BoursoBank API integration services (PSD2 / OpenFinance)

Deliverables checklist

• OpenAPI / Swagger specification for every endpoint we expose
• Protocol and auth-flow report covering OAuth, SCA, cookie chain and CSRF tokens
• Runnable source code in Python and Node.js (CLI plus REST microservice)
• Postman / Insomnia collection and pytest / Jest test suites
• Compliance pack: PSD2 consent template, GDPR data-minimization notes, retention guidance
• One technical handover session and 30 days of fix-bug warranty after delivery

Engagement models

Two ways to work with us, both free of upfront commitment:

• Source-code delivery from $300 — we hand over runnable code and documentation; you pay only after acceptance testing on your own sandbox.
• Pay-per-call hosted API — call our managed BoursoBank endpoints with metered billing; ideal for early-stage products that prefer usage-based pricing over a one-off build.

1. Accounting & expense automation

Freelancers and SMEs banking with BoursoBank ship transactions to Pennylane, QuickBooks or Sage in near-real time. We pull movements through a PSD2 AIS aggregator, normalize merchant strings, attach the matching PDF statement from the document vault, and post-process for VAT category. The OpenFinance angle: the same pipeline merges BoursoBank movements with Hello bank! or Fortuneo data so the customer sees a single ledger.

2. Wealth dashboard for retail investors

BoursoBank is a brokerage as much as a bank: PEA, CTO, life insurance, PERin and crypto ETPs all live in the same app. We expose a unified /portfolio endpoint that returns positions, NAV, and 24-month performance series, mapping each instrument to its ISIN. Clients use it for client-facing dashboards, performance attribution and risk reporting against the EBA OpenFinance roadmap.

3. Treasury & multi-bank cash position

Corporates with several banking relationships pull balances from BoursoBank alongside BNP Paribas, Crédit Mutuel and Société Générale. Our scheduled job calls GET /accounts and GET /accounts/{id}/balances every fifteen minutes through the aggregator and pushes a normalized payload into the company's ERP. The OpenBanking AIS scope keeps the flow read-only and within PSD2 boundaries.

4. Payment initiation (PIS) for B2C apps

Marketplaces and SaaS billing tools trigger SEPA Instant transfers from a BoursoBank account using PSD2 Payment Initiation. The user redirects to BoursoBank's SCA challenge, confirms the payment, and the merchant receives a webhook with the SEPA instant settlement reference. We deliver the consent flow, idempotency keys, and reconciliation job that ties back the incoming credit on the merchant IBAN.

5. Cashback & loyalty enrichment

The Corner, BoursoBank's cashback hub, links 140+ partner brands inside the secure banking session. We extract cashback events and pair them with the matching outbound transaction, so partners can attribute spend, validate vouchers and feed loyalty engines. The same enriched stream powers personal-finance apps that show effective post-cashback spend.

Authorize an account-holder consent

POST /api/v1/boursobank/consent
Content-Type: application/json
X-Request-ID: 6f1c-...

{
  "psu_id": "client@example.com",
  "scope": ["accounts", "balances", "transactions"],
  "valid_until": "2026-07-30",
  "frequency_per_day": 4,
  "redirect_uri": "https://app.example.com/callback"
}

200 OK
{
  "consent_id": "csnt_01HZ...",
  "auth_url": "https://auth.boursorama.com/oauth2/authorize?...",
  "expires_at": "2026-05-01T12:30:00Z",
  "sca_method": "app_to_app"
}

Fetch transactions for a date range

GET /api/v1/boursobank/accounts/{account_id}/transactions
  ?from=2026-04-01&to=2026-04-30&booking_status=both
Authorization: Bearer <ACCESS_TOKEN>
Consent-ID: csnt_01HZ...

200 OK
{
  "account_id": "FR76 4061 8...",
  "currency": "EUR",
  "transactions": {
    "booked": [
      {
        "transaction_id": "tx_77a1",
        "value_date": "2026-04-08",
        "amount": {"value": "-42.10", "currency": "EUR"},
        "remittance_information": "MONOPRIX PARIS 13",
        "mcc": "5411",
        "category": "groceries"
      }
    ],
    "pending": []
  },
  "_links": {"next": "?cursor=eyJv..."}
}

Webhook: SEPA Instant credit on merchant IBAN

POST https://merchant.example.com/hooks/boursobank
X-Signature: sha256=...
Content-Type: application/json

{
  "event": "payment.credit.settled",
  "occurred_at": "2026-05-01T09:14:22Z",
  "payment_id": "pay_3c91",
  "creditor_iban": "FR76 ...",
  "debtor_iban_hash": "sha256:1f...",
  "amount": {"value": "129.00", "currency": "EUR"},
  "scheme": "SEPA_INST",
  "end_to_end_id": "ORDER-2026-91823"
}

# Verify X-Signature with HMAC-SHA256(shared_secret)
# Reply 2xx within 5s; we retry with exponential backoff up to 24h.

Regulatory framework

BoursoBank is a French credit institution authorized by the Autorité de Contrôle Prudentiel et de Résolution (ACPR) and supervised by the Banque de France. Any third party that touches account data must respect the EU revised Payment Services Directive (PSD2), the EBA Regulatory Technical Standards on Strong Customer Authentication, and the GDPR. For the broader OpenFinance landscape we also track the upcoming PSD3 / PSR proposal and the EU Financial Data Access framework.

How we apply it

• All AIS calls go through aggregators holding an ACPR licence (Bridge, Powens, Tink, TrueLayer, Nordigen, Enable Banking) or through documented user-export flows.
• SCA is never bypassed; consents are renewed every 90 days as required by the EBA RTS.
• Personal data is minimized at source — we drop fields the client does not need before any storage.
• Encryption at rest (AES-256) and in transit (TLS 1.2+), with audit logs retained for 12 months.
• Customer-side data subject rights (access, rectification, erasure) are wired into every deliverable.

Hello bank!

BNP Paribas' digital subsidiary in France. Holds current-account, card and savings data through PSD2 AIS, and is a frequent counterparty in multi-bank cash positioning alongside BoursoBank.

Fortuneo

Crédit Mutuel Arkéa's online bank with around 1.2 million clients, strong on brokerage and PEA. Users with both Fortuneo and BoursoBank usually want a unified portfolio export across the two brokers.

Monabanq

Crédit Mutuel Alliance Fédérale's online bank. Account, savings and card transactions are typical inputs to a single SME ledger that also pulls BoursoBank movements.

Nickel

BNP Paribas-owned neobank distributed via tobacconists. Holds prepaid card and basic-account data; useful for unbanked-segment products that need to merge Nickel and BoursoBank movements.

Revolut

European neobank with multi-currency wallets, cards and stock trading. Frequently aggregated with BoursoBank for cross-border spend analytics and FX exposure reports.

N26

German neobank popular with French expats. Account and transaction data follow Berlin Group NextGenPSD2 and slot directly into the same normalized model we use for BoursoBank.

Wise

Multi-currency account and FX rails. Customers often need transfer events from Wise tied back to a EUR settlement leg in their BoursoBank current account.

Lydia / Sumeria

French peer-to-peer payments app with around 8 million users, now expanding into Sumeria, a full digital banking brand. Wallet and P2P transfer data complement BoursoBank ledger data nicely.

BforBank

Crédit Agricole's online bank, with savings, brokerage and life-insurance offers. Same AIS surface area as BoursoBank, often consolidated in wealth dashboards.

Orange Bank

Mobile-operator-led bank that had a strong card and account product in France. Listed here because legacy Orange Bank customers still ask for transaction history exports alongside their newer BoursoBank account.

About us

OpenFinance Lab is an independent studio focused on mobile-app protocol analysis and OpenData / OpenFinance pipelines. The team mixes engineers from European retail banks, payment institutions, brokerage platforms and fintech aggregators. We have shipped production integrations for AIS, PIS, statement export, brokerage portfolios and life-insurance positions across France, the UK, Singapore and the UAE.

• Daily banking, brokerage, insurtech and cross-border clearing
• Enterprise API gateways, SCA orchestration, security reviews
• Custom Python, Node.js and Go SDKs with reproducible test fixtures
• Full pipeline: protocol study, build, internal validation, compliance pack
• Source-code delivery from $300 with pay-on-acceptance
• Pay-per-call hosted API with no upfront commitment

Contact

Send us your target app, the data you need and any sandbox credentials you already hold. We will reply with a scoped quote and an indicative timeline within one business day.

Contact page

Engagement workflow

1. Scope confirmation: which BoursoBank surfaces (accounts, transactions, brokerage, PIS) and which downstream system.
2. Protocol analysis and aggregator selection (Bridge, Powens, Tink, TrueLayer, Nordigen) — 2 to 5 business days.
3. Build and internal validation against a real test account — 3 to 8 business days.
4. Documentation, sample requests and pytest / Jest test cases — 1 to 2 business days.
5. Handover, 30-day fix-bug warranty, and an optional retainer for new endpoints.

FAQ

Does BoursoBank expose a public developer API?

What data can I extract from a BoursoBank account?

How long does delivery take?

How do you stay compliant with French and EU rules?