enable-banking-api

Enable Banking API

Purpose

Provides domain knowledge about the Enable Banking Open Banking API — endpoints, authentication, session lifecycle, transaction structure, rate limits, and supported Danish banks. Reference this when orchestrating tools/eb-api.py for API-based transaction sync.

API Overview

Enable Banking provides PSD2-compliant access to bank account data across 2,500+ European banks. SmartSpender uses it as an alternative to browser automation for faster, more reliable transaction sync.

• API Base URL: https://api.enablebanking.com
• Authentication: JWT signed with RSA private key (PS256 algorithm)
• Data Format: JSON, ISO 20022 inspired field names
• Rate Limit: Max 4 account information requests per day per account (PSD2 regulation)

Authentication

JWT Structure

The eb-api.py helper handles JWT generation. Conceptually:

• Issuer: enablebanking.com
• Audience: api.enablebanking.com
• Algorithm: PS256 (RSA-PSS with SHA-256)
• Expiry: 1 hour from creation
• Payload: includes app_id from config

Config File

Stored at ~/.config/smartspender/eb-config.json:

{
  "app_id": "your-application-id",
  "key_path": "~/.config/smartspender/private.pem"
}

Session Lifecycle

Consent Flow

1. Initiate: eb-api.py auth --bank <name> sends POST to /auth with ASPSP details and redirect URL (https://smartspender.mentilead.com/callback.html)
2. MitID: User authenticates in browser (auto-opened)
3. HTTPS Relay: Bank redirects to callback.html which forwards code to http://localhost:19876/callback
4. Capture: Localhost listener on port 19876 catches the authorization code
5. Session: Code exchanged for session_id via POST to /sessions
6. Active: Session provides access to account data for 90-180 days

Session States

State	Meaning	Action
active	Consent valid, API accessible	Proceed with sync
expired	Consent period ended	Re-run auth for new consent
revoked	Bank-side revocation	Re-run auth
no_session	No session file exists	Run setup + auth