SDK

Please check our PHP SDK, it will help you to implement our API.

Our cookbooks

Please check our cookbooks, they will help you to understand our API.

API Server IP

If you are using a firewall, ensure that your server allow the traffic from the IP address below:

185.8.76.132

Making requests

End points

Anytime's apis provide a production endpoint and a sandbox endpoint that will allow you to test your apps with all methods

Production endpoint : ws.anyti.me

Sandbox endpoint : ws-sandbox.anyti.me

Protocol

The only allowed protocol is HTTPS.

Http verbs

As per RESTful design patterns, Anytime API implements the following HTTP verbs:

• GET - Read resources
• POST - Create new resources
• PUT - Modify existing resources
• DELETE - Remove resources

Authentication

Anytime API works with multiple security layers. Below we describe how to configure your credentials to access the API.

Generate a public and private RSA Key

The first step is to create a private RSA key with openssl. The key will be used to sign your request by passing the signature in a header parameter named. We will explain it in detail later in the documentation.

To generate the RSA key, open a terminal on your mac or linux server and type the following commands:

1. Generate the RSA key

   openssl genrsa -des3 -out id_rsa.pem 2048

   You will be asked to enter a pass phrase and verify it. Enter a strong password and remember it.

2. Export the public key

   openssl rsa -in id_rsa.pem -outform PEM -pubout -out id_rsa.pub

   Enter the pass phrase you set before and press enter. If the pass phrase is correct, the file "id_rsa.pub" is created containing your public key.

3. Export the private key

   openssl rsa -in id_rsa.pem -out id_rsa -outform PEM

   Enter the pass phrase you set before and press enter. If the pass phrase is correct, the file "id_rsa" is created containing your private key.

The next step is to send your public key to us in the anytime developer zone.

Allow servers IP/ranges

In the anytime developer zone, you have to specify the IP addresses allowed to connect the API. You can set ipv4 and ipv6 ip addresses or even an ipv4 or ipv6 subnet. For example, if the ipv4 of your server is 123.45.67.89, you have to add this IP address to the allowed IP to be able to perform API requests on it.

Build your first query

When the 2 previous steps are completed, you are able to make your first request. We have a quite simple API named apicheck that allow you to make a simple call to the API and get a 200 response if all is working fine. Please follow the steps below:

1. Call this URL

   curl "https://ws-sandbox.anyti.me/v1.0/apicheck" -X GET

   As we don't have yet a correct signature neither an oauth2 token, you should get a 401 error with the following message:

   Access denied. You have to provide valid authentication information.

2. Build signature and validation data

   The signature works by adding this two parameters in the http header of your HTTP request:

   X-Validation-Data

   X-Signed-Request

   First you have to choose the value of the a validation data by yourself. A good practice is to have at least something unique like a timestamp with float precision. You are free to add other data to make the signature more complicated.

   Note that a validation data can be used only one time. If you try to use the same one a second time, the API will reject you with a 401 code (ValidationDataAlreadyUsedException).

   X-Validation-Data: 1478508503.5145

   Now you have to build the signature:

   1. Compute an openssl signature using the X-Validation-Data string.
   2. Encode this signature using base64 algorithm

   Example with PHP:

   $xValidationData = sha1 (microtime ().rand (0, PHP_INT_MAX));
   $signature = '';
   
   if (!@openssl_sign($xValidationData, $signature, $rsaPrivateKey)) {
       die ('The provided RSA private key is invalid.');
   }
   
   $xSignedRequest = base64_encode ($signature);

   Please check our PHP SDK, it will help you to implement our API.

   Be carefull

   In PHP OPENSSL_ALGO_SHA1 is used as default algorithm by openssl_sign() and openssl_verify(). That means if you use an other language than PHP, make sure you use the correct signature algorithm.

   Here is an exemple for NodeJS:

   var crypto = require("crypto");
   var signer = crypto.createSign('SHA1');
   
   signer.update(X_Validation_data);
   var XSignedRequest = signer.sign(privateKey, 'base64');
                                   

3. Generate a token

   Once it's done, you still not able to use the API. You have to generate an OAuth2 token. To do that, just make a POST HTTP request to the following URL with the X-Validation-Data and X-Signed-Request parameters filled + the authentication information we provided to you in form-data parameter (client_id, client_secret, username, password) and also set the form-data parameter "grant_type" to "password".

   Example with curl:

   curl "https://ws-sandbox.anyti.me/oauth/v2/token" \
       -X POST \
       -H 'X-Validation-Data: string' \
       -H 'X-Signed-Request: string' \
       -d 'grant_type=password' \
       -d 'client_id=string' \
       -d 'client_secret=string' \
       -d 'username=string' \
       -d 'password=string'

   If your credentials and your signature are fine, you should receive a json response with your token:

   {
     "request_id": 90402,
     "type_response": "sync",
     "timestamp": 1478525194.6798,
     "hash": "a476623576b50ad3f2d49ae36d27b6f2e8876565e3232c04e49afeb831e1db0f",
     "body": {
       "access_token": "YOUR_TOKEN",
       "expires_in": 3600,
       "token_type": "bearer",
       "refresh_token": "YOUR_REFRESH_TOKEN"
     }
   }

4. Make your first valid request

   Now you can use the access token to make your requests on our API.

   Example with curl:

   curl "https://ws-sandbox.anyti.me/v1.0/apicheck" \
       -X GET \
       -H 'Authorization: Bearer YOUR_TOKEN' \
       -H 'X-Validation-Data: string' \
       -H 'X-Signed-Request: string'
   

   If everything is fine you should receive a json with the current date and time.

Response validation

The purpose is to certify the origin of the response retrieved from the API. The string is an sha256 hash algorithm applied on the string below:

timestamp|username

• Timestamp: The one displayed in the JSON response.
• Username: The one you use to create tokens.

Once you have computed the string, you can compare it with the hash string displayed in the json response. If the computed hash is not equals to the displayed hash, you can not trust the response.

Versioning

When you make a query, you have to specify which version of the API you want to use. The version is set in the URI like this:

https://ws.anyti.me/v<version>

So if you want to call the functionality "apicheck" for the 1.0 version of the API you have to call:

https://ws.anyti.me/v1.0/apicheck

Note that we are using <major>.<minor>.<bug-fix> version format but you have to specify only the major and minor part as for each incompatible changes we will create a new major or minor version.

Incompatible changes

• Add/Delete functionalities
• Modify the behaviour of existing functionalities (add/delete parameters, change ordering rules, add/delete properties, modify properties format
• Add/Modify/Delete error code
• Deprecate functionalities or parameters

HTTP status code

We use several HTTP status code. Each HTTP status code is extended by several sub-code to have a bigger panel of error code and make easy the errors management.

• 200 - OK

  The query succeeded.

• 400 - Bad Request

  This error will occur if some query/form-data/uri parameters are malformed or invalid.

  Code	Text code
  4000010	BadVersionFormatException
  4000011	VersionNotSupportedException
  4000050	DateStartGreaterThanDateEndFilterException
  4000210	AccountInvalidParameterException
  4000220	AccountIdenticalSrcAndDstAccountIdException
  4000230	AccountIbanAlreadyExistsException
  4000310	CardInvalidParameterException

• 401 - Unauthorized

  This error will occur if you supply wrong credentials/signature/not allowed IP.

  Code	Text code
  4010010	OAuth2AccessDeniedException
  4010020	OAuth2InvalidRequestException
  4010030	OAuth2InvalidClientException
  4010040	OAuth2InvalidGrantException
  4010050	OAuth2InvalidTokenException
  4010060	IpAddressNotAllowedException
  4010070	BadRsaSignatureException
  4010080	ValidationDataAlreadyUsedException

• 402 - Payment Required

  This error will occur when accounts or cards have not enough money to perform the operation.

  Code	Text code
  4020210	AccountSrcNotEnoughCreditException
  4020220	AccountBalanceTooLowException
  4020320	CardBalanceTooLowException
  4020321	CardBalanceTooHighException

• 403 - Unauthorized

  This error will occur if you try to access a resource you are not allowed to handle.

  Code	Text code
  4030020	SubEnvironmentAccessDeniedException
  4030030	FunctionalityNotAllowedException
  4030210	AccountIdNoRightsException
  4030211	AccountIdPartnerNoRightsException
  4030220	AccountIbanIncompleteKYCException
  4030212	AccountBadTypeException
  4030221	AccountIbanNotCreatedException
  4030310	CardAccountNoRightsException
  4030320	CardNotActivatedException
  4030330	CardLoadAmountTooLowException
  4030331	CardLoadAmountTooHighException
  4030350	CardCancelledNoActionException
  4030360	CardBadCardTypeException
  4030365	CardBadStatusUpdateException
  4030370	CardAccountCannotOrderVirtualCardsException
  4030380	CardGetPinBadCvcException
  4030390	CardUpdateCardUpdateMissingHolderDataException
  4030410	OrderIdNoRightsException

• 404 - Not Found

  This error will occur if the uri route is wrong.

  Code	Text code
  4040010	InvalidRouteException
  4040210	AccountStatementNotFoundException
  4040310	CardStatementNotFoundException
  4040410	OrderNoAvailableTrackingDataException

• 405 - Not Allowed

  This error will occur if the method used (GET/POST/PUT...) is not available for the called URI.

  Code	Text code
  4050010	MethodNotAllowedException

• 408 - Request Timeout

  This error will occurs if we are unable to execute your request within a specified time

  Code	Text code
  4080010	BankingNetworkTimeoutException

• 429 - Too Many Request

  This error will occur if you reach any limitation.

  Code	Text code
  4290010	MaxQueryRateByIpReachedException
  4290020	MaxQueryRateByFunctionalityReachedException
  4290030	MaxQueryRateByApiUserReachedException
  4290310	CardMaxLoadPerDayException
  4290311	CardMaxLoadPerMonthException
  4290312	CardMaxLoadPerYearException
  4290313	CardMaxLoadPerFourDaysException
  4290314	CardMaxLoadPerWeekException
  4290320	CardLoadCapacityException
  4290330	CardMaxAllowedOrderReachedException
  4290331	CardMaxAllowedOrderReachedForSubAccountException

• 451 - Unavailable for legal reason

  This error will occur if you try to do something forbidden for a specific.

  Code	Text code
  4510210	AccountCreditTransferKycUploadRequiredException
  4510310	CardCreditSingleUseUnavailableException
  4510320	CardOrderKycUploadRequiredException
  4510330	CardLoadKycUploadRequiredException

• 500 - Internal Server Error

  This error will occur if there is something wrong on our side.

  Code	Text code
  5000010	UnknownException

Rate limiting

We are limiting the max allowed request you can made. See below the limitation rules:

• By user or IP: Maximum 86.400 queries by day
• By functionality: Maximum 200 queries in 1 minute

If you reach the rate limit, you will get a 429 HTTP status code. (See HTTP status codes)

Note that the rate limiting is not enabled in the sandbox environment.

Webhooks

Our webhooks will send you updated data in realtime.

We will send you a json into the HTTP RAW DATA :

Card transactions

Send the card transactions processed.

{
    "request_id":109605,
    "type_response":"async",
    "body":
     {
       "method":"card_last_tx",
       "card_ref":"ANY0000000000",
       "acc_id":"xxx",
       "transaction":
         {
           "txid":"11111111111",
           "mcc":"5942",
           "amount":98.32,
           "amount_fx":98.32,
           "currency":"EUR",
           "fx":"1.000000",
           "fx_fee":0,
           "status":"S",
           "type":"D",
           "balance_after":"0.00",
           "date":"2017-02-02 14:14:48",
           "description":"FNAC DIRECT - RUE DES BATEAUX LAVOIRS, IVRY SUR SEIN,94768,FRA,FRA"
         }
     },
    "timestamp":"1483365005",
    "hash":"[HASH]"
}

Credit transfers

Send the credit transfers status update.

The json contains a list of 1 to maximum 100 credit transfers.

The updated status can changes from "In progress" to "Cancelled" or "Executed".

{
    "request_id":109605,
    "type_response":"async",
    "event_name":"credit_transfer_processed",
    "body": {
      "credit-transfers":[
         {
            "internal_id": 50000,
            "sender_account_id": 1234,
            "sender_account_type": "business",
            "creation_date": "2020-10-23T11:04:03+02:00",
            "request_date": "2020-10-23",
            "execution_date": "2020-10-23",
            "execution_reference": "123456789123",
            "transaction_type": "ct",
            "beneficiary_name": "John Smith",
            "beneficiary_iban": "NL86ABNA1666412472",
            "beneficiary_swift_code": "ABNCNL2A",
            "reason": "Beneficiary communication message",
            "status": "Executed",
            "amount": "155.00",
            "currency": "EUR"
         },
         {...},
         {...}
      ]
    }
    "timestamp":"1483365005",
    "hash":"[HASH]"
}

Create a new oauth2 token. When you create a new token the previous one will be automatically obsolete.

/oauth/v2/token

Check that the API connection succeed with correct credentials and RSA public key

/v1.0/apicheck

apicheck-apicheckpost-description

/v1.0/apicheck

Retrieve the account list

/v1.0/accounts

Create a new account, either business or individual. A cardholder must be specified for each account type.

/v1.0/accounts

Retrieve a specific account information

/v1.0/accounts/{id}

Update account informations

/v1.0/accounts/{id}

Retrieve the balance of the current account

/v1.0/accounts/{id}/balance

Retrieve the cards list of an account

/v1.0/accounts/{id}/cards

Retrieve the statements list of an account

/v1.0/accounts/{id}/statements

Retrieve a specific account statement

/v1.0/accounts/{id}/statements/{txid}

Retrieve the iban statements list of an account

/v1.0/accounts/{id}/iban-statements

Retrieve credit transfers list

/v1.0/accounts/{id}/credit-transfers

Create a credit transfer

/v1.0/accounts/{id}/credit-transfers

Download a credit transfer testimonial PDF. You can only download testimonial for executed credit transfers.

/v1.0/accounts/{id}/credit-transfers/{ctid}/testimonial

Get a list of uploaded KYC and their status.

/v1.0/accounts/{id}/kyc

Upload KYC files. You have to fill at least one parameter.

/v1.0/accounts/{id}/kyc

Create an IBAN for this account

/v1.0/accounts/{id}/iban

Create a virtual IBAN for this account

/v1.0/accounts/{id}/virtual-ibans

Order a new Visa or Mastercard payment card. Beware, virtual cards can't be ordered by a "consumer" account type.

/v1.0/cards

Retrieve information on this payment card

/v1.0/cards/{card_ref}

Update card info

/v1.0/cards/{card_ref}

Get all cards transactions

/v1.0/cards/{card_ref}/transactions

Get transaction details of a specific transaction

/v1.0/cards/{card_ref}/transactions/{txid}

As the transaction is not processed instantly, the response you get is not the final response containing the transaction information. This one will be sent asynchronously to the webhook you have defined in your API account configuration. For more details about the response format please check the webhook section in the API documentation.

/v1.0/cards/{card_ref}/credit

As the transaction is not processed instantly, the response you get is not the final response containing the transaction information. This one will be sent asynchronously to the webhook you have defined in your API account configuration. For more details about the response format please check the webhook section in the API documentation.

/v1.0/cards/{card_ref}/debit

Get pin code of a card

/v1.0/cards/{card_ref}/pin

Text new pin to cardholder

/v1.0/cards/{card_ref}/pin