canonical: https://jentic.com/apis/db.com/deutschebank # Db Deutsche Bank API The Deutsche Bank API is the open banking platform exposed by Deutsche Bank for partners and developers building on the bank's account, payment, and reference-data products. This spec covers the platform's core authentication primitive (POST `/auth/token`) plus a generic resources surface used to enumerate and resolve bank-side objects. Authentication is an API key in the X-API-Key header, with token issuance backing more sensitive operations. The wider Deutsche Bank developer programme expands these primitives into full PSD2 account information and payment initiation flows. ## For AI agents Authenticate against the Deutsche Bank developer platform and enumerate or resolve bank-side resources via a small REST surface. ## Scope Does not handle account information retrieval, payment initiation, or PSD2 consent flows - use for partner authentication and resource discovery only. ## Capabilities - Issue an authentication token via POST `/auth/token` - List bank-side resources via GET /resources - Resolve a single resource by ID via GET `/resources/{id}` - Drive token-aware flows for downstream Deutsche Bank developer products - Use the X-API-Key header to scope access at the partner level ## Use cases ### Partner Authentication Bootstrap Partners integrating with the Deutsche Bank developer platform start by exchanging their X-API-Key for a short-lived access token via POST `/auth/token.` That token then authorises subsequent calls into more sensitive Deutsche Bank products (account info, payment initiation) when the partner has the right entitlements. Bootstrapping the auth flow correctly is a prerequisite for any downstream banking integration. Example prompt: Call POST `/auth/token` with the partner X-API-Key, store the returned token, and use it as the bearer for subsequent banking calls ### Resource Discovery Integrators use GET /resources to enumerate the resource records their partner credentials can see, then GET `/resources/{id}` to pull the canonical record. This is typically the first call in any onboarding flow, used to confirm scope and to seed downstream caches with the right reference identifiers. Example prompt: Call GET /resources to list available reference records, then GET `/resources/{id}` for each to seed a local cache ### Token Refresh for Long-running Jobs Long-running data pipelines that call Deutsche Bank developer endpoints over many hours refresh their access token periodically by calling POST `/auth/token` again before the previous token expires. The pattern keeps batch jobs running through the night without manual credential rotation. Example prompt: Schedule POST `/auth/token` every 50 minutes, replace the active token in memory, and resume the in-flight resource sync ### AI Agent Banking Integration AI agents that need to operate against the Deutsche Bank developer platform call the auth and resources endpoints through Jentic. Jentic isolates the X-API-Key in its vault and handles the token exchange, so the agent only deals with token references and resource IDs - never the raw partner secret. Example prompt: Authenticate via POST `/auth/token`, list resources via GET /resources, and return a summary table of resource IDs for downstream payment flows ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/auth/token` | Issue an access token from a partner X-API-Key | | GET | `/resources` | List accessible resource records | | GET | `/resources/{id}` | Resolve a single resource record by ID | ## Key resources - **Authentication** — Issue access tokens for Deutsche Bank developer platform calls - **Resources** — List and resolve bank-side reference resource records ## Why Jentic - **Setup:** Wiring the Deutsche Bank API by hand means learning its X-API-Key header, running the POST `/auth/token` exchange yourself, and carrying the resulting token onto each resource call. Through Jentic you install once, import the Deutsche Bank API from the API Directory, store the API key once, and your agent calls it. - **Permission scoping:** Deutsche Bank puts the resource id in the URL path (`/resources/{id}`), so a rule can pin your agent to one resource. You choose the operations it may call, so you can grant resource discovery and reads while leaving the token exchange or other operations out unless you add them. - **Credential handling:** Your Deutsche Bank X-API-Key is stored once, encrypted, by your own Jentic One instance and injected at execution time, and the token exchange is handled for you. Neither the X-API-Key nor the raw partner credential ever enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'authenticate against Deutsche Bank' or 'list bank resources', and Jentic returns the matching operation with its input schema so the agent calls POST `/auth/token` or GET /resources without browsing developer.db.com. ## Related APIs - **Open Banking UK Account Information** — The UK Open Banking standard defines a regulated account-information API used by all UK banks. - **Plaid** — Plaid aggregates bank connections for thousands of institutions globally with a single integration. - **TrueLayer** — TrueLayer is a European open banking aggregator covering account data and payment initiation. ## FAQ ### What authentication does the Deutsche Bank API use? Deutsche Bank uses an API key passed in the X-API-Key header, exchanged for a short-lived access token via POST `/auth/token.` Through Jentic, the X-API-Key is stored encrypted in your Jentic One instance and the token exchange is handled inside the platform. ### Can I list resources with the Deutsche Bank API? Yes. GET /resources lists the resource records your partner credentials can see, and GET `/resources/{id}` resolves a specific record. This is the typical entry point for onboarding flows. ### What are the rate limits for the Deutsche Bank API? Rate limits are governed by your partner agreement and are not declared in this OpenAPI spec; consult developer.db.com or your Deutsche Bank partner contact before running high-frequency token or resource calls. ### How do I issue a Deutsche Bank access token through Jentic? Search Jentic for 'issue a Deutsche Bank access token', load the POST `/auth/token` operation, and execute it. Jentic injects the X-API-Key automatically and returns the access token for use with downstream calls. ### Does this spec cover account information and payment initiation? This spec covers only authentication and resource discovery. Account information and payment initiation are part of separate Deutsche Bank developer products gated behind PSD2 entitlements and a stricter onboarding. ### Is the Deutsche Bank developer programme open to any developer? The sandbox is open to registered developers, but production access requires partnership onboarding through developer.db.com, including KYC and PSD2 compliance steps where applicable. ### Can I limit what my agent is allowed to do with the Deutsche Bank API? Yes. Because you run Jentic One yourself, your own rules decide which of the Deutsche Bank operations your agent may call, so you can grant read access to GET /resources and GET `/resources/{id}` while leaving the POST `/auth/token` exchange out unless you add it. Since the resource id sits in the URL path (`/resources/{id}`), a rule can also pin the agent to a single resource record rather than the full list. The stored X-API-Key is injected only for the operations you have allowed, so the agent never gains broader access than you grant.