Overview

Banklink API v1

The Banklink v1 API lets you list linked bank accounts, retrieve transactions, check balances, trigger syncs, and create hosted link or access requests.

A link request creates a reusable bank profile and stores encrypted bank credentials. Set save_data to control whether its first fetch is also saved in Banklink. An access request performs one configured fetch and delivery; Banklink never stores that customer’s credentials or transactions.

Verification

Live link and access requests need a verified link profile: your name, logo, website domain, privacy policy and privacy contact, shown to the customer on the hosted consent screen. Verify in the dashboard (Link Requests → Branding & verification) by proving you control the domain and disclosing Banklink in your privacy policy, or by requesting a manual review. Until then these endpoints return 403 org_not_verified. Live webhook and redirect URLs must be https on your verified domain. See https://banklink.co.za/resources/verify-organisation-link-requests.

Webhooks

Webhook deliveries (link requests, access requests and Pulses) are signed. Each carries Banklink-Signature: t=<unix>,v1=<hex>, where v1 is an HMAC-SHA256 of {t}.{raw body} keyed with your webhook signing secret (dashboard → Settings → Webhook signing). Verify against the raw body, compare in constant time, and reject timestamps older than five minutes. During the 24 hours after a secret rotation the header carries two v1 values; accept either. Banklink-Delivery is a unique id per delivery and Banklink-Event names the event. The SDKs ship constructWebhookEvent / construct_event helpers. See the webhooks section for payloads.

All endpoints require a Bearer API key in the Authorization header. Successful responses are wrapped in a { "data": ... } envelope. Errors use { "error": { "code", "message" } }. List endpoints additionally include a "cursor" field for pagination.

Sandbox (test mode)

Every endpoint has a sandbox on the same base URL. Create a test key (sk_test_...) in the dashboard and use it exactly like a live key — requests are served from a synthetic per-organisation dataset, never touch a real bank, and are never billed.

GET /accounts returns two seeded accounts with ~90 days of generated transactions.
POST /accounts/{id}/sync appends 1–3 new synthetic transactions.
POST /link-requests and POST /access-requests create synthetic hosted links. They work before your organisation is verified, show your current branding, and their webhook/email deliveries are simulated and never sent. redirect_url may also be http://localhost.
POST /link — any credential field equal to "fail" returns a credential error; anything else links a new synthetic account.
POST /sandbox/reset wipes and re-seeds your sandbox.

Information

OpenAPI version: 3.1.0

Authentication

bearerAuth

API key from the Banklink dashboard. An sk_live_... key runs against real bank integrations and consumes credits; an sk_test_... key runs against the sandbox (synthetic data, unbilled) on the same base URL.

Security scheme type: http