What authentication does the Postbank Bulgaria Open Banking API use?

The API uses OAuth 2.0 authorization code flow with three scopes: ais (Account Information), pis (Payment Initiation), and cfs (Confirmation of Funds). Authorization is at https://api.postbank.bg/oauth/authorize and tokens are obtained from https://api.postbank.bg/oauth/token. Through Jentic, OAuth tokens are managed automatically.

Can I initiate SEPA transfers through the Postbank Bulgaria API?

Yes. The /v1/payments/sepa-credit-transfers endpoint accepts a payment request with debtor account IBAN, creditor account IBAN, and an instructed amount with currency. The API returns a payment ID and transaction status. The API also supports domestic-budget-transfers as a payment product.

What are the rate limits for the Postbank Bulgaria Open Banking API?

PSD2 regulations require banks to provide reasonable access. Specific rate limits are not published in the specification. Postbank follows standard NextGenPSD2 guidelines which typically allow 4 access requests per day for account information without active customer involvement.

How do I retrieve account transactions through the Postbank API with Jentic?

Install the SDK with pip install jentic, then search for 'retrieve bank account transactions'. Jentic returns the getAccountTransactions operation schema requiring an account-id path parameter and optional dateFrom and dateTo query parameters. Execute the call to receive booked and pending transaction records.

What consent management is required for account access?

Before accessing account data, you must create an AIS consent via POST /v1/consents. The consent has a validUntil date and a status (received, valid, rejected, expired). You can check consent status with GET /v1/consents/{consentId} and revoke it with DELETE /v1/consents/{consentId}. All account endpoints require an active consent.

Can I limit what my agent is allowed to do with the Postbank Bulgaria Open Banking API?

Yes. Because you run Jentic One yourself, your own rules decide which Postbank operations and OAuth credentials the agent may use. Since the account id sits in the URL path (/v1/accounts/{account-id}/...), you can pin the agent to reading balances and transactions on a single account while excluding payment initiation such as /v1/payments/sepa-credit-transfers unless you explicitly add it. Only the operations you allow, like GET /v1/accounts or POST /v1/funds-confirmations, are ever callable.