Open Banking UK APIs for AI Agents
www.openbanking.org.uk·Developer portal → standards.openbanking.org.uk
PaymentsPayment ProcessingBankingOfficial Vendor DocumentsOAuth 2.0No authAgent Ready
For Agents
APIs5 in catalogue
Endpoints81 indexed
AuthOAuth 2.0 / No auth
ProvenanceOfficial OpenAPI documents
An agent can read consented UK bank account balances and transactions, initiate and track domestic, scheduled, standing order, and international payments, run yes/no funds availability checks, receive pushed consent and resource events, and look up public branch, ATM, and product data across the CMA9 banks. All authenticated flows are scoped to what the customer has consented to and follow the same standard across every regulated UK bank.
Open Banking UK is the regulator-mandated standard, not a single bank or aggregator: the same OpenAPI operations are implemented by every CMA9 bank, so an agent integrates once and reaches all of them. It separates the regulated PSD2 surfaces (account access, payments, funds checks, and events) from a fully public, unauthenticated Open Data directory of branches, ATMs, and products.
Use for: Reading consented UK bank account data, initiating account-to-account payments, running yes/no funds checks, receiving consent and resource events, and querying public branch, ATM, and product directory data across the CMA9 banks
Not supported: card processing, non-UK banks, customer onboarding, credit scoring, real-time balance streaming
Credentials: The four regulated APIs (AISP, PISP, CBPII, and event notifications) share the same PSD2 model of OAuth 2.0 with TPP client credentials plus PSU authorization-code strong customer authentication, so one authorised TPP registration and credential set covers them, while the Open Data API is fully public and needs no authentication.
All 5 Open Banking UK OpenAPI documents are vendor-official and indexed by Jentic, kept validated and agent-ready.
Open Banking UK publishes the standardised OpenAPI specifications that every regulated UK bank implements under PSD2 and the CMA Open Banking Order. The five APIs cover the full third-party provider surface: reading account, balance, and transaction data (AISP); initiating account-to-account payments including scheduled, standing order, and international transfers (PISP); running yes/no funds availability checks (CBPII); receiving pushed consent and resource event notifications; and querying public branch, ATM, and product directory data. Because every CMA9 bank exposes the same operations under its own host, one integration works across HSBC, Barclays, Lloyds, NatWest, Santander, RBS, Bank of Ireland, Danske, and Nationwide.
Open Banking UK API Catalog
5 APIs across 2 product groups.
Finance4
Account and Transaction API SpecificationRead UK bank account, balance, transaction, and direct-debit data through the regulated Open Banking AISP standard's 29 endpoints, using consent-scoped OAuth 2.0.~29 endpointsOpen Data APILook up UK bank branch and ATM locations and retrieve published product details for personal accounts, business accounts, credit cards, and SME loans across the CMA9 banks.~6 endpointsConfirmation of Funds API SpecificationCheck whether a UK bank account has sufficient funds for a given amount via the regulated CBPII standard's 4 endpoints, with consent-scoped OAuth 2.0.~4 endpointsEvent Notification API Specification - TPP EndpointsReceive push notifications from UK banks about consent and resource events via the single POST /event-notifications endpoint, secured with TPPOAuth2Security.~1 endpoint
Which Open Banking UK API should I use?
| I want to... | Use |
|---|---|
| Read a customer's real balances, transactions, and direct debits | Account and Transaction API Specification |
| Confirm whether an account can cover a specific amount | Confirmation of Funds API Specification |
| Move money out of a customer's UK bank account | Payment Initiation API |
| Look up bank products, branches, or ATMs without customer data | Open Data API |
| Stay in sync with consent changes without polling | Event Notification API Specification - TPP Endpoints |
Install Jentic One Beta
Connect the Open Banking UK APIs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Open Banking UK APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fopenbanking.org.uk" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fopenbanking.org.uk" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Once connected, ask your agent something like: “connect to UK Open Banking to read accounts and initiate payments”.
What AI Agents Can Do with Open Banking UK
Each workflow spans multiple Open Banking UK APIs. Jentic routes each operation to the right API automatically.
Account-to-account checkout with a funds pre-check
Before initiating a bank payment at checkout, confirm the customer's account can cover the order amount, then create and submit the payment. The yes/no funds check keeps data disclosure minimal while the payment initiation flow settles the transfer via Faster Payments.
Example prompt:
Run POST /funds-confirmations for the order amount, and if FundsAvailable is true, create a domestic-payment-consent and submit the matching domestic payment once the customer authorises it.
APIs used
Confirmation of Funds API Specification + Payment Initiation API
Lending decision from live bank data
Read a borrower's real transactions and recurring outflows to compute affordability, then check that the nominated account can fund an initial payment before disbursing. This combines full transaction history with a minimal-disclosure funds check for the decision moment.
Example prompt:
Pull 90 days of transactions and standing orders via the AISP endpoints, compute net affordability, then call POST /funds-confirmations to confirm the account can cover the first instalment.
APIs used
Account and Transaction API Specification + Confirmation of Funds API Specification
Consent state kept in sync without polling
Read account data under a consent, and instead of repeatedly polling consent state, react to pushed Security Event Tokens so cached transaction data is invalidated and revoked consents stop being used the moment the bank signals a change.
Example prompt:
On receipt of a SET at POST /event-notifications, parse the affected ConsentId or AccountId and either mark the consent revoked or refresh the AISP transaction cache for that account.
APIs used
Account and Transaction API Specification + Event Notification API Specification - TPP Endpoints
Bank product research with live directory data
Answer customer questions about UK retail banking products by combining the public product and branch directory with the ability to move money once the customer chooses an account, so research and action live in the same workflow.
Example prompt:
Fetch /personal-current-accounts across the CMA9 banks to rank accounts, then, once the customer selects one, create a domestic-payment-consent to fund the opening deposit.
APIs used
Open Data API + Payment Initiation API
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring these APIs by hand means running the TPP client-credentials and PSU authorization-code OAuth flows, managing eIDAS-bound mTLS certificates and JWS signing for payments, and resolving the right per-bank base path for every operation. Through Jentic you install once, add the specific Open Banking API you need from the Jentic directory, store your credentials once, and your agent calls it.
Permission scoping
These specs put the consent and resource identifiers in the URL path, so your own rules can pin an agent to a single consent or account and to just the operations it needs, such as reading transactions or creating one domestic payment. Money-moving or consent-deleting operations are not included unless you add them.
Credential isolation
Your TPP OAuth credentials, eIDAS-bound mTLS certificates, and signing keys are stored once, encrypted, by your own Jentic One instance and applied at execution time. They never enter the agent's prompt, logs, or context, and the public Open Data API needs no credentials at all.
Intent-based discovery
Agents search the Jentic directory by intent such as 'read a customer's bank transactions' or 'initiate a UK domestic payment', and Jentic returns the matching operation and its input schema so the agent calls the right endpoint across the account, payment, funds, event, and directory APIs without browsing the OBIE specification.
FAQs
Specific to using Open Banking UK APIs through Jentic.
What is the difference between the regulated APIs and the Open Data API?
The AISP, PISP, CBPII, and event notification APIs are regulated PSD2 surfaces that require an authorised third-party provider registration, eIDAS certificates, and customer consent, because they touch live customer account data or move money. The Open Data API is a public, unauthenticated dataset of branches, ATMs, and published product terms that needs no credentials at all.
Does one integration work across every UK bank?
Yes. These are standard specifications rather than one bank's private API. Every CMA9 bank, and other authorised banks and building societies, implements the same operations under its own host and authorisation server, so the same OpenAPI shape works across HSBC, Barclays, Lloyds, NatWest, Santander, RBS, Bank of Ireland, Danske, and Nationwide with only the base URL changing per bank.
Do I need to become an authorised third-party provider to use these APIs?
For the four regulated APIs, yes. Calling live account, payment, funds, or event endpoints requires registration as an authorised AISP, PISP, or CBPII with the FCA or another competent authority, plus eIDAS certificates. The Open Data API is exempt because it exposes only public product and directory data.
How does customer consent scope what an agent can do?
The regulated APIs create a consent object that the customer authorises through strong customer authentication, and that consent pins which accounts and resource types can be accessed. An agent's reach is bounded by the consent the customer granted, so it cannot read or act beyond what was authorised.
Which API should I use to check a balance versus confirm funds?
Use the AISP Account and Transaction API when you need the actual balance, transaction history, or statements. Use the CBPII Confirmation of Funds API when you only need a yes/no answer on whether a specific amount is available, which discloses less customer data.
Can I avoid polling for consent and resource changes?
Yes. The Event Notification API lets a bank push a Security Event Token to your inbound endpoint when a consent is revoked or a resource changes, so you can update consent state and invalidate cached account data on the event rather than polling the AISP or CBPII APIs on a schedule.
If you need a different Payments vendor
All 4 are in the Jentic catalogue with the same one-credential, intent-search pattern.
BOOK A DEMO
Start Connecting APIs to Your AI Agents
Browse thousands of APIs and connect them all to your agent with Jentic One. One layer, one credential — every API your agent needs.