Skip to content

Home

Jump to bottom
xPokm15 edited this page Feb 23, 2024 · 37 revisions

Product

The Account Direct Access API (ADAA) service provides secure access to information about:

  • Client’s transaction history
  • Bank account balance
  • Information about transaction history is provided in connection with current accounts of a client of Komerční banka.

You can find more details on the Direct Account Access API

Enviroments

For testing and debugging your requests we recommend to use the Postman app. We have prepared collections of example requests to use in Postman, download them from the links below.

Sandbox

Production

How to start

Actors

  • User - Client KB - User who give access to his account via API in Komercni banka
  • Developer - Developer who create app
  • KB - Komercni banka

Process

Process flow

1. Register on KB API portal

To use any of our API's you (the Developer) will need to be registred on our API portal. Though the API portal you will be able to subscribe to the API's you want to use and generate API keys.

2. Create API keys for the API's you will be using

  • Subcribe to an API (Client Registration, OAuth2, Account direct access API)
  • create an API key for it (apiKey) - How create API key (apiKey)

Each API needs its own API key. You can create multiple API keys for each API. You can also create multiple API keys for the same API.

3. Register your application via the Client Registration API

Create a Software statement for your application and register it via the Client Registration API. You will need to use the API key you created in the previous step.

4. Construct a URL to the Application Registration endpoint and visit it in the Client's browser

  • Contruct a URL
  • Visit the constructed URL in the Client's browser.
  • Browser redirects to KB for an authorization of a Client of KB. (example page)

5. Client of KB registers an app connection inside KB's interface

  • Client of KB continues to login to KB. (example page)
  • Client of KB confirms authorization via an authorization app (KB Klíč). (example page)
  • Client of KB chooses accounts to be authorized with the API. (example page)
  • KB redirects back to a callback url provided in the software statement and that way transfers control back to the app.

6. Decrypt the application registration information

You, the Developer, needs to process the information included in the callback URL.

You will need the client_id, client_secret in the next steps.

7. Construct a URL to get the Authorization code Token and visit it in the Client's browser

Using the client_id obtained in the previous step, construct a URL to get the authorization code token.

  • Construct a URL as described in the Tokens - Authorization code wiki page.
  • Visit the constructed URL in the Client's browser.
  • Browser redirects to KB for an authorization of a Client of KB.

8. Client of KB confirms app scopes inside KB's interface

  • Client of KB continues to login to KB. (example page)
  • Client of KB confirms scopes (example page)
  • KB redirects back to a callback url provided in the request URL parameter and that way transfers control back to the app.

9. Obtain Refresh token and Access Token using the Authorization code

  • Get the Authorization code from the callback URL's parameters
  • Use the Authorization code , client_id and client_secret to get the Refresh token and Access Token

10. Call the ADAA API using the Access token provided

  • First, you will probably want to get the Client's Accounts available. The accountId is needed for other endpoints.

Account Balances
Transactions
Notification of changes to your account (webhook)
Account Statements - PDF

Recommendations for the user interface

  • Make a flow to create an Application Registration by the user (step 4) - each user needs only 1 application
  • Make a flow for Refresh token acquisition and renewal (step 7) - once every 12 months or sooner. Refresh token is valid for 12 months.
  • Check out our demo app
Clone this wiki locally