BTG Pactual Banking — API Integration & Open Finance Solutions

1. OAuth 2.0 Authorization (Open Finance Brasil / FAPI 1.0)

// Step 1: Authorization request (FAPI 1.0 / PKCE)
GET https://auth.btgpactual.com/oauth2/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &scope=accounts+transactions+credit-cards
  &code_challenge=BASE64URL(SHA256(code_verifier))
  &code_challenge_method=S256
  &state=RANDOM_STATE

// Step 2: Exchange code for access token
POST https://auth.btgpactual.com/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTH_CODE
&redirect_uri=https://yourapp.com/callback
&code_verifier=CODE_VERIFIER
&client_id=YOUR_CLIENT_ID

// Response
{
  "access_token": "eyJhbGc...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "dGhpcyB...",
  "scope": "accounts transactions credit-cards"
}

2. Account Balance & Transaction History Query

// Fetch account balance (Open Finance Brasil Phase 2)
GET /open-banking/accounts/v2/accounts/{accountId}/balances
Authorization: Bearer <ACCESS_TOKEN>
x-fapi-auth-date: Tue, 22 Apr 2025 08:00:00 GMT
x-fapi-customer-ip-address: 203.0.113.0
x-fapi-interaction-id: <UUID>

// Response
{
  "data": {
    "availableAmount": "4850.32",
    "blockedAmount": "0.00",
    "automaticallyInvestedAmount": "12345.67",
    "currency": "BRL",
    "updateDateTime": "2025-04-22T09:00:00Z"
  }
}

// Fetch Pix + TED transaction history
GET /open-banking/accounts/v2/accounts/{accountId}/transactions
  ?fromBookingDateTime=2025-03-01T00:00:00Z
  &toBookingDateTime=2025-03-31T23:59:59Z
  &page=1&page-size=50
Authorization: Bearer <ACCESS_TOKEN>

// Response (one item)
{
  "transactionId": "TXN-2025-03-15-0042",
  "completedAuthorisedPaymentType": "PIX",
  "creditDebitType": "DEBITO",
  "transactionName": "Pagamento Fornecedor",
  "type": "PIX",
  "amount": "1200.00",
  "currency": "BRL",
  "bookingDate": "2025-03-15",
  "pixEndToEndId": "E30306294...",
  "counterpartyName": "ACME Ltda",
  "counterpartyCPFCNPJ": "12.345.678/0001-99"
}

3. Credit Card Statement Export

// Fetch card invoice (closed cycle)
GET /open-banking/credit-cards-accounts/v2
    /accounts/{creditCardAccountId}/bills
  ?fromDueDate=2025-03-01
  &toDueDate=2025-04-01
Authorization: Bearer <ACCESS_TOKEN>

// Response
{
  "billId": "BILL-2025-03",
  "dueDate": "2025-04-10",
  "billTotalAmount": "3478.90",
  "billMinimumAmount": "347.89",
  "currency": "BRL",
  "isInstalment": false,
  "transactions": [
    {
      "transactionId": "CARD-TX-001",
      "transactionName": "UBER DO BRASIL",
      "creditDebitType": "DEBITO",
      "transactionType": "COMPRA_A_VISTA",
      "transactionalAdditionalInfo": "MCC:4121",
      "amount": "45.90",
      "currency": "BRL",
      "transactionDate": "2025-03-08",
      "chargeIdentificator": "2025030800042"
    }
  ]
}

// Error handling
// HTTP 401 → token expired → refresh via refresh_token grant
// HTTP 429 → rate-limited → back-off 60s, retry with x-fapi-interaction-id
// HTTP 403 → consent revoked → re-initiate consent flow

Open Finance Brasil & BACEN Regulation

BTG Pactual Banking participates in Brazil's Open Finance Brasil ecosystem, governed by Resolução BCB nº 32/2020 (later updated by Resolução CMN nº 4.949/2021) issued by the Banco Central do Brasil (BACEN). This regulation mandates that participating financial institutions expose standardized APIs for account data, transaction history, and payment initiation — with explicit user consent. BTG Pactual Empresas completed conformance testing under Open Finance Brasil Functional v2.0 (payments, January 2023), confirming the bank's API compliance posture.

All integrations we deliver follow the FAPI 1.0 security profile (Financial-grade API), which requires mTLS client authentication, PKCE for authorization code flows, and signed request objects (JAR). This aligns with the technical security requirements mandated by BACEN for Open Finance participants.

LGPD Data Protection

Brazil's Lei Geral de Proteção de Dados (LGPD, Law nº 13.709/2018) — Brazil's equivalent of GDPR — governs all personal data processed in connection with BTG Pactual Banking integrations. Key obligations include a lawful basis for data processing (typically explicit user consent), data minimization (requesting only the scopes necessary for the use case), and a defined data retention and deletion policy.

Our deliverables include compliance guidance on LGPD-aligned consent management: how to record the user consent event (with timestamp, scope granted, and consentId), how to handle consent revocation via the Open Finance Brasil Consent API (DELETE /consents/{consentId}), and data-retention ceilings aligned with BACEN's audit-history requirements (typically 5 years for financial records).

About Our Studio

We are an independent technical service studio specializing in app interface integration and authorized API integration for global clients. Our team brings years of hands-on experience in mobile applications and fintech, covering the full pipeline from protocol analysis and interface refactoring to Open Finance integration, third-party API delivery, and automated data scripting.

• Deep expertise in Brazilian Open Finance (BACEN, LGPD, FAPI 1.0) and Latin American fintech ecosystems
• End-to-end delivery: protocol analysis → API design → build → validation → compliance guidance
• Support for both Android and iOS platforms; deliverables in Python, Node.js, or Go
• Custom SDK, test harnesses, and OpenAPI / Swagger documentation included
• Source code delivery from $300 — receive runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted API endpoints and pay only for calls made; no upfront cost; ideal for usage-based pricing

Contact Us

To request a quote, submit your target app and requirements, or ask a technical question, please visit our contact page. We respond within one business day and can provide a scoping estimate for BTG Pactual Banking integration within 48 hours.

Contact page →

After initial contact we will confirm scope, timeline, and pricing before any work begins. No payment is required upfront for source code delivery engagements.

Deliverables Checklist

• API specification (OpenAPI 3.0 / Swagger) for all integrated endpoints
• Protocol and auth flow report: OAuth 2.0 / FAPI 1.0 consent chain, token lifecycle, mTLS setup
• Runnable source code for account login, balance, transaction, card statement, and investment APIs (Python / Node.js)
• Automated integration test suite with real-response fixtures
• Compliance guidance memo: LGPD consent management, BACEN data-retention requirements, consent revocation flow
• Inline code documentation and a quick-start integration guide

Engagement Workflow

1. Scope confirmation: You describe your integration goals (e.g. ERP reconciliation, PFM, credit scoring) and we confirm which BTG Pactual data endpoints are required.
2. Protocol analysis & API design (2–4 business days): We map the target flows, design the OAuth consent journey, and draft the OpenAPI spec.
3. Build & internal validation (3–7 business days): We implement and test the integration against live or sandbox environments.
4. Documentation & test cases (1–2 business days): We finalize docs, sample payloads, and error-handling guidance.
5. Delivery & handover: Source code delivered; you review and confirm before payment (source code model).

Typical first delivery: 6–13 business days. Third-party consent-flow approvals or sandbox access provisioning may extend timelines.