# Overview This collection of API endpoints enables you to access data and perform actions on your Investec Mauritius account. With these APIs, you can: - Retrieve a list of your accounts and account details - Check account balances - Get your transaction history - Download PDF documents (bank statements) # Authentication

View Authentication details

- Investec API authentication uses **OAuth 2.0 client credentials** (`client_id` and `client_secret`), with the addition of an `x-api-key`. - Log in to Investec Online to get your `client_id` and `client_secret` and to generate your `x-api key` with the scopes you require. **1. Get an access token** - To get an access token, you must exchange your `client_id`, `client_secret` and `x-api key` for the token ```bash curl --location 'https://openapi.investec.com/identity/v2/oauth2/token' \ --header 'x-api-key: <>' \ --header 'Authorization: Basic <>' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' ``` **Headers explained:** - `x-api-key`: API key generated on Investec Online - `Authorization`: Base64-encoded `client_id:client_secret`. Take your `client_id` and `client_secret` and base64 encode them to provide a value for basic authorization. - `Content-Type`: Indicates the request body format **2. Use the token for all API requests** - Use the access token that you receive in all subsequent API requests - Access tokens are **valid for 30 minutes** and must be refreshed when expired ```bash curl --location 'https://openapi.investec.com/...' \ --header 'Authorization: Bearer <>' ``` **Notes** - Ensure your API key has the required scopes - you can set these when you create the key on Investec Online.

# Quickstart

View Quickstart (cURL)

This Quickstart walks you through making your first successful API call to the Mauritius Accounts API endpoints. By the end of this guide, you will: - Authenticate using OAuth 2.0 client credentials and your x-api key - Call the Get Accounts endpoint - Receive an HTTP 200 OK response with a list of your accounts. **Before you start** Make sure you have the following: - An **Investec Mauritius account** or optionally use the Sandbox - You have enrolled for Investec Developer on Investec Online (not required if using Sandbox) - You have your client_id and client_secret from Investec Online and have created an API key (see [Sandbox](#Sandbox) section for sandbox keys) - API key scopes include at least “accounts” (not required for Sandbox) - An API client such as Postman, Curl or your own application code. **Choose your environment** You can make your first call in either sandbox or production. The flow is identical. The Sandbox API will return mock data, and all actions can be run multiple times. Keep in mind that the sandbox is stateless and therefore, for example, balances won’t be updated when transfers are made in the sandbox. **Sandbox** Use this for development and testing. **Base API URL**: https://openapisandbox.investec.com **Production** Use this when you are ready to connect to your live account data. **Base API URL**:https://openapi.investec.com **Step 1: Get an access token** All Investec APIs use OAuth 2.0 with the client credentials grant type. The client_id and client_secret are combined and Base64 encoded to create the value used in the Authorization header as Basic {base64_value}. You must include: - HTTP Basic Auth (client_id:client_secret) - Your x-api key **Token request** ```bash curl --location 'https://openapisandbox.investec.com/identity/v2/oauth2/token' \ --header 'x-api-key: <>' \ --header 'Accept: application/json' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --header 'Authorization: Basic <>' \ --data-urlencode 'grant_type=client_credentials' ``` **What this does** - Authenticates your application - Returns a short-lived access token called a bearer token (valid for 30 minutes) - Confirms your credentials and API key are valid **Successful response example** ```json { "access_token": "qwertyuiop123456789", "token_type": "Bearer", "expires_in": 1799, "scope": "accounts" } ``` **Step 2: Get your accounts** Now that you have a token, you can call the accounts endpoint. **Sandbox** https://openapisandbox.investec.com/mu/pb/v1/accounts **Production** https://openapi.investec.com/mu/pb/v1/accounts **Request example** ```bash curl --location 'https://openapisandbox.investec.com/mu/pb/v1/accounts' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer <>' ``` **What a successful call looks like (HTTP 200 OK)** If everything is set up correctly, you will receive HTTP 200 OK and a JSON response containing your accounts. **Successful response example** ```json { "data": { "accounts": { "accounts": [ { "profileId": 9633, "profileName": "XYZ PTY LTD", "accountId": 5331, "accountName": "XYZ PTY LTD USD", "accountNumber": "10101010101", "accountCurrency": "USD" } ] } }, "links": { "self": "https://openapi.investec.com/mu/pb/v1/accounts" }, "meta": { "totalPages": 1 } } ``` This confirms that your authentication flow is working, your API key has the correct scopes, and you can successfully access account data. **Step 3: How to debug your first call** **Common issues on a first call** | Issue | Guidance | |-------|----------| | Token request fails | Ensure you are using HTTP Basic Auth and that the x-api-key is included | | 401 response | Check that your credentials are correct | | 403 response | Confirm your API key includes the `accounts` scope | # Sandbox

Sandbox access

**Base API URL**: https://openapisandbox.investec.com - To authenticate in the Sandbox environment, you are provided with a **client_id**, **client_secret**, and **x-api-key**. - The client_id and client_secret are combined and **Base64 encoded** to create the value used in the Authorization header as Basic {base64_value} — this encoded value is provided below for you. - The x-api-key is sent as a separate header, and the request will return an **access_token**. - The sandbox has the following scopes: - accounts - Account information - transactions - Transaction history - Follow the [Quickstart](#Quickstart(cURL)) instructions to get going using the Sandbox **Sandbox credentials** | Field | Value | |-------|--------| | client_id | `APg2xd3OxQbRWInH6RgCJS81xYFAkswe` | | client_secret | `vAphFxthiUBdBg70` | | x-api-key | `QVBnMnhkM094UWJSV0luSDZSZ0NKUzgxeFlGQWtzd2U6YVc1MlpYTjBaV010ZW1FdGNHSXRZV05qYjNWdWRITXRjMkZ1WkdKdmVBPT0`| | Authorisation | Basic `QVBnMnhkM094UWJSV0luSDZSZ0NKUzgxeFlGQWtzd2U6dkFwaEZ4dGhpVUJkQmc3MA==`|

# Release Notes

Description of API changes

2024-11-19 * **Enhancement**: Added balance endpoint 2024-08-19 * **Enhancement**: Added currency to accounts endpoint - this now returns the currency that an account is in 2024-08-07 * **Enhancement**: Added sandbox environment 2024-07-11 * **Enhancement**: Added account and transaction history endpoints 2025-06-11 * **Enhancement**: Added endpoints related to document retrieval such as downloading PDF statements.

MAU Open Banking