Permissions define what data can be accessed through an authorised consent. Request only the permissions you need - customers are more likely to approve minimal, relevant permissions.
| Permission | Data Access |
|---|---|
ReadAccounts | Account numbers, names, types, currency |
ReadBalances | Current and available balances |
ReadTransactions | Transaction history with payee info |
ReadStatements | Account statements |
ReadParty | Account holder name and contact details |
Each data endpoint needs the matching permission on the consent, which the customer approved when they authorised it:
| Permission | Endpoints |
|---|---|
ReadAccounts | GET /v1/accounts, GET /v1/accounts/{account_id} |
ReadBalances | GET /v1/accounts/{account_id}/balances |
ReadTransactions | GET /v1/accounts/{account_id}/transactions |
ReadStatements | GET /v1/accounts/{account_id}/statements, GET /v1/accounts/{account_id}/statements/{statement_id}, GET /v1/accounts/{account_id}/statements/{statement_id}/file |
ReadParty | GET /v1/party, GET /v1/accounts/{account_id}/party |
If the consent doesn't include the permission an endpoint needs, the call returns 403; create a new consent that includes it.
Include the permissions array when creating a consent:
{
"permissions": ["ReadAccounts", "ReadBalances", "ReadTransactions"]
}
Bank Support Varies
Not all banks support all permissions: statements in particular are available at some banks only (see Bank Coverage). A redirect or decoupled consent that requests a permission the bank doesn't offer is rejected with 400; in the Gateway Flow the check happens when the customer chooses their bank. Use the metadata endpoint (GET /v1/meta) to check feature availability before requesting permissions.
Returns account identifiers and basic details:
Returns balance information:
Returns transaction history:
Use from_booking_date_time and to_booking_date_time parameters to filter by date range.
Returns account statements, a single statement, and the statement file. Available at some banks only (see Bank Coverage, or features.statements in GET /v1/meta).
Returns account holder information: