i-ONE Bank API integration services (KRW / MyData / OpenBanking)

Deliverables checklist

• OpenAPI 3.1 specification covering login, balance, statement, transfer and MyData endpoints
• Protocol and authentication report — token chain, device-binding, certificate pinning, root-detection signals
• Runnable source for Python, Node.js or Go (your choice) with retry, idempotency and webhook receivers
• Pytest / Jest integration tests against an IBK or KFTC sandbox profile
• PIPA-aligned data-handling guide: consent text, retention windows, deletion endpoints

API example: statement query (pseudocode)

POST /api/v1/ibk/ione/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>
X-Consent-Id: 8c2f1a-mydata-2026

{
  "account_no": "010-12345-67-890",
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "tran_type": "ALL",
  "page": 1,
  "page_size": 50
}

200 OK
{
  "account_no": "010-12345-67-890",
  "currency": "KRW",
  "balance_after_last_tran": 5320140,
  "items": [
    {"tran_dt":"2026-04-29T11:21:03+09:00","amount":-12500,"counterparty":"GS25","memo":"Convenience","balance":5320140},
    {"tran_dt":"2026-04-28T18:02:11+09:00","amount":1800000,"counterparty":"PAYROLL","memo":"Salary","balance":5332640}
  ],
  "next_page": null
}

API example: KFTC-style transfer (pseudocode)

POST /api/v1/ibk/ione/transfer
Authorization: Bearer <ACCESS_TOKEN>
Idempotency-Key: 6f3b8d-2026

{
  "from_account": "010-12345-67-890",
  "to_bank_code": "088",
  "to_account":   "110-9876-5432-10",
  "amount":       50000,
  "memo_to":      "Rent April",
  "memo_from":    "Rent April",
  "biometric_token": "fido2:ey..."
}

201 Created
{
  "tran_id": "IBK20260504-9981",
  "status":  "COMPLETED",
  "fee":     0,
  "kftc_ref":"KFTC-2026050412345"
}

1. Cross-border payroll reconciliation

A Seoul-based subsidiary of a multinational pays staff in KRW from an IBK corporate sub-account. Our connector calls the statement endpoint each morning, matches each tran_id against the parent ERP's payroll batch and posts a reconciliation row. Maps to KFTC Open Banking inquiry APIs — the same rail that exposes balances and history across all 18 Korean banks.

2. SME accounting sync

An SME using a SaaS bookkeeping product wants daily auto-import of i-ONE Bank deposit history. The integration polls the statement API, normalises counterparty names against Korean business-registration data, and surfaces the result as standard accounting double-entry rows — no manual CSV exports.

3. MyData wealth dashboard

A robo-advisor consolidates a customer's IBK deposit, time-deposit and stock account positions through MyData consent. We carry the consent token across calls, refresh it before expiry, and present every position in a unified /portfolio response so the advisor's risk engine sees one source of truth.

4. Real-time settlement alerts

An e-commerce merchant accepting bank-transfer payouts from KRW customers needs a sub-second confirmation. We translate IBK push events into a webhook on the merchant side, signed with HMAC and replay-protected by Idempotency-Key; the merchant flips the order to "paid" the moment the credit lands.

5. Risk & fraud overlay

A digital lender wants device-risk telemetry alongside transaction history. Through i-ONE Guard signals — root detection, remote-control detection, malicious URL flags — and the regular statement feed, the lender's model gets both behavioural and device features in one schema.

Korean regulatory frame

Korea operates one of the most prescriptive open-finance regimes in Asia. Open Banking has run through the Korea Financial Telecommunications & Clearings Institute (KFTC) since December 2019, and Financial-Sector MyData launched fully on 5 January 2022 under the Financial Services Commission. Every i-ONE Bank integration we ship rides those rails — there is no scraping, no credential replay.

For personal data we follow the Personal Information Protection Act (PIPA). Recent 2026 amendments raised potential administrative fines to 10% of total revenue for severe breaches, so consent capture, data minimisation and breach-notification hooks are baked into every endpoint we deliver.

Operational controls

• Consent tokens recorded with timestamp and scope; revocation honoured within one polling cycle.
• Storage limited to the smallest field set the use case actually needs (no raw KRW account numbers in logs).
• ISMS-P-aligned controls: encryption at rest, key rotation, segregated audit trails.
• Optional residency: deploy the integration runtime inside your KR-region cloud account.
• Sandbox-first: every endpoint is verified against an IBK / KFTC sandbox profile before production cutover.

About OpenFinance Lab

We are an independent technical studio working at the intersection of mobile-app protocol analysis and OpenFinance integration. The team has shipped fintech infrastructure for banks, payment gateways and cross-border remittance products, with deep experience around KFTC Open Banking, Korean MyData, PSD2, UPI and Open Data initiatives in Southeast Asia.

For i-ONE Bank in particular we combine readings of the public Google Play listing, the KFTC Open Banking specification and the Financial Services Commission's MyData guidance to design APIs that match how the app actually behaves — not how a marketing brochure describes it.

• Protocol analysis, reverse engineering, sandbox replay and contract-test harnesses
• Custom Python, Node.js, Go or Kotlin SDKs with first-class typings
• End-to-end pipeline: scoping → analysis → build → validation → compliance review
• Source-code delivery from $300 — runnable APIs and full documentation, paid after acceptance
• Pay-per-call hosted API — no upfront cost, billed only on usage

Contact

Send us the target app and the integration scope (e.g. "i-ONE Bank statement export and MyData asset sync for our wealth dashboard") and we'll come back with a fixed-fee proposal within one business day.

Contact page

Engagement workflow

1. Scope confirmation: which i-ONE Bank surfaces (login, statement, transfer, MyData, stocks) and which downstream system.
2. Protocol analysis and API design (2–5 business days, scope-dependent).
3. Build and internal validation against IBK / KFTC sandbox (3–8 business days).
4. Documentation, runnable samples and pytest / jest test cases (1–2 business days).
5. Production cutover with monitoring dashboards and on-call hand-off.

FAQ

What do you need from me to start an i-ONE Bank integration?

How long does an i-ONE Bank API delivery take?

How do you handle Korean compliance and PIPA?

Can you deliver MyData asset aggregation as well as transactions?