string · The bank's product name for the account · e.g. `superaccount`
  - `type` — string · Account type, a code from the ISO 20022 `ExternalCashAccountType1Code` list ([external code sets](https://www.iso20022.org/catalogue-messages/additional-content-messages/external-code-sets)), for example `CACC` (current account) or `SVGS` (savings account). `OTHR` means another type · e.g. `CACC`
  - `baseCurrency` — string · Account currency (ISO 4217) · e.g. `EUR`
  - `authorizationExpiration` — string<date-time> · When the user's authorization of the account expires, in RFC 3339. Set to 90 days after the authorization was created · e.g. `2026-12-31T08:37:51+00:00`
- `balances` — object[]
  - `amount` — object
    - `value` — number · Balance as an absolute value, `creditDebitIndicator` gives the sign · e.g. `1520.35`
    - `currency` — string · Currency of the balance (ISO 4217) · e.g. `EUR`
  - `creditDebitIndicator` — string · Sign of the balance · e.g. `CRDT`
    - `CRDT` — Zero or positive balance
    - `DBIT` — Negative balance
  - `dateTime` — string<date-time> · When the balance was checked, in RFC 3339 · e.g. `2026-10-06T08:00:00+00:00`

### Responses

- `200` — Account details and balances
- `400` — Missing or invalid header or body (`INVALID_REQUEST`), or the bank could not be recognised (`UNSUPPORTED_BANK`)
- `403` — Returned for two different reasons, told apart by the body:
  
    - **Bank authorization needed** – the account is not connected yet, or its authorization
      at the bank has expired. The body has `consent_id` and `redirect_url`; redirect the
      user, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
    - **Access token rejected** – the token is missing, invalid or expired, or lacks the
      scope. The body is an error with code `UNAUTHORIZED`.
- `500` — Unexpected bank response (`INTERNAL_SERVER_ERROR`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/information' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'
```


## Retrieve account balances

`POST https://wap-sa.payout.one/api/v1/accounts/balance`

Retrieves the balances of a connected account from the bank.

### Parameters

- `PSU-IP-Address` (header) — IP address the user is connected from
- `PSU-Presence` (header) — Whether the user triggered the request (default `false`)
  - `true` — The request is a direct result of a user action
  - `false` — Not a direct result of a user action
- `PSU-User-Agent` (header) — User agent of the user's browser

### Request body

- `iban` — string (required) · IBAN of the account · e.g. `SK3112000000198742637541`
- `bank` — string · Integration `name` from [List integrations](#list_integrations), for IBANs whose bank cannot be recognised from the IBAN alone · e.g. `tatrabanka`

### Response 200

- `balances` — object[]
  - `amount` — object
    - `value` — number · Balance as an absolute value, `creditDebitIndicator` gives the sign · e.g. `1520.35`
    - `currency` — string · Currency of the balance (ISO 4217) · e.g. `EUR`
  - `creditDebitIndicator` — string · Sign of the balance · e.g. `CRDT`
    - `CRDT` — Zero or positive balance
    - `DBIT` — Negative balance
  - `dateTime` — string<date-time> · When the balance was checked, in RFC 3339 · e.g. `2026-10-06T08:00:00+00:00`
  - `type` — string · Balance type, a code from the ISO 20022 `ExternalBalanceType1Code` list ([external code sets](https://www.iso20022.org/catalogue-messages/additional-content-messages/external-code-sets)), for example `ITAV` (interim available) or `CLBD` (closing booked). Some banks add their own codes `ACCR`, `DSCR`, `OWRS` and `OWFU` · e.g. `ITAV`

### Responses

- `200` — Account balances
- `400` — Missing or invalid header or body (`INVALID_REQUEST`), or the bank could not be recognised (`UNSUPPORTED_BANK`)
- `403` — Returned for two different reasons, told apart by the body:
  
    - **Bank authorization needed** – the account is not connected yet, or its authorization
      at the bank has expired. The body has `consent_id` and `redirect_url`; redirect the
      user, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
    - **Access token rejected** – the token is missing, invalid or expired, or lacks the
      scope. The body is an error with code `UNAUTHORIZED`.
- `500` — Unexpected bank response (`INTERNAL_SERVER_ERROR`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/balance' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'
```


## List transactions

`POST https://wap-sa.payout.one/api/v1/transactions`

Lists the transactions of a connected account, retrieved from the bank. Each page holds up
to 100 transactions.

### Pagination

To get the next page, repeat the request with `page_index` set to `pagination.next_page`
from the previous response. `next_page` is `null` on the last page.

### Parameters

- `PSU-IP-Address` (header) — IP address the user is connected from
- `PSU-Presence` (header) — Whether the user triggered the request (default `false`)
  - `true` — The request is a direct result of a user action
  - `false` — Not a direct result of a user action
- `PSU-User-Agent` (header) — User agent of the user's browser

### Request body

- `iban` — string (required) · IBAN of the account · e.g. `SK3112000000198742637541`
- `bank` — string · Integration `name` from [List integrations](#list_integrations), for IBANs whose bank cannot be recognised from the IBAN alone · e.g. `tatrabanka`
- `page_index` — string · Page to return, from `pagination.next_page` or `pagination.previous_page` of a previous response. Omit for the first page · e.g. `zxQewRtveXy`
- `date_from` — string · Return no transactions older than this date. Defaults to 90 days ago · e.g. `2026-09-01`
- `date_to` — string · Return no transactions newer than this date. Defaults to the end of today · e.g. `2026-09-30`

### Response 200

- `pagination` — object
  - `next_page` — string | integer | null · `page_index` of the next page, `null` on the last page · e.g. `zxQewRtveXy`
  - `previous_page` — string | integer | null · `page_index` of the previous page
- `transactions` — object[]
  - `amount` — object
    - `value` — string · Amount as an absolute decimal string, `creditDebitIndicator` gives the direction · e.g. `12.50`
    - `currency` — string · Currency of the transaction (ISO 4217) · e.g. `EUR`
  - `valueDate` — string · Date when the funds become available to the account owner, for credits · e.g. `2026-09-14`
  - `bookingDate` — string · Date when the transaction was posted to the account in the bank's books · e.g. `2026-09-14`
  - `creditDebitIndicator` — string · Direction of the transaction · e.g. `CRDT`
    - `CRDT` — Credit, money added to the account
    - `DBIT` — Debit, money taken from the account
  - `bankTransactionCode` — string · ISO 20022 bank transaction code
  - `transactionDetails` — object
    - `reversalIndicator` — boolean · Whether the transaction reverses a previous one
    - `references` — object
      - `accountServiceReference` — string · Unique transaction id assigned by the bank
      - `endToEndIdentification` — string · End-to-end identification of the transaction, as reported by the bank
      - `chequeNumber` — string · Masked card number of a card transaction, for example `** 1111`
    - `counterValueAmount` — object
      - `amount` — object
        - `value` — string · Counter-value amount as a decimal string
        - `currency` — string · Currency of the counter-value amount (ISO 4217)
    - `currencyExchange` — object
      - `exchangeRate` — number · Exchange rate applied to the transaction
    - `relatedParties` — object
      - `debtor` — object
        - `name` — string · Name of the debtor
      - `debtorAccount` — object
        - `identification` — string · Debtor's account, usually an IBAN
      - `creditor` — object
        - `name` — string · Name of the creditor
      - `creditorAccount` — object
        - `identification` — string · Creditor's account, usually an IBAN
    - `tradingParty` — object
      - `name` — string · Name of the third party. For card transactions, the merchant
    - `relatedAgents` — object
      - `debtorAgent` — object
        - `financialInstitutionIdentification` — string · Debtor's bank, usually a BIC
      - `creditorAgent` — object
        - `financialInstitutionIdentification` — string · Creditor's bank, usually a BIC
    - `remittanceInformation` — string · Payment message for the receiver

### Responses

- `200` — A page of transactions
- `400` — Missing or invalid header or body (`INVALID_REQUEST`), or the bank could not be recognised (`UNSUPPORTED_BANK`)
- `403` — Returned for two different reasons, told apart by the body:
  
    - **Bank authorization needed** – the account is not connected yet, or its authorization
      at the bank has expired. The body has `consent_id` and `redirect_url`; redirect the
      user, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
    - **Access token rejected** – the token is missing, invalid or expired, or lacks the
      scope. The body is an error with code `UNAUTHORIZED`.
- `500` — Unexpected bank response (`INTERNAL_SERVER_ERROR`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/transactions' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541",
       "date_from": "2026-09-01",
       "date_to": "2026-09-30"
     }'
```


## List accounts by consent

`POST https://wap-sa.payout.one/api/v1/provider/accounts`

Lists the accounts the user authorized under a consent, with their details from the bank.
Call it with the `consent_id` from a `403` response once the user has authorized access, see
[Authorizing access to the bank account](#authorizing-access-to-the-bank-account).

### Parameters

- `PSU-IP-Address` (header) — IP address the user is connected from
- `PSU-Presence` (header) — Whether the user triggered the request (default `false`)
  - `true` — The request is a direct result of a user action
  - `false` — Not a direct result of a user action
- `PSU-User-Agent` (header) — User agent of the user's browser

### Request body

- `consent_id` — integer (required) · Consent id from the `403` response of an account endpoint · e.g. `123`

### Response 200

- `accounts` — object[]
  - `identification` — object
    - `iban` — string · IBAN of the account · e.g. `SK3112000000198742637541`
  - `name` — string · Account name · e.g. `Main account`
  - `productName` — string · The bank's product name for the account · e.g. `superaccount`
  - `type` — string · Account type, a code from the ISO 20022 `ExternalCashAccountType1Code` list ([external code sets](https://www.iso20022.org/catalogue-messages/additional-content-messages/external-code-sets)), for example `CACC` (current account) or `SVGS` (savings account). `OTHR` means another type · e.g. `CACC`
  - `baseCurrency` — string · Account currency (ISO 4217) · e.g. `EUR`
  - `authorizationExpiration` — string<date-time> · When the user's authorization of the account expires, in RFC 3339. Set to 90 days after the authorization was created · e.g. `2026-12-31T08:37:51+00:00`

### Responses

- `200` — Accounts of the consent
- `400` — Missing `consent_id` or unknown consent (`INVALID_REQUEST`)
- `403` — Returned for two different reasons, told apart by the body:
  
    - **Bank authorization needed** – the account is not connected yet, or its authorization
      at the bank has expired. The body has `consent_id` and `redirect_url`; redirect the
      user, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
    - **Access token rejected** – the token is missing, invalid or expired, or lacks the
      scope. The body is an error with code `UNAUTHORIZED`.
- `500` — Unexpected bank response (`INTERNAL_SERVER_ERROR`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/provider/accounts' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "consent_id": 123
     }'
```


## Verify IBAN

`POST https://wap-sa.payout.one/api/v1/accounts/verify-iban`

Verifies that the user has access to the bank account with the given IBAN. Banklink checks
the account with the bank.

### Parameters

- `PSU-IP-Address` (header) — IP address the user is connected from
- `PSU-Presence` (header) — Whether the user triggered the request (default `false`)
  - `true` — The request is a direct result of a user action
  - `false` — Not a direct result of a user action
- `PSU-User-Agent` (header) — User agent of the user's browser

### Request body

- `iban` — string (required) · IBAN of the account · e.g. `SK3112000000198742637541`
- `bank` — string · Integration `name` from [List integrations](#list_integrations), for IBANs whose bank cannot be recognised from the IBAN alone · e.g. `tatrabanka`

### Response 200

- `iban` — string · IBAN of the verified account · e.g. `SK3112000000198742637541`
- `verified` — boolean · Always `true`. Without access, the response is `403` instead · e.g. `true`

### Responses

- `200` — The user has access to the account
- `400` — Missing or invalid header or body (`INVALID_REQUEST`), or the bank could not be recognised (`UNSUPPORTED_BANK`)
- `403` — Returned for two different reasons, told apart by the body:
  
    - **Bank authorization needed** – the account is not connected yet, or its authorization
      at the bank has expired. The body has `consent_id` and `redirect_url`; redirect the
      user, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
    - **Access token rejected** – the token is missing, invalid or expired, or lacks the
      scope. The body is an error with code `UNAUTHORIZED`.
- `500` — Unexpected bank response (`INTERNAL_SERVER_ERROR`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/verify-iban' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'
```


## Initiate payment

`POST https://wap-sa.payout.one/api/v1/payments/{integration}/{payment_product}`

Creates a payment for the user to authorize at their bank. Redirect the user to
`_links.sca.href`, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account),
then track the payment with [Retrieve payment status](#payment_status).

### Parameters

- `integration` (path, required) — `name` of an integration from [List integrations](#list_integrations) that supports payment initiation (`pisp` is `true`)
- `payment_product` (path, required) — Payment method. Integrations support different methods, see `supported_payment_methods` in [List integrations](#list_integrations)
  - `sepa-credit-transfers` — SEPA credit transfer, listed as `sepa`
  - `instant-sepa-credit-transfers` — Instant SEPA credit transfer, listed as `sepa_ipay`

### Request body

- `endToEndIndentification` — string · e.g. `/VS1/SS2/KS3`

  Your end-to-end identification of the payment. The key is spelled `endToEndIndentification`.

  In the form `/VS{variable symbol}/SS{specific symbol}/KS{constant symbol}`, Banklink reads
  the variable, specific and constant symbol from it.

- `creditorAgent` — string · BIC of the creditor's bank · e.g. `COBADEFFXXX`
- `creditorName` — string (required) · Name of the creditor · e.g. `John Doe`
- `creditorEmail` — string · E-mail of the creditor, a non-standard field used by the `payout` integration · e.g. `john.doe@example.com`
- `debtorName` — string (required) · Name of the debtor · e.g. `Test Testovic`
- `remittanceInformationUnstructured` — string · Payment message for the creditor · e.g. `Testing`
- `purposeProprietary` — string · Non-standard field, required by `csob-cz` for business customers
- `debtorAccount` — object (required)
  - `iban` — string (required) · e.g. `SK3112000000198742637541`

    IBAN of the debtor account. Supported countries:

    - `SK` – Slovakia
    - `CZ` – Czech Republic
    - `DE` – Germany
    - `LT` – Lithuania

- `creditorAccount` — object (required)
  - `iban` — string (required) · IBAN of the creditor account, from the same countries as `debtorAccount.iban` · e.g. `DE89370400440532013000`
- `instructedAmount` — object (required)
  - `amount` — string (required) · Amount as a decimal string · e.g. `1.00`
  - `currency` — string (required) · one of `EUR`, `CZK` · e.g. `EUR`

### Response 201

- `paymentId` — integer · Payment id, used by [Retrieve payment status](#payment_status) · e.g. `123`
- `_links` — object
  - `sca` — object
    - `href` — string<uri> · URL to redirect the user to for authorizing the payment · e.g. `https://wap-sa.payout.one/providers/forward/Xk7pQ2`

### Responses

- `201` — Payment created
- `400` — Invalid request body (`INVALID_INPUT` with `xpath`) or unknown `payment_product` (`INVALID_PAYMENT_PRODUCT`)
- `403` — Missing, invalid or expired access token, or missing scope (`UNAUTHORIZED`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/payments/tatrabanka/sepa-credit-transfers' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "endToEndIndentification": "/VS1/SS2/KS3",
       "creditorAgent": "COBADEFFXXX",
       "creditorName": "John Doe",
       "debtorName": "Test Testovic",
       "remittanceInformationUnstructured": "Testing",
       "debtorAccount": {
         "iban": "SK3112000000198742637541"
       },
       "creditorAccount": {
         "iban": "DE89370400440532013000"
       },
       "instructedAmount": {
         "amount": "1.00",
         "currency": "EUR"
       }
     }'
```


## Retrieve payment status

`GET https://wap-sa.payout.one/api/v1/payments/{payment_id}/status`

Retrieves the current status of a payment. Unless the payment is `pending` or `completed`,
Banklink first asks the bank for its latest status.

### Parameters

- `payment_id` (path, required) — Payment id returned by [Initiate payment](#payment_initialisation)

### Response 200

- `paymentId` — integer · Payment id · e.g. `123`
- `transactionStatus` — string · Status of the payment · e.g. `pending`
  - `pending` — Created in Banklink, not yet posted to the bank
  - `initialized` — Posted to the bank, not yet validated
  - `received` — Validated by the bank as technically correct
  - `accepted` — Accepted by the bank as valid and signed by the user, waiting to be processed
  - `unknown` — Signed, but Banklink could not check its status afterwards
  - `completed` — Processed successfully
  - `rejected` — Invalid or declined by the user

### Responses

- `200` — Payment status
- `403` — Missing, invalid or expired access token, or missing scope (`UNAUTHORIZED`)
- `404` — Unknown payment
- `500` — Banklink could not get the latest status from the bank (`INTERNAL_SERVER_ERROR`)

### Example

```bash
curl -X GET 'https://wap-sa.payout.one/api/v1/payments/123/status' \
  -H "Authorization: Bearer $TOKEN"
```


## Create verification

`POST https://wap-sa.payout.one/api/v1/verifications`

Starts verifying the user's identity through their bank account. Redirect the user to the
returned `redirect_url`, see [Authorizing access to the bank account](#authorizing-access-to-the-bank-account).
Once the user is back, get the result with [Retrieve verification status](#get_verification_status).

The [Verification guide](https://developers.payout.tech/guides/verification.html) describes the whole flow.

### Request body

- `iban` — string (required) · IBAN of the account to verify the user with · e.g. `CZ6508000000192000145399`
- `first_name` — string · User's first name, compared with the names of the account owners · e.g. `Jan`
- `last_name` — string · User's last name, compared with the names of the account owners · e.g. `Novák`
- `bank` — string · Integration `name` from [List integrations](#list_integrations), for IBANs whose bank cannot be recognised from the IBAN alone · e.g. `csas`

### Response 200

- `id` — string<uuid> · Verification id · e.g. `3f1c9a52-7d4e-4b8a-9c21-5e6f7a8b9c0d`
- `redirect_url` — string<uri> · URL to send the user to. There they log in to their bank and grant access to the account, which is what the verification checks · e.g. `https://wap-sa.payout.one/providers/forward/Xk7pQ2`
- `status` — string · Result of the verification · e.g. `initialized`
  - `initialized` — Created, the user has not finished authorizing access at the bank yet
  - `verified_access` — The user accessed the account, but the bank does not provide owner names
  - `verified_ownership` — The user accessed the account and an owner's name matches `first_name` and `last_name`
  - `unverified_access` — The user failed to provide credentials to access the account
  - `unverified_ownership` — The user accessed the account, but no owner's name matches `first_name` and `last_name`
  - `error` — Communication with the bank failed

### Responses

- `200` — Verification created
- `400` — Invalid request body (`INVALID_INPUT` with `xpath`)
- `403` — Missing, invalid or expired access token, or missing scope (`UNAUTHORIZED`)

### Example

```bash
curl -X POST 'https://wap-sa.payout.one/api/v1/verifications' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "CZ6508000000192000145399",
       "first_name": "Jan",
       "last_name": "Novák"
     }'
```


## Retrieve verification status

`GET https://wap-sa.payout.one/api/v1/verifications/{verification_id}`

Retrieves the result of a verification created by your application.

### Parameters

- `verification_id` (path, required) — Verification id returned by [Create verification](#create_verification)

### Response 200

- `status` — string · Result of the verification · e.g. `initialized`
  - `initialized` — Created, the user has not finished authorizing access at the bank yet
  - `verified_access` — The user accessed the account, but the bank does not provide owner names
  - `verified_ownership` — The user accessed the account and an owner's name matches `first_name` and `last_name`
  - `unverified_access` — The user failed to provide credentials to access the account
  - `unverified_ownership` — The user accessed the account, but no owner's name matches `first_name` and `last_name`
  - `error` — Communication with the bank failed

### Responses

- `200` — Verification status
- `400` — Unknown verification, or one created by another application (`UNSUPPORTED_BANK`)
- `403` — Missing, invalid or expired access token, or missing scope (`UNAUTHORIZED`)

### Example

```bash
curl -X GET 'https://wap-sa.payout.one/api/v1/verifications/3f1c9a52-7d4e-4b8a-9c21-5e6f7a8b9c0d' \
  -H "Authorization: Bearer $TOKEN"
```


## List integrations

`GET https://wap-sa.payout.one/api/v1/integrations`

Lists the banks Banklink integrates with and what each of them supports.

### Response 200

- `name` — string · Integration name. Use it as `bank` in account requests and as `integration` in [Initiate payment](#payment_initialisation) · e.g. `tatrabanka`
- `aisp` — boolean · Whether the integration supports account information · e.g. `true`
- `pisp` — boolean · Whether the integration supports payment initiation · e.g. `true`
- `supported_payment_methods` — string[] · Payment methods for [Initiate payment](#payment_initialisation). Present only when `pisp` is `true`
  - `sepa` — SEPA credit transfer, payment product `sepa-credit-transfers`
  - `sepa_ipay` — Instant SEPA credit transfer, payment product `instant-sepa-credit-transfers`

### Responses

- `200` — Integrations
- `403` — Missing, invalid or expired access token, or missing scope (`UNAUTHORIZED`)

### Example

```bash
curl -X GET 'https://wap-sa.payout.one/api/v1/integrations' \
  -H "Authorization: Bearer $TOKEN"
```