canonical: https://jentic.com/apis/bca.co.id/bca

# BCA Developer API

Bank Central Asia's developer API exposes core retail and corporate banking operations to authorised partners. The API covers OAuth 2.0 access-token issuance (including a B2B variant), business debit card inquiry and limit management, balance and statement retrieval, virtual account transfer inquiry and status, and a marketplace account-opening flow. Sandbox and production endpoints are both declared, so integrators can develop against the sandbox before promoting to live banking traffic.

## For AI agents

Issue BCA OAuth tokens, inquire balances and bank statements, manage business debit card limits, and check virtual-account transfer status. Useful for fintech back-office and treasury agents.

## Scope

Does not handle retail consumer banking, FX trading, or lending - use for partner-scoped corporate balance, statement, virtual-account, and business debit card operations only.

## Capabilities

- Issue an OAuth access token via POST `/api/oauth/token` or the B2B variant POST `/openapi/v1.0/access-token/b2b`
- Inquire a business debit card via POST `/openapi/bdc/v1.0/inquiry-card` and update its status
- Set or change a business debit card spending limit via POST `/openapi/bdc/v1.0/setting-limit`
- Run a corporate balance inquiry with POST `/openapi/v1.0/balance-inquiry`
- Pull a corporate bank statement with POST `/openapi/v1.0/bank-statement` or GET the offline file statement
- Inquire and check the status of a virtual-account transfer via the `/openapi/v1.0/transfer-va` endpoints

## Use cases

### Corporate Cash-Position Reporting

A treasury team needs to pull end-of-day balances and statements across multiple BCA corporate accounts. The API exposes POST `/openapi/v1.0/balance-inquiry` for live balances and POST `/openapi/v1.0/bank-statement` for itemised transactions. Combine with the OAuth B2B token endpoint and the run becomes a scheduled job hitting BCA each morning to refresh the cash dashboard.

Example prompt: Issue a B2B token via POST `/openapi/v1.0/access-token/b2b`, then call POST `/openapi/v1.0/balance-inquiry` and POST `/openapi/v1.0/bank-statement` for each account

### Business Debit Card Lifecycle

Finance ops teams managing corporate cards can use POST `/openapi/bdc/v1.0/inquiry-card` to look up card status, POST `/openapi/bdc/v1.0/setting-limit` to adjust spend caps, and POST `/openapi/bdc/v1.0/update-status` to block or unblock a card after travel or termination events. The flow sits behind an internal admin tool or a Slack-driven approval bot.

Example prompt: Call POST `/openapi/bdc/v1.0/inquiry-card` to confirm the card, then POST `/openapi/bdc/v1.0/setting-limit` to raise the daily limit for a travelling employee

### Virtual Account Reconciliation

Marketplaces and billers using BCA virtual accounts need to confirm whether incoming transfers have settled. POST `/openapi/v1.0/transfer-va/inquiry` returns the transfer record and POST `/openapi/v1.0/transfer-va/status` returns its current state. The reconciliation job uses both to mark customer invoices paid as soon as funds clear.

Example prompt: Call POST `/openapi/v1.0/transfer-va/inquiry` for each pending invoice, then POST `/openapi/v1.0/transfer-va/status` to confirm settlement before marking paid

### Agent-Driven Treasury Lookup via Jentic

A finance ops chat agent can use the BCA Developer API through Jentic to answer ad-hoc treasury questions like 'what's the balance on the operating account right now?' without operators handling OAuth refresh. Jentic isolates the BCA client credentials in its vault and exposes the 12 BCA operations as discoverable tools indexed by natural-language intent.

Example prompt: Search Jentic for 'bca account balance inquiry', load the POST `/openapi/v1.0/balance-inquiry` schema, and execute against the requested account

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/api/oauth/token` | Issue an OAuth access token |
| POST | `/openapi/v1.0/access-token/b2b` | Issue a B2B OAuth access token |
| POST | `/openapi/v1.0/balance-inquiry` | Inquire on a corporate account balance |
| POST | `/openapi/v1.0/bank-statement` | Retrieve a corporate bank statement |
| POST | `/openapi/bdc/v1.0/inquiry-card` | Inquire on a business debit card |
| POST | `/openapi/bdc/v1.0/setting-limit` | Set a business debit card spending limit |
| POST | `/openapi/v1.0/transfer-va/inquiry` | Inquire on a virtual account transfer |
| POST | `/openapi/v1.0/transfer-va/status` | Check the status of a virtual account transfer |

## Key resources

- **OAuth Tokens** — Issue partner and B2B OAuth access tokens via `/api/oauth/token` and `/openapi/v1.0/access-token/b2b`
- **Business Debit Cards** — Inquire card details, update status, and adjust spending limits
- **Account Balances and Statements** — Live balance inquiry and itemised bank-statement retrieval, plus offline file statements
- **Virtual Account Transfers** — Inquire and check the status of incoming virtual-account transfers
- **Marketplace Account Opening** — Generate merchant onboarding tokens and check account-opening status

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 65 / 100
- **Maturity:** AI-Aware
- **Dimensions:**
  - Foundational Compliance: 99 / 100
  - Developer Experience & Jentic Compatibility: 63 / 100
  - AI-Readiness & Agent Experience: 42 / 100
  - Agent Usability: 94 / 100
  - Security: 60 / 100
  - AI Discoverability: 100 / 100
- **View full report:** https://jentic.com/apis/bca.co.id/bca/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Wiring the BCA Developer API by hand means running the OAuth and B2B access-token exchanges, choosing between the sandbox and production hosts, and signing each banking request yourself. Through Jentic you install once, import the BCA Developer API from the API Directory, store the client credentials once, and your agent calls it.
- **Permission scoping:** BCA carries its account and virtual-account targets in the request body rather than as a resource in the URL path, so scope the agent to the operations it needs, such as balance inquiry or bank statement retrieval. You choose that operation set, so business debit card limit setting is not included unless you add it.
- **Credential handling:** Your BCA OAuth client id and secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'BCA account balance inquiry' or 'check a virtual account transfer status', and Jentic returns the matching BCA operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Basesnap API** — Database snapshot service - back up the ledger database that ingests BCA statement and balance data
- **Bbot API** — Restaurant ordering platform - pair with BCA when reconciling Indonesian merchant payouts
- **Baseten API** — Unrelated ML platform; listed as a placeholder peer in the absence of a competing Indonesian banking API in the corpus

## FAQ

### What authentication does the BCA Developer API use?

BCA uses bearer tokens issued via OAuth. POST `/api/oauth/token` issues a partner token and POST `/openapi/v1.0/access-token/b2b` issues a B2B token. Pass the token as Authorization: Bearer <token> on all subsequent calls. Through Jentic the client credentials live in the vault and only a scoped token reaches the agent.

### Can I fetch a corporate account balance with the BCA API?

Yes. POST `/openapi/v1.0/balance-inquiry` returns the live balance for a corporate account. Pair it with POST `/openapi/v1.0/bank-statement` to also retrieve recent transactions in the same run.

### How do I check a virtual account transfer status through Jentic?

Search Jentic for 'check bca virtual account transfer status', which surfaces POST `/openapi/v1.0/transfer-va/status.` Load the schema, supply the transfer reference, and execute to receive the current settlement state.

### What are the rate limits for the BCA Developer API?

The OpenAPI spec does not declare explicit rate limits. BCA applies per-partner quotas declared in the partner agreement and may throttle aggressive polling. Use the sandbox host for development and respect any 429 responses in production.

### Does the BCA API expose business debit card management?

Yes. POST `/openapi/bdc/v1.0/inquiry-card` looks up a card, POST `/openapi/bdc/v1.0/setting-limit` adjusts its daily spend cap, and POST `/openapi/bdc/v1.0/update-status` changes the card's active/blocked state. All require a partner-scoped OAuth token.

### Is there a sandbox for testing the BCA API?

Yes. The OpenAPI spec declares both https://sandbox.bca.co.id (sandbox) and https://api.bca.co.id (production) as servers. Develop against the sandbox host, and switch the base URL when promoting to live banking traffic.

### Can I limit what my agent is allowed to do with the BCA Developer API?

Yes. Because you run Jentic One yourself, your own rules decide which BCA operations and credentials the agent can use, so you can grant only what a task needs, such as POST `/openapi/v1.0/balance-inquiry` and POST `/openapi/v1.0/bank-statement` for read-only cash reporting. Since BCA carries the account and virtual-account targets in the request body rather than in the URL path, you scope by operation rather than by resource, and you leave state-changing calls like POST `/openapi/bdc/v1.0/setting-limit` out of the set unless you deliberately add them. The stored OAuth client credentials are injected only for the operations you have allowed, so the agent cannot reach BCA endpoints you did not include.