API reference

Payout Banklink API

PSD2 API aggregator and more.

Authentication

This API can be accessed on behalf of a user with an OAuth2 access token issued by Payout ID. Supported grant flows are authorization_code and client_credentials. Send the token in the Authorization: Bearer <access_token> header.

Environment	Authorization endpoint	Token endpoint
Sandbox	https://id-sa.payout.one/oauth/authorize	https://id-sa.payout.one/oauth/token
Production	https://id.payout.one/oauth/authorize	https://id.payout.one/oauth/token

Integrator can use these scopes:

scope	description	endpoints
BLAISP	scope for reading details of user bank account	List accounts, Account Details, Account Information, Retrieve account balance, Consent Accounts, /transactions
BLIBAN	to verify that currently authorized user has access to bank account	Verify IBAN
BLPISP	to create payment on behalf of current user	Payment initialisation, Payment status
VERIFY	to verify user identity, retrieved using the `client_credentials` flow	Create Verification, Get Verification Status

List Integrations requires a valid access token but no specific scope.

A missing, invalid or expired token, or a token without the required scope, is rejected with 403 and error code UNAUTHORIZED.

Authorizing access to the bank account

When the requested account is not connected yet, or its authorization at the bank has expired, account endpoints respond with 403 and a body containing consent_id and redirect_url. Redirect the user to redirect_url and add the query parameters redirect_uri (one of the redirect URIs registered for your application) and optionally state. The same applies to _links.sca.href returned by Payment initialisation and to redirect_url returned by Create Verification. After the user authorized access at the bank, he is redirected back to redirect_uri together with state.

Errors

View as Markdown Spec

API uses HTTP response codes.

Code	Description
400	Bad request
401	Unauthorized
403	Forbidden
404	Not Found
500	Internal Server Error

Errors are returned in a tppMessages array:

JSON

{
  "tppMessages": [
    {
      "category": "ERROR",
      "code": "INVALID_INPUT",
      "text": "Unsupported IBAN country",
      "xpath": "/debtorAccount/iban"
    }
  ]
}

xpath is present only for validation errors (INVALID_INPUT).

HTTP	code	meaning
400	INVALID_REQUEST	Missing or invalid header or body
400	INVALID_INPUT	A request body field failed validation, see `xpath`
400	UNSUPPORTED_BANK	Bank could not be recognised from `iban` and `bank`
400	INVALID_PAYMENT_PRODUCT	Unknown `payment_product` path parameter
401	INVALID_TOKEN	Token does not identify the application (`aud`, `auu` claims)
403	UNAUTHORIZED	Missing, invalid or expired token, or missing scope
500	INTERNAL_SERVER_ERROR	Unexpected bank response or internal error

A 403 returned by an account endpoint can instead contain consent_id and redirect_url: the user has to authorize access to the account first, see Authentication. Unknown payment in Payment status returns 404 with body {"errors": {"detail": "Not Found"}}.

POST

List accounts

View as Markdown Spec

/v1/accounts

Retrieve current user connected accounts. Data are returned from Banklink, the bank is not called.

Responses

200 Success

name	example	description
accounts[]/identification/iban	SK3112000000198742637541	IBAN of retrieved account
accounts[]/name	common	Name of account
accounts[]/baseCurrency	EUR	-
accounts[]/providerName	tatrabanka	Name of bank servicing the account

Response 200

accountsobject[]

identificationobject

ibanstring

IBAN of retrieved account · e.g. SK3112000000198742637541

namestring

Name of account · e.g. common

baseCurrencystring

e.g. EUR

providerNamestring

Name of bank servicing the account · e.g. tatrabanka

Other responses

403

Missing, invalid or expired access token, or missing scope (UNAUTHORIZED)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/accounts' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://wap-sa.payout.one/api/v1/accounts", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/accounts",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/accounts");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "accounts": [
    {
      "identification": {
        "iban": "SK3112000000198742637541"
      },
      "name": "common",
      "baseCurrency": "EUR",
      "providerName": "tatrabanka"
    }
  ]
}

POST

Retrieve account balance

View as Markdown Spec

/v1/accounts/balance

Retrieve current user account balance directly from bank.

Response in case of unexpired connected account

Body parameters

name	description
balances[]/amount/value	Balance of account
balances[]/amount/currency	Currency of this balance from ISO 4217
balances[]/type	Balance type in ISO 20022
balances[]/creditDebitIndicator	CRDT if it is credit, else DBIT
balances[]/dateTime	Date and time of account balance check in RFC3339

Response in case of expired/unknown account

Status 403.

name	description
consent_id	Consent id, can be used with Consent Accounts after user authorization
redirect_url	Redirect url to use to redirect user to authorize access to account

Parameters

PSU-IP-Addressheader · string

IP address from which is user performing actions

PSU-Presenceheader · string

If request is realtime consequence of user action, true or false (default)

PSU-User-Agentheader · string

Application which user is using to browse web

Request body

iban requiredstring

IBAN of the account · e.g. SK3112000000198742637541

bankstring

Optional name of bank, integration name from List Integrations, for IBANs whose bank cannot be recognised from IBAN alone · e.g. tatrabanka

Response 200

balancesobject[]

amountobject

valuenumber

Balance of account · e.g. 1520.35

currencystring

Currency of this balance from ISO 4217 · e.g. EUR

typestring

Balance type in ISO 20022 · e.g. ITAV

creditDebitIndicatorstring

CRDT if it is credit, else DBIT · one of CRDT, DBIT · e.g. CRDT

dateTimestring<date-time>

Date and time of account balance check in RFC3339 · e.g. 2026-10-06T08:00:00+00:00

Other responses

400

Missing or invalid header or body (INVALID_REQUEST), or bank could not be recognised (UNSUPPORTED_BANK)

403

Response in case of expired/unknown account, redirect user to redirect_url to authorize access to account. Also returned with UNAUTHORIZED error for a missing, invalid or expired access token, or missing scope.

500

Unexpected bank response (INTERNAL_SERVER_ERROR)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/balance' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/accounts/balance", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "iban": "SK3112000000198742637541"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/accounts/balance",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "iban": "SK3112000000198742637541",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/accounts/balance");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "iban" => "SK3112000000198742637541"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "balances": [
    {
      "amount": {
        "value": 1520.35,
        "currency": "EUR"
      },
      "type": "ITAV",
      "creditDebitIndicator": "CRDT",
      "dateTime": "2026-10-06T08:00:00+00:00"
    }
  ]
}

POST

Verify IBAN

View as Markdown Spec

/v1/accounts/verify-iban

Verify that current user has access to account with specified IBAN.

Response in case of unexpired connected account

Body parameters

name	description
iban	IBAN for which was verification requested
verified	Constant true

Response in case of expired/unknown account

Status 403.

Body parameters

name	description
consent_id	Consent id
redirect_url	Url to redirect user to authorize access to account

Parameters

PSU-IP-Addressheader · string

IP address from which is user performing actions

PSU-Presenceheader · string

If request is realtime consequence of user action, true or false (default)

PSU-User-Agentheader · string

Application which user is using to browse web

Request body

iban requiredstring

IBAN of the account · e.g. SK3112000000198742637541

bankstring

Optional name of bank, integration name from List Integrations, for IBANs whose bank cannot be recognised from IBAN alone · e.g. tatrabanka

Response 200

ibanstring

IBAN for which was verification requested · e.g. SK3112000000198742637541

verifiedboolean

Constant true · e.g. true

Other responses

400

Missing or invalid header or body (INVALID_REQUEST), or bank could not be recognised (UNSUPPORTED_BANK)

403

500

Unexpected bank response (INTERNAL_SERVER_ERROR)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/verify-iban' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/accounts/verify-iban", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "iban": "SK3112000000198742637541"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/accounts/verify-iban",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "iban": "SK3112000000198742637541",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/accounts/verify-iban");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "iban" => "SK3112000000198742637541"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "iban": "SK3112000000198742637541",
  "verified": true
}

POST

Account Details

View as Markdown Spec

/v1/accounts/details

Retrieve details of user account identified by IBAN

For expired/unknown account the response is 403 with consent_id and redirect_url.

Parameters

PSU-IP-Addressheader · string

IP address from which is user performing actions

PSU-Presenceheader · string

If request is realtime consequence of user action, true or false (default)

PSU-User-Agentheader · string

Application which user is using to browse web

Request body

iban requiredstring

IBAN of the account · e.g. SK3112000000198742637541

bankstring

Optional name of bank, integration name from List Integrations, for IBANs whose bank cannot be recognised from IBAN alone · e.g. tatrabanka

Response 200

identificationobject

ibanstring

IBAN of retrieved account · e.g. SK3112000000198742637541

namestring

Name of account · e.g. common

productNamestring

name of product in bank · e.g. superaccount

typestring

type of account, depends on bank · e.g. CACC

baseCurrencystring

e.g. EUR

authorizationExpirationstring<date-time>

The date and time in RFC3339 at which authorization of the account expires · e.g. 2026-12-31T08:37:51+00:00

Other responses

400

Missing or invalid header or body (INVALID_REQUEST), or bank could not be recognised (UNSUPPORTED_BANK)

403

500

Unexpected bank response (INTERNAL_SERVER_ERROR)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/details' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/accounts/details", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "iban": "SK3112000000198742637541"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/accounts/details",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "iban": "SK3112000000198742637541",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/accounts/details");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "iban" => "SK3112000000198742637541"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "identification": {
    "iban": "SK3112000000198742637541"
  },
  "name": "common",
  "productName": "superaccount",
  "type": "CACC",
  "baseCurrency": "EUR",
  "authorizationExpiration": "2026-12-31T08:37:51+00:00"
}

POST

Consent Accounts

View as Markdown Spec

/v1/provider/accounts

Retrieve list of accounts by consent id, which is returned during user authorization

Each item of accounts has the same fields as the Account Details response.

Parameters

PSU-IP-Addressheader · string

IP address from which is user performing actions

PSU-Presenceheader · string

If request is realtime consequence of user action, true or false (default)

PSU-User-Agentheader · string

Application which user is using to browse web

Request body

consent_id requiredinteger

Consent id returned in consent_id when user authorization was requested · e.g. 123

Response 200

accountsobject[]

identificationobject

ibanstring

IBAN of retrieved account · e.g. SK3112000000198742637541

namestring

Name of account · e.g. common

productNamestring

name of product in bank · e.g. superaccount

typestring

type of account, depends on bank · e.g. CACC

baseCurrencystring

e.g. EUR

authorizationExpirationstring<date-time>

The date and time in RFC3339 at which authorization of the account expires · e.g. 2026-12-31T08:37:51+00:00

Other responses

400

Missing consent_id or unknown consent (INVALID_REQUEST)

403

500

Unexpected bank response (INTERNAL_SERVER_ERROR)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/provider/accounts' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "consent_id": 123
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/provider/accounts", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "consent_id": 123
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/provider/accounts",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "consent_id": 123,
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/provider/accounts");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "consent_id" => 123
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "accounts": [
    {
      "identification": {
        "iban": "SK3112000000198742637541"
      },
      "name": "common",
      "productName": "superaccount",
      "type": "CACC",
      "baseCurrency": "EUR",
      "authorizationExpiration": "2026-12-31T08:37:51+00:00"
    }
  ]
}

POST

Account Information

View as Markdown Spec

/v1/accounts/information

Retrieve current user account information and balances

account has the same fields as the Account Details response. Each item of balances has amount/value, amount/currency, creditDebitIndicator and dateTime as described in Retrieve account balance.

For expired/unknown account the response is 403 with consent_id and redirect_url.

Parameters

PSU-IP-Addressheader · string

IP address from which is user performing actions

PSU-Presenceheader · string

If request is realtime consequence of user action, true or false (default)

PSU-User-Agentheader · string

Application which user is using to browse web

Request body

iban requiredstring

IBAN of the account · e.g. SK3112000000198742637541

bankstring

Optional name of bank, integration name from List Integrations, for IBANs whose bank cannot be recognised from IBAN alone · e.g. tatrabanka

Response 200

accountobject

identificationobject

ibanstring

IBAN of retrieved account · e.g. SK3112000000198742637541

namestring

Name of account · e.g. common

productNamestring

name of product in bank · e.g. superaccount

typestring

type of account, depends on bank · e.g. CACC

baseCurrencystring

e.g. EUR

authorizationExpirationstring<date-time>

The date and time in RFC3339 at which authorization of the account expires · e.g. 2026-12-31T08:37:51+00:00

balancesobject[]

amountobject

valuenumber

Balance of account · e.g. 1520.35

currencystring

Currency of this balance from ISO 4217 · e.g. EUR

creditDebitIndicatorstring

CRDT if it is credit, else DBIT · one of CRDT, DBIT · e.g. CRDT

dateTimestring<date-time>

Date and time of account balance check in RFC3339 · e.g. 2026-10-06T08:00:00+00:00

Other responses

400

Missing or invalid header or body (INVALID_REQUEST), or bank could not be recognised (UNSUPPORTED_BANK)

403

500

Unexpected bank response (INTERNAL_SERVER_ERROR)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/accounts/information' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541"
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/accounts/information", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "iban": "SK3112000000198742637541"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/accounts/information",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "iban": "SK3112000000198742637541",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/accounts/information");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "iban" => "SK3112000000198742637541"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "account": {
    "identification": {
      "iban": "SK3112000000198742637541"
    },
    "name": "common",
    "productName": "superaccount",
    "type": "CACC",
    "baseCurrency": "EUR",
    "authorizationExpiration": "2026-12-31T08:37:51+00:00"
  },
  "balances": [
    {
      "amount": {
        "value": 1520.35,
        "currency": "EUR"
      },
      "creditDebitIndicator": "CRDT",
      "dateTime": "2026-10-06T08:00:00+00:00"
    }
  ]
}

POST

Payment initialisation

View as Markdown Spec

/v1/payments/{integration}/{payment_product}

Payment initialisation request. Access token for this request requires BLPISP OAuth scope.

Redirect the user to _links.sca.href to authorize the payment, see Authentication.

Responses

201 Created

name	example	description
paymentId	123	Id of created payment
_links/sca/href	https://wap-sa.payout.one/providers/forward/Xk7pQ2	HATEOAS link containing redirect to authorize user

400 Invalid input parameter

name	example	description
tppMessages[]/category	ERROR	Message category, only error is supported for now
tppMessages[]/code	INVALID_INPUT	Kind of error that happened
tppMessages[]/text	Unsupported IBAN country
tppMessages[]/xpath	/debtorAccount/iban	XPath to field where error happened (optional)

Parameters

integration requiredpath · string

Which integration to use to create payment: name of an integration from List Integrations, for example tatrabanka, vub, slsp, unicredit, csob, csas, fio, komercni-banka, csob-cz.

payment_product requiredpath · string

Which payment method to use, can be different per integration: sepa-credit-transfers (sepa in supported_payment_methods of List Integrations) or instant-sepa-credit-transfers (sepa_ipay). one of sepa-credit-transfers, instant-sepa-credit-transfers

Request body

endToEndIndentificationstring

End to end identification. In format /VS…/SS…/KS… it is split to variable, specific and constant symbol · max 35 · e.g. /VS1/SS2/KS3

creditorAgentstring

BIC of creditor bank · e.g. COBADEFFXXX

creditorName requiredstring

max 70 · e.g. John Doe

creditorEmailstring

E-mail of creditor, non-standard field used by the payout integration · max 254 · e.g. [email protected]

debtorName requiredstring

e.g. Test Testovic

remittanceInformationUnstructuredstring

max 140 · e.g. Testing

purposeProprietarystring

Non-standard field, required by csob-cz for business customers

debtorAccount requiredobject

iban requiredstring

IBAN of debtor account (SK, CZ, DE or LT) · e.g. SK3112000000198742637541

creditorAccount requiredobject

iban requiredstring

IBAN of creditor account (SK, CZ, DE or LT) · e.g. DE89370400440532013000

instructedAmount requiredobject

amount requiredstring

Amount as decimal number · e.g. 1.00

currency requiredstring

one of EUR, CZK · e.g. EUR

Response 201

paymentIdinteger

Id of created payment · e.g. 123

_linksobject

scaobject

hrefstring<uri>

HATEOAS link containing redirect to authorize user · e.g. https://wap-sa.payout.one/providers/forward/Xk7pQ2

Other responses

400

Invalid input parameter (INVALID_INPUT with xpath, or INVALID_PAYMENT_PRODUCT)

403

Missing, invalid or expired access token, or missing scope (UNAUTHORIZED)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/payments/{integration}/{payment_product}' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "endToEndIndentification": "/VS1/SS2/KS3",
       "creditorAgent": "COBADEFFXXX",
       "creditorName": "John Doe",
       "debtorName": "Test Testovic",
       "remittanceInformationUnstructured": "Testing",
       "debtorAccount": {
         "iban": "SK3112000000198742637541"
       },
       "creditorAccount": {
         "iban": "DE89370400440532013000"
       },
       "instructedAmount": {
         "amount": "1.00",
         "currency": "EUR"
       }
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/payments/{integration}/{payment_product}", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "endToEndIndentification": "/VS1/SS2/KS3",
    "creditorAgent": "COBADEFFXXX",
    "creditorName": "John Doe",
    "debtorName": "Test Testovic",
    "remittanceInformationUnstructured": "Testing",
    "debtorAccount": {
      "iban": "SK3112000000198742637541"
    },
    "creditorAccount": {
      "iban": "DE89370400440532013000"
    },
    "instructedAmount": {
      "amount": "1.00",
      "currency": "EUR"
    }
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/payments/{integration}/{payment_product}",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "endToEndIndentification": "/VS1/SS2/KS3",
        "creditorAgent": "COBADEFFXXX",
        "creditorName": "John Doe",
        "debtorName": "Test Testovic",
        "remittanceInformationUnstructured": "Testing",
        "debtorAccount": {
            "iban": "SK3112000000198742637541",
        },
        "creditorAccount": {
            "iban": "DE89370400440532013000",
        },
        "instructedAmount": {
            "amount": "1.00",
            "currency": "EUR",
        },
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/payments/{integration}/{payment_product}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "endToEndIndentification" => "/VS1/SS2/KS3",
  "creditorAgent" => "COBADEFFXXX",
  "creditorName" => "John Doe",
  "debtorName" => "Test Testovic",
  "remittanceInformationUnstructured" => "Testing",
  "debtorAccount" => [
    "iban" => "SK3112000000198742637541"
  ],
  "creditorAccount" => [
    "iban" => "DE89370400440532013000"
  ],
  "instructedAmount" => [
    "amount" => "1.00",
    "currency" => "EUR"
  ]
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 201

{
  "paymentId": 123,
  "_links": {
    "sca": {
      "href": "https://wap-sa.payout.one/providers/forward/Xk7pQ2"
    }
  }
}

GET

Payment status

View as Markdown Spec

/v1/payments/{payment_id}/status

Retrieve actual status of payment.

Responses

200 Success

name	example	description
paymentId	123	Id of requested payment
transactionStatus	pending	Status of the payment, described in following table

Payment statuses

value	description
pending	payment created in Banklink but not yet posted to bank
initialized	payment posted to bank, but not yet validated
received	payment was validated as technically correct by bank
accepted	bank accepted payment as valid, is signed by user and waiting to be processed
unknown	payment was signed, but we were unable to check it's status after that
completed	payment was successfully processed
rejected	payment is invalid or declined by user

404 Not Found

Parameters

payment_id requiredpath · integer

Payment ID returned during payment initialization request

Response 200

paymentIdinteger

Id of requested payment · e.g. 123

transactionStatusstring

Status of the payment, described in the payment statuses table · one of pending, initialized, received, accepted, unknown, completed, rejected · e.g. pending

Other responses

403

Missing, invalid or expired access token, or missing scope (UNAUTHORIZED)

404

Not Found

Request

curl -X GET 'https://wap-sa.payout.one/api/v1/payments/{payment_id}/status' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://wap-sa.payout.one/api/v1/payments/{payment_id}/status", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://wap-sa.payout.one/api/v1/payments/{payment_id}/status",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/payments/{payment_id}/status");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "paymentId": 123,
  "transactionStatus": "pending"
}

GET

List Integrations

View as Markdown Spec

/v1/integrations

List of bank integrations. name is the value to use as bank in account requests and as integration in Payment initialisation.

Response 200 (array)

namestring

Integration name · e.g. tatrabanka

aispboolean

Integration supports account information · e.g. true

pispboolean

Integration supports payment initiation · e.g. true

supported_payment_methodsstring[]

Present only when pisp is true. sepa stands for sepa-credit-transfers, sepa_ipay for instant-sepa-credit-transfers

Other responses

403

Missing, invalid or expired access token, or missing scope (UNAUTHORIZED)

Request

curl -X GET 'https://wap-sa.payout.one/api/v1/integrations' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://wap-sa.payout.one/api/v1/integrations", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://wap-sa.payout.one/api/v1/integrations",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/integrations");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

[
  {
    "name": "payout",
    "aisp": true,
    "pisp": true,
    "supported_payment_methods": [
      "sepa"
    ]
  },
  {
    "name": "tatrabanka",
    "aisp": true,
    "pisp": true,
    "supported_payment_methods": [
      "sepa",
      "sepa_ipay"
    ]
  }
]

POST

Create Verification

View as Markdown Spec

/v1/verifications

Verify user identity using PSD2 APIs. Requires VERIFY scope that can be retrieved using client credentials flow from Payout ID.

Redirect the user to the returned redirect_url, see Authentication. The result can then be retrieved with Get Verification Status.

Request body

iban requiredstring

IBAN of the account used for verification · e.g. CZ6508000000192000145399

first_namestring

First name compared with account owner · e.g. Jan

last_namestring

Last name compared with account owner · e.g. Novák

bankstring

Optional integration name from List Integrations, for IBANs whose bank cannot be recognised from IBAN alone · e.g. csas

Response 200

idstring<uuid>

Verification id · e.g. 3f1c9a52-7d4e-4b8a-9c21-5e6f7a8b9c0d

redirect_urlstring<uri>

Url to redirect user to verify access to account · e.g. https://wap-sa.payout.one/providers/forward/Xk7pQ2

statusstring

one of initialized, verified_access, verified_ownership, unverified_access, unverified_ownership, error · e.g. initialized

Other responses

400

Invalid input parameter (INVALID_INPUT with xpath)

403

Missing, invalid or expired access token, or missing scope (UNAUTHORIZED)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/verifications' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "CZ6508000000192000145399",
       "first_name": "Jan",
       "last_name": "Novák"
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/verifications", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "iban": "CZ6508000000192000145399",
    "first_name": "Jan",
    "last_name": "Novák"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/verifications",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "iban": "CZ6508000000192000145399",
        "first_name": "Jan",
        "last_name": "Novák",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/verifications");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "iban" => "CZ6508000000192000145399",
  "first_name" => "Jan",
  "last_name" => "Nov\u00e1k"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "id": "3f1c9a52-7d4e-4b8a-9c21-5e6f7a8b9c0d",
  "redirect_url": "https://wap-sa.payout.one/providers/forward/Xk7pQ2",
  "status": "initialized"
}

GET

Get Verification Status

View as Markdown Spec

/v1/verifications/{verification_id}

Verification status can be one of:

initialized - verification was created but user was not yet redirected for verification
verified_access - user managed to provide credentials for account, but bank servicing that account is not providing ownership information
verified_ownership - user managed to login and account servicer provided ownership information which also matched name of the user
unverified_access - user failed to provide credentials to access account
unverified_ownership - user provided credentials to access account but ownership details were different from provided user details
error - error during communication between us and account servicer

Only verifications created by the same application can be retrieved.

Parameters

verification_id requiredpath · string<uuid>

Verification id returned by Create Verification

Response 200

statusstring

one of initialized, verified_access, verified_ownership, unverified_access, unverified_ownership, error · e.g. initialized

Other responses

400

Unknown verification (returned with code UNSUPPORTED_BANK)

403

Missing, invalid or expired access token, or missing scope (UNAUTHORIZED)

Request

curl -X GET 'https://wap-sa.payout.one/api/v1/verifications/{verification_id}' \
  -H "Authorization: Bearer $TOKEN"

const res = await fetch("https://wap-sa.payout.one/api/v1/verifications/{verification_id}", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
  },
});
const data = await res.json();

import os, requests

res = requests.get(
    "https://wap-sa.payout.one/api/v1/verifications/{verification_id}",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/verifications/{verification_id}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN")]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "status": "initialized"
}

POST

/transactions

View as Markdown Spec

/v1/transactions

Retrieve current user transactions directly from bank. Up to 100 transactions are returned per page.

Body parameters

name	required	description
iban	true	-
bank	false	Optional name of bank, integration `name` from List Integrations
page_index	false	Parameter to be used if we want to visit next or previous page, it can be filled from next_page/previous_page from successful previous response
date_from	false	Does not return transaction older than this, default is 90 days ago
date_to	false	Does not return transactions newer than this, default is end of today

Response in case of unexpired connected account

Body parameters

name	description
pagination/next_page	Next page index
pagination/previous_page	Previous page index
transactions[]/amount/value	Amount in transaction
transactions[]/amount/currency	Currency of transactions
transactions[]/valueDate	The Date at which assets become available to the account owner in case of a credit
transactions[]/bookingDate	The Date when an entry is posted to an account on the ASPSPs books.
transactions[]/creditDebitIndicator	Indication of credit or debit, CRDT or DBIT respectiveli
transactions[]/bankTransactionCode	ISO20022 bank transaction code
transactions[]/transactionDetails/reversalIndicator	Whatever this transaction is reveresal for previous one
transactions[]/transactionDetails/references/accountServiceReference	Unique transaction id generated by ASPSP
transactions[]/transactionDetails/references/endToEndIdentification	The unique identifier of the transaction generated by a bank that it should be considered as a bank reference
transactions[]/transactionDetails/references/chequeNumber	For card transactions, this is the card number in format ** 1111.
transactions[]/transactionDetails/counterValueAmount/amount/value	Numberic value of amount as fractional number
transactions[]/transactionDetails/counterValueAmount/amount/currency	Alphabetic code from ISO 4217
transactions[]/transactionDetails/currencyExchange/exchangeRate	Fraction as exchange rate for transaction
transactions[]/transactionDetails/relatedParties/debtor/name	Debtor account
transactions[]/transactionDetails/relatedParties/debtorAccount/identification	Unique identificator of debtor account, usually IBAN
transactions[]/transactionDetails/relatedParties/creditor/name	Creditor account
transactions[]/transactionDetails/relatedParties/creditorAccount/identification	Creditor account unique identificator, usualy IBAN
transactions[]/transactionDetails/tradingParty/name	Name of third party, in case of card transactions it is merchant
transactions[]/transactionDetails/relatedAgents/debtorAgent/financialInstitutionIdentification	Identification of bank managing debtor account, usually BIC
transactions[]/transactionDetails/relatedAgents/creditorAgent/financialInstitutionIdentification	Identification of bank managing creditor account, usually BIC
transactions[]/transactionDetails/remittanceInformation	The text aimed as the information for a receiver of the transaction.

Response in case of expired/unknown account

Status 403.

Body parameters

name	description
consent_id	Consent id
redirect_url	Url to redirect user to authorize access to account

Parameters

PSU-IP-Addressheader · string

IP address from which is user performing actions

PSU-Presenceheader · string

If request is realtime consequence of user action, true or false (default)

PSU-User-Agentheader · string

Application which user is using to browse web

Request body

iban requiredstring

IBAN of the account · e.g. SK3112000000198742637541

bankstring

Optional name of bank, integration name from List Integrations, for IBANs whose bank cannot be recognised from IBAN alone · e.g. tatrabanka

page_indexstring

Parameter to be used if we want to visit next or previous page, it can be filled from next_page/previous_page from successful previous response · e.g. xAffr34154

date_fromstring

Does not return transaction older than this. Default is 90 days ago · e.g. 2023-01-05

date_tostring

Does not return transactions newer than this. Default is end of today · e.g. 2023-01-10

Response 200

paginationobject

next_pageany

Next page index · e.g. zxQewRtveXy

previous_pageany

Previous page index · e.g. g1123zseaR

transactionsobject[]

amountobject

valuestring

Amount in transaction · e.g. 12.50

currencystring

Currency of transactions · e.g. EUR

valueDatestring

The Date at which assets become available to the account owner in case of a credit · e.g. 2026-09-14

bookingDatestring

The Date when an entry is posted to an account on the ASPSPs books. e.g. 2026-09-14

creditDebitIndicatorstring

Indication of credit or debit, CRDT or DBIT respectiveli · one of CRDT, DBIT · e.g. CRDT

bankTransactionCodestring

ISO20022 bank transaction code

transactionDetailsobject

reversalIndicatorboolean

Whatever this transaction is reveresal for previous one

referencesobject

accountServiceReferencestring

Unique transaction id generated by ASPSP

endToEndIdentificationstring

The unique identifier of the transaction generated by a bank that it should be considered as a bank reference

chequeNumberstring

For card transactions, this is the card number in format ** 1111.

counterValueAmountobject

amountobject

valuestring

Numberic value of amount as fractional number

currencystring

Alphabetic code from ISO 4217

currencyExchangeobject

exchangeRatenumber

Fraction as exchange rate for transaction

relatedPartiesobject

debtorobject

namestring

Debtor account

debtorAccountobject

identificationstring

Unique identificator of debtor account, usually IBAN

creditorobject

namestring

Creditor account

creditorAccountobject

identificationstring

Creditor account unique identificator, usualy IBAN

tradingPartyobject

namestring

Name of third party, in case of card transactions it is merchant

relatedAgentsobject

debtorAgentobject

financialInstitutionIdentificationstring

Identification of bank managing debtor account, usually BIC

creditorAgentobject

financialInstitutionIdentificationstring

Identification of bank managing creditor account, usually BIC

remittanceInformationstring

The text aimed as the information for a receiver of the transaction.

Other responses

400

Missing or invalid header or body (INVALID_REQUEST), or bank could not be recognised (UNSUPPORTED_BANK)

403

500

Unexpected bank response (INTERNAL_SERVER_ERROR)

Request

curl -X POST 'https://wap-sa.payout.one/api/v1/transactions' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "iban": "SK3112000000198742637541",
       "page_index": "xAffr34154",
       "date_from": "2023-01-05",
       "date_to": "2023-01-10"
     }'

const res = await fetch("https://wap-sa.payout.one/api/v1/transactions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYOUT_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "iban": "SK3112000000198742637541",
    "page_index": "xAffr34154",
    "date_from": "2023-01-05",
    "date_to": "2023-01-10"
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://wap-sa.payout.one/api/v1/transactions",
    headers={"Authorization": f"Bearer {os.environ['PAYOUT_TOKEN']}"},
    json={
        "iban": "SK3112000000198742637541",
        "page_index": "xAffr34154",
        "date_from": "2023-01-05",
        "date_to": "2023-01-10",
    },
)
data = res.json()

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wap-sa.payout.one/api/v1/transactions");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  "iban" => "SK3112000000198742637541",
  "page_index" => "xAffr34154",
  "date_from" => "2023-01-05",
  "date_to" => "2023-01-10"
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . getenv("PAYOUT_TOKEN"), "Content-Type: application/json"]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response 200

{
  "pagination": {
    "next_page": "zxQewRtveXy",
    "previous_page": "g1123zseaR"
  },
  "transactions": [
    {
      "amount": {
        "value": "12.50",
        "currency": "EUR"
      },
      "valueDate": "2026-09-14",
      "bookingDate": "2026-09-14",
      "creditDebitIndicator": "CRDT"
    }
  ]
}

Was this page helpful?

Need help? Contact support.
Questions? Contact sales.
Service status? status.payout.one.
LLM? Read llms.txt.