CA+ API integration services (Credit Agricole Ukraine · OpenBanking)

1. Authentication & session

Replicates the CA+ registration path — phone number plus card number or tax code (РНОКПП) — and the per-session login choice between biometrics, PIN, and password. Sessions refresh on a rolling token, so long-running automations stay valid without storing credentials in plain text.

2. Card & IBAN balances

Returns multi-currency balances per card and per IBAN account, including authorisation holds and the available limit on credit cards. Useful for treasury dashboards that consolidate UAH, USD, and EUR positions across several Ukrainian banks.

3. Transaction history & categories

Streams entries from the CA+ history thread with the original category labels (groceries, transport, utilities, salary, FX, transfers). Supports date-range filters, merchant filters, and incremental sync via cursor — purpose-built for bookkeeping and personal-finance categorisation engines.

4. IBAN & peer-to-peer transfers

Initiates fee-free transfers between Crédit Agricole accounts and instant IBAN transfers within the bank (the feature added in 2024). Works for both card-to-card and IBAN-to-IBAN flows, with idempotency keys that prevent accidental duplicate payments in batch runs.

5. Currency exchange & FX events

Reads the in-app currency exchange feature: rate snapshots at execution time, source and destination card, and resulting balance impact. Suitable for FX P&L reports and audit trails when converting USD/EUR/UAH inside CA+.

6. Mobile savings, deposits & loans

Pulls open positions on mobile savings (with the published yearly rate, up to 8%), term deposits, and any active loans or credit-card eligibility checks. Returns accrued interest and maturity dates for downstream forecasting.

A. SME accounting sync (BAS, M.E.Doc, 1C)

Business context: Ukrainian SMEs that hold their operating account in Credit Agricole still re-key statements into BAS, M.E.Doc, or 1C. Data involved: IBAN balance, daily transaction list, FX events, scheduled payments. OpenData mapping: account information service (AIS) under the NBU framework, with read-only consent renewed every 180 days, and ISO 20022 camt.053-style daily statements pushed to the customer's accounting suite.

B. Personal finance & budgeting tools

Business context: PFM apps that aggregate Privat24, Monobank, Sense SuperApp, and CA+ in one view. Data involved: card balances, transaction stream with CA+ categories, mobile savings yield. OpenFinance mapping: a single user-consented connector that delivers categorised transactions and recurring-spend detection without storing the user's CA+ password — only short-lived session tokens are kept.

C. Cross-border treasury for Polish/French parent groups

Business context: groups with subsidiaries in Ukraine often need to consolidate Crédit Agricole Ukraine balances with Crédit Agricole Polska (CA24 Mobile) and the parent CA SA accounts in France. Data involved: end-of-day IBAN balance, FX rates, intercompany transfers. OpenBanking mapping: combined PSD2 (EU side) and NBU (Ukraine side) AIS calls, normalised into a single multi-entity view.

D. AML & compliance monitoring

Business context: regulated entities and crypto on-/off-ramps must monitor inflows and outflows on Ukrainian bank accounts. Data involved: transaction stream, beneficiary IBAN, narrative, MCC codes when present. OpenData mapping: streaming webhook from a TPP gateway into the customer's AML engine, with the NBU's encryption and data-retention rules applied at every hop.

E. Loan origination & credit decisioning

Business context: Ukrainian fintechs offering BNPL or microloans want a 90-day income proof from CA+ without manual PDF uploads. Data involved: salary inflows, balance trajectory, FX activity, credit-card utilisation. OpenFinance mapping: a one-shot AIS consent that delivers a redacted statement to the lender's underwriting engine, scored and discarded after the decision per data-minimisation rules.

Login & session refresh

// Authorise a CA+ session via our adapter
POST /api/v1/caplus/auth/login
Content-Type: application/json
X-TPP-Id: tpp_demo_01

{
  "phone": "+380XXXXXXXXX",
  "factor": "card_number",      // or "tax_code"
  "card_number": "4149XXXXXXXX1234",
  "device_fingerprint": "dvc_8f2..."
}

// Response (truncated)
{
  "session_id": "ses_01HRZ...",
  "expires_in": 600,
  "next_step": "otp_required",
  "challenge_id": "chl_01HRZ..."
}

Statement query (history thread)

POST /api/v1/caplus/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "iban": "UA213996220000026XXXXXXXXXXXXX",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "currency":  "UAH",
  "page_cursor": null
}

// Response (item)
{
  "id": "txn_01HS...",
  "posted_at": "2026-03-14T08:21:11Z",
  "amount": -245.50,
  "currency": "UAH",
  "category": "groceries",
  "merchant": "ATB-Market",
  "card_last4": "1234"
}

Webhook: balance & OTP events

POST https://your-app.example/webhook/caplus
X-Signature: sha256=...

{
  "event": "balance.changed",
  "iban":  "UA21399622...",
  "card_last4": "1234",
  "delta": -245.50,
  "currency": "UAH",
  "occurred_at": "2026-03-14T08:21:12Z"
}

// Error envelope (consistent across endpoints)
{
  "error": {
    "code": "consent_expired",
    "message": "AIS consent expired; user must re-authorise.",
    "doc": "/docs/errors#consent_expired"
  }
}

Deliverables checklist

• API specification (OpenAPI 3.1 / Swagger)
• Protocol & auth flow report (CA+ session, OTP, trusted-device)
• Runnable adapter source: Python & Node.js (Go on request)
• Sample data fixtures, Postman collection, and contract tests
• NBU open banking compliance notes & data-retention guidance
• Optional hosted endpoints with pay-per-call billing

Engagement workflow

1. Scope confirmation: which CA+ surfaces and which downstream targets.
2. Protocol analysis & API design (2–5 business days, complexity-dependent).
3. Build and internal validation (3–8 business days).
4. Docs, samples, contract tests, and compliance notes (1–2 business days).
5. Typical first delivery: 5–15 business days; NBU TPP onboarding may extend the timeline.

About us

We are an independent technical service studio specialising in App interface integration and authorized API integration. Our team has a decade of hands-on experience in mobile applications and fintech, with engineers who have shipped open banking adapters across the EU PSD2 perimeter and now in Ukraine under the NBU framework. We deliver one-stop services across protocol analysis, interface refactoring, OpenData integration, and third-party API integration.

• Service scope: financial & banking apps, e-commerce, hotel/travel/mobility, social/OTT/dating apps
• Deliverable type: ready-to-use API source code, OpenAPI docs, test plans
• Coverage: Android and iOS protocol analysis, server-side reconstruction
• Compliance: NBU open banking, EU PSD2, GDPR, internal audit-ready logs

Two engagement models:

• Source code delivery from $300 — runnable API source code and full documentation; pay after delivery upon satisfaction.
• Pay-per-call API billing — access our hosted API endpoints and pay only for the calls you make, no upfront fee.

Contact

To request a quote, share the target app and your concrete data needs (e.g. statement export, IBAN transfers, balance webhooks). We reply with scope, timeline, and a fixed price for the source-code option or a per-call rate for the hosted option.

Open contact page →

We sign NDAs on request and operate under documented customer authorisation only. We do not perform unauthorised access or work that bypasses bank security controls.