canonical: https://jentic.com/apis/finapi.io/finapi # finAPI Access API The finAPI Access API is a BaFin-licensed open banking interface that gives applications access to bank account data, payment initiation, and aggregated banking information across European institutions. It exposes 15 endpoints covering OAuth client-credentials token issuance, end-user provisioning, and bank-connection management. Authentication is by OAuth 2.0 client credentials for service-to-service calls and bearer tokens for end-user-scoped operations. The API is used by fintechs and embedded-finance products that need PSD2-compliant access to retail and SMB bank accounts in the DACH region and beyond. ## For AI agents Provision end users and bank connections under a BaFin-licensed open banking platform via OAuth 2.0 and bearer tokens. ## Scope Does not handle card acquiring, KYC/identity verification, or accounting bookkeeping - use for PSD2 user provisioning and bank connection management only. ## Capabilities - Issue an OAuth 2.0 access token via POST `/oauth/token` using client credentials - Provision an end user under your finAPI client and link them to bank connections - Create a new bank connection by initiating the PSD2 SCA flow on POST /bankConnections - List the bank connections owned by a given finAPI user - Delete a bank connection when an end user revokes consent - Surface user records so an agent can reconcile finAPI identity with the host application's user table ## Use cases ### Embedded Open Banking Onboarding Fintechs that need to read SMB transaction data can have an agent provision the end user via POST /users, then call POST /bankConnections to start the PSD2 strong customer authentication flow. Once consent is granted, the agent stores the connection id and downstream services can read account data through the same finAPI session. Example prompt: Call POST /users to create the user, then POST /bankConnections with the bank id and SCA configuration, and store the connection id with the user record. ### Consent Revocation Handling Compliance teams operating under PSD2 need to honour consent revocations promptly. An agent can listen for revoke events from the host application and call DELETE `/bankConnections/{id}` on the finAPI side to ensure the bank connection is removed and no further data calls succeed against the revoked link. Example prompt: On revoke event, look up the user's connection ids, then DELETE `/bankConnections/{id}` for each, then mark the host record as revoked. ### Service-To-Service Token Refresh Backend automations that hit finAPI on a schedule can have an agent refresh the OAuth client credentials token by calling POST `/oauth/token` before the previous token expires, then cache the new bearer for subsequent calls. This keeps the polling loop running without 401-driven retries. Example prompt: On token expiry, call POST `/oauth/token` with the client credentials grant and replace the cached bearer used by the polling worker. ### AI Agent finAPI Integration via Jentic An agent connected to Jentic can search by intent (for example provision a finapi user) and Jentic returns the matching finAPI operation along with its input schema. The OAuth client credentials and per-user bearer tokens live in your Jentic One instance, which is critical given finAPI's BaFin-licensed status. Integration drops from a multi-week PSD2 onboarding to under an hour. Example prompt: Search Jentic for create a finapi bank connection, load POST /bankConnections, and execute with the user id and bank id while Jentic injects the bearer token from the vault. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/oauth/token` | Issue an OAuth access token | | POST | `/users` | Provision a new end user | | GET | `/users` | List end users under your client | | DELETE | `/users/{userId}` | Delete an end user | | GET | `/bankConnections` | List bank connections | | POST | `/bankConnections` | Create a new bank connection | | GET | `/bankConnections/{id}` | Retrieve a bank connection | | DELETE | `/bankConnections/{id}` | Delete a bank connection | ## Key resources - **OAuth Token** — Issue access tokens via client credentials - **Users** — End users provisioned under your finAPI client - **Bank Connections** — Linked bank accounts authenticated via PSD2 SCA ## Why Jentic - **Setup:** Wiring the finAPI Access API by hand means running the OAuth2 client-credentials flow at `/oauth/token`, choosing between the sandbox and live hosts, and managing per-user bearer tokens for PSD2 provisioning yourself. Through Jentic you install once, import the finAPI Access API from the API Directory, store the client credentials once, and your agent calls it. - **Permission scoping:** finAPI puts the user id and bank-connection id in the URL path (`/users/{userId}`, `/bankConnections/{id}`), so a rule can pin your agent to the users and connections you allow. You choose the operations it may call, so a destructive action like deleting a user or a bank connection is not included unless you add it. - **Credential handling:** Your finAPI client credentials and per-user bearer tokens are stored once, encrypted, by your own Jentic One instance and injected at execution time. The OAuth client secret never enters the agent's prompt, logs, or context, which matters for a BaFin-licensed integration. - **Discovery method:** Agents search Jentic by intent such as 'link a bank account' or 'provision a new user', and Jentic returns the matching finAPI operation with its input schema, so the agent does not have to walk the full PSD2 spec. ## Related APIs - **Plaid API** — US-centric open banking aggregator with broader institution coverage in North America - **Stripe API** — Card and bank payments rails that pair with finAPI account information - **bunq API** — European neobank API with native account access ## FAQ ### What authentication does the finAPI Access API use? finAPI uses OAuth 2.0 client credentials for service tokens via POST `/oauth/token`, plus bearer tokens for per-user calls. Through Jentic, both the client credentials and user tokens live in the encrypted vault and are injected at execution. ### Can I link a bank account with the finAPI Access API? Yes. Provision the user via POST /users, then call POST /bankConnections to begin the PSD2 SCA flow against the chosen bank. Once the end user completes SCA, the connection becomes usable for downstream account information calls. ### What are the rate limits for the finAPI Access API? finAPI applies per-client throttling and the spec does not publish a fixed RPS. Sandbox traffic is limited more aggressively than production. Agents should respect 429 responses with exponential backoff and avoid bursting on /bankConnections during SCA flows. ### How do I revoke a bank connection through Jentic? Search Jentic for revoke a finapi bank connection, load the DELETE `/bankConnections/{id}` operation, and execute with the connection id. Jentic injects the bearer token from the vault and finAPI removes the connection on the bank side. ### Is the finAPI Access API free to use? finAPI offers a sandbox at sandbox.finapi.io for development, but production use against live.finapi.io requires a commercial agreement and a BaFin-licensed contract because the underlying service is regulated. ### Can I list all bank connections for a user with finAPI? Yes. Call GET /bankConnections with the user context to enumerate that user's links. Agents can then iterate the connections to refresh transaction data or surface revocation candidates. ### Can I limit what my agent is allowed to do with the finAPI Access API? Yes. Jentic One is self-hosted by you, so your own rules decide which finAPI operations and credentials the agent may use. Because finAPI puts the user id and bank-connection id in the URL path (`/users/{userId}`, `/bankConnections/{id}`), you can pin the agent to the specific users and connections you allow. You also choose the operations it may call, so a destructive action like DELETE `/users/{userId}` or DELETE `/bankConnections/{id}` is excluded unless you add it.