Enable Banking

Exchange the code from the bank's redirect for a session and store it under label, replacing the consent stored there (the previous sessions.json is copied to sessions.json.bak first); without a label, a renewal replaces the stored consent for the same bank, country and psu_type. Takes the WHOLE redirect URL or just its code. The code is single-use and expires within minutes, so run this straight after the approval. The session is written to disk before anything else, because Enable Banking reveals the session id exactly once. Returns the authorised accounts (IBAN, currency, name, as the bank describes them now) and when the consent ends.

The same statement as get_transactions (same arguments, same filters, same reads at the bank), written as a CSV file instead of returned: one row per transaction with its account, dates, direction, signed exact amount, currency, counterparty, payment reference and status. Returns the file's path, size and SHA-256, and how many rows it holds. Use it for a long period or many accounts, or when the result is meant for a spreadsheet or an accountant.

The balances the bank reports for one account uid: every type it sends (booked, available, interim, and so on), each with the PSD2 code as sent and its meaning spelled out, a reference date where the bank gives one, and the amount as an EXACT decimal string signed by the bank (negative when overdrawn). One read at the bank per call, like a statement.

A statement: the transactions of one account (account_uid), of every account on one consent (label), or of every account on every stored consent (neither), following the bank's pagination to the end. Each account read spends one of the few reads the bank allows per account per day (about four), so read once and narrow with the filters rather than reading again: text, direction, amount_min and amount_max run here, after the read, and cost nothing more. Dates are YYYY-MM-DD and empty means unbounded. transaction_status takes a friendly name (booked, pending, cancelled, hold, other, rejected, scheduled) or a PSD2 code; empty omits the filter, which is NOT the same as asking for booked. Each row carries a SIGNED decimal amount as a string, negative for money leaving the account, and a counterparty resolved against the direction rather than copied from one fixed field. Amounts are strings because they are exact: parse them yourself if you need arithmetic. An amountWarning appears only on a row whose figure could not be taken at face value. Reading several accounts, each row also names its account, and one account that fails is reported in accounts without hiding the others. For more rows than a reply should hold, export_transactions writes the same statement as CSV.

Check that the integration is alive and say so in detail: the Enable Banking application the key pair authenticates as, its environment and redirect URL, where the config, key and sessions are, and how many consents are stored. Run this before concluding the MCP is broken.

The accounts a stored consent currently reaches, asked of the API rather than replayed from disk, because a bank can drop an account from a live consent. The uid field is what get_transactions takes.

List the banks Enable Banking can reach, by two-letter country code. The name field is what start_auth takes, psuTypes says whether the bank exposes personal accounts, business accounts or both, and maxConsentDays is how long that bank will let a consent last. Pass an empty country for every bank in every market. Served from a one-hour cache.

Every stored consent: its label, the bank, the accounts it covered, and when it EXPIRES (date and days left). A lapsed consent needs the account holder to approve a new one in the bank app, so check this first when a statement suddenly fails, and before one runs out.

End a stored consent: Enable Banking is asked to close the session, which ends the bank's consent, and the label is removed from the stored consents (the file as it was is kept as a backup). Afterwards nothing can read those accounts until the account holder approves a new consent in their bank, so use it only when access should really stop (an account closed, an application retired, access no longer wanted). A consent the bank already ended is removed just the same. The label is required, always.

Begin a consent with one bank, valid for 180 days, over every account the bank offers. To renew a stored consent, pass the bank, country and psu_type list_stored_sessions shows for it. Returns a URL a HUMAN must open: the bank requires strong customer authentication, so this step cannot be automated. After approval the bank redirects to the configured redirect_url with ?code=... in the query; that URL, or just the code, goes into complete_auth. Moves money or makes a legal document: the client asks the user to approve each call.