Itaú Empresas: Conta PJ — API integration & Open Finance Brasil source-code delivery

1. Account & balance sync

Connects to the Open Finance Brasil accounts resource for Conta PJ: account identifier, branch, company CNPJ, product subtype (conta corrente / conta-poupança), available and blocked balance, and automatic deposit overdraft. Use for intraday liquidity dashboards and reconciliation.

2. Extrato PJ (statement) export

Paginated statement API with filters by date range (up to 365 days), PIX/boleto/TED/card/acquirer type, and credit/debit indicator. Output as JSON, CSV, OFX, or a rendered PDF that matches the in-app extrato layout for audit continuity.

3. PIX PJ inbound & outbound

Supports PIX keys (CNPJ, email, telefone, EVP), Pix Copia e Cola, QR codes, scheduled PIX, and the Itaú PIX Recebe 5-day interest-free credit benefit. Exposes real-time webhook events for every e2e_id so receivables show up in your ERP within seconds.

4. Boleto registrado issuance

Generate registered boletos with CNPJ payee, due date, multa/juros/desconto rules, and customer CPF/CNPJ; retrieve settlement status and reconcile against PIX-boleto hybrid payments when customers pay via QR.

5. Business & virtual card transactions

Pull Itaú Business Card authorizations, installment plans (up to 24x), billing-cycle details, and virtual-card metadata. Useful for corporate-card expense tools that need line-item merchant data and MCC codes.

6. Credit, Adapt plan & investments

Surface capital de giro balances, receivables anticipation schedules, consortium contracts, fixed income positions, and the Adapt plan tariff counters — so CFOs can see how much monthly fee the company has already amortized through activity.

Scenario A · ERP real-time reconciliation

Business context: A retail SMB using an ERP wants every inbound PIX, boleto payment, and Rede settlement to auto-reconcile against open invoices.

Data / API: Open Finance Brasil accounts/statements + PIX webhook stream + Rede settlement endpoint. Match by e2e_id, nosso_número, and CNPJ counterparty.

OpenData mapping: Phase 2 customer data (accounts, transactions) + Phase 3 payment status — consent granted by the company representative through the Itaú app.

Scenario B · Treasury & liquidity dashboard

Business context: A mid-market group with several Itaú Empresas CNPJs needs a consolidated view of cash, overdraft, and credit facilities.

Data / API: Balance endpoint, credit contracts endpoint, investments positions, and consórcio schedules — polled every 15 minutes and materialized into a BI warehouse.

OpenData mapping: Consented Phase 2 & Phase 4 aggregation — only required fields leave the bank boundary (data minimization by design).

Scenario C · Accounting SaaS one-click import

Business context: A cloud accounting product wants users to connect their Itaú Empresas account and auto-import statements, categorizing PIX/boleto/card lines for the tax advisor.

Data / API: Extrato PJ paginated endpoint exported to OFX/CSV + MCC-based categorization of the business-card lines.

OpenData mapping: Ongoing consent renewed every 12 months per Open Finance Brasil rules, with a revocation UI surfaced in the SaaS.

Scenario D · Marketplace seller payouts

Business context: A marketplace needs to pay thousands of SMB sellers who hold Itaú Empresas accounts, while reconciling chargebacks and invoice deductions.

Data / API: PIX payment initiation (PISP) scoped to the marketplace's own Itaú account + seller-side inbound PIX confirmation webhooks.

OpenData mapping: Phase 3 payment initiation under a FAPI-compliant flow with an Itaú-issued mTLS certificate and per-transaction consent.

Scenario E · Credit underwriting & risk

Business context: A lender underwriting working-capital loans wants to inspect real Itaú Empresas cash flow for the last 12 months before approving a line.

Data / API: 365-day statement API + PIX inbound histogram + Rede acquirer settlement + current credit contracts — aggregated into a cash-flow score.

OpenData mapping: Short-duration, read-only Phase 2 consent tightly scoped to underwriting; raw data is discarded after decision.

Deliverables checklist

• OpenAPI 3.0 specification covering accounts, statements, PIX, boleto, cards
• Protocol & auth flow report (OAuth 2.0 client_credentials + mTLS + FAPI headers)
• Runnable source code (Python / Node.js / Go) with sample CNPJ flows
• Consent management module with 12-month renewal + revocation hooks
• Postman/Insomnia collection aligned with Itaú devportal
• Integration tests (mock + sandbox) and load-test plan
• Compliance note (LGPD, Resolução CMN nº 4,658 / BCB Open Finance rules)

Snippet 1 · mTLS + OAuth 2.0 token (Itaú devportal)

POST https://sts.itau.com.br/api/oauth/token
Content-Type: application/x-www-form-urlencoded
# mTLS client certificate required (dynamic CSR, 365-day validity)

grant_type=client_credentials
&client_id=<CLIENT_ID>
&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
&client_assertion=<SIGNED_JWT>
&scope=accounts+statements+pix.read

Response:
{
  "access_token": "eyJhbGciOiJQUzI1NiIsInR5cCI6...",
  "token_type": "Bearer",
  "expires_in": 300
}

Snippet 2 · Extrato PJ statement pull

GET /open-banking/accounts/v2/accounts/{accountId}/transactions
  ?fromBookingDate=2026-03-01
  &toBookingDate=2026-03-31
  &creditDebitIndicator=CREDIT
  &page=1&page-size=200
Authorization: Bearer <ACCESS_TOKEN>
x-fapi-interaction-id: 1b6c1c54-5c2e-4b3d-8f0b-9e61a6b1f2d1
x-fapi-auth-date: Mon, 20 Apr 2026 10:15:00 GMT

Response (excerpt):
{
  "data": [{
    "transactionId": "TXN-55f1...",
    "completedAuthorisedPaymentType": "TRANSFERENCIA_PIX",
    "creditDebitType": "CREDIT",
    "transactionName": "PIX RECEBIDO - VENDAS MARKETPLACE",
    "type": "PIX",
    "amount": { "amount": "1820.45", "currency": "BRL" },
    "transactionDateTime": "2026-03-18T14:22:10Z",
    "partieCnpjCpf": "12345678000190"
  }],
  "links": { "self": "...", "next": "...page=2" },
  "meta": { "totalRecords": 412, "totalPages": 3 }
}

Snippet 3 · PIX PJ webhook handler (Node.js)

// Inbound PIX webhook — validates signature, then forwards
// to the customer's ERP queue for reconciliation.
app.post('/webhooks/pix/itau-empresas', verifyFapiSig, (req, res) => {
  const { endToEndId, txid, valor, pagador, infoPagador } = req.body;

  if (!endToEndId || !txid) {
    return res.status(400).json({ error: 'missing_ids' });
  }

  queue.publish('erp.reconcile', {
    source: 'itau-empresas',
    cnpj: pagador.cnpj,
    amount: Number(valor),
    e2eId: endToEndId,
    txid,
    note: infoPagador,
    receivedAt: new Date().toISOString()
  });

  // Respect Itaú's 5-day interest-free PIX PJ credit benefit
  // by tagging the settlement window.
  res.status(200).json({ status: 'accepted' });
});

Compliance & privacy

Every delivery is designed to sit inside Brazil's regulatory perimeter. Specifically we align with Open Finance Brasil standards (Banco Central do Brasil, phases 1–4 and the Financial-Grade API / FAPI 1.0 Advanced security profile), LGPD (Lei Geral de Proteção de Dados, Lei nº 13.709/2018) for any personal data of company representatives, and CMN Resolução nº 4,658 / BCB Resolução nº 85 on cybersecurity for institutions authorized by the Central Bank. Authentication uses OAuth 2.0 with mTLS on Itaú's sts.itau.com.br STS endpoint, signed JWT client assertions, and short-lived (5 minute) access tokens.

Operationally we ship consent records, audit logs, per-purpose scopes, and data-minimization filters, so that only the fields a scenario actually needs cross the boundary between the bank and the customer's stack. When the client operates outside Brazil, we additionally document GDPR-compatible controls for downstream storage.

Data flow / reference architecture

• 1. Client App / Consent UI — company admin authorizes scopes in the Itaú app or our hosted consent page.
• 2. Integration Gateway — holds the mTLS certificate, handles OAuth token refresh, and enforces FAPI headers.
• 3. Normalization & Storage — statements, PIX events, and card lines are normalized into a canonical schema and stored encrypted at rest.
• 4. Downstream APIs / Webhooks — customer ERP, accounting SaaS, BI warehouse, or mobile app consumes a single, stable JSON contract.

This pipeline keeps Itaú-specific quirks (rate limits, FAPI headers, pagination) isolated inside the gateway, so your product code stays bank-agnostic.

Inter Empresas: Conta PJ

Digital PJ account from Banco Inter with a business credit card without annual fees, rewards, unlimited PIX and boleto. Teams that hold both Inter and Itaú Empresas usually ask for a unified extrato export across the two CNPJ positions.

BTG Pactual Empresas

100% digital PJ account from BTG Pactual with unlimited PIX, billing and receivables-anticipation features, and a strong investment module. Typical integration question: align BTG investments and Itaú Empresas credit contracts on a single treasury dashboard.

Bradesco Net Empresa

Long-standing PJ app from Bradesco with balances, payments, DOC/TED/PIX, credit and the BIA assistant. Frequently paired with Itaú Empresas in multi-bank corporate clients; shared reconciliation is the main integration driver.

Bradesco Empresas e Negócios

Newer Bradesco app focused on simplified cash management, barcode-reader payments, PIX and credit. Integrations typically re-use the same Open Finance Brasil consent model applied to Itaú.

Santander Empresas

Santander's PJ app with accounts, investments (CDB, funds, poupança), payments, credit simulations and Getnet acquirer. Useful pairing when a company collects via Getnet and holds Itaú Empresas as its main operating account.

Nu Empresas (Nubank PJ)

Nubank's PJ payment account with zero maintenance fees, unlimited PIX, and a business credit card. Startups that begin with Nu Empresas and later open Itaú Empresas frequently want a single feed for both.

Cora: Conta PJ Digital

Cora focuses on invoice issuance with QR code, free PIX/TED and shared account access for co-founders. Integrators often combine Cora's invoice data with Itaú Empresas' settlement data for end-to-end A/R visibility.

C6 Empresas

C6 Bank's PJ app with multi-user access, PIX, boleto, card, and international transfer capabilities. A natural complement to Itaú Empresas when the company has cross-border flows.

Banco do Brasil PJ

Banco do Brasil's business banking super-app, heavily used by agribusiness and public-sector suppliers. Consolidated extrato exports between BB PJ and Itaú Empresas are a frequent accounting-office request.

PJBank & Pluggy (ERP Banking)

Infrastructure providers that expose unified APIs across Brazilian banks. Teams sometimes start with Pluggy or PJBank and then ask us for a deeper, direct Itaú Empresas integration to cover specific features (e.g. Adapt plan counters, virtual-card metadata) that aggregators abstract away.

About our studio

We are an independent technical services studio focused on mobile app interface integration and authorized API integration. Our engineers have shipped production systems inside Brazilian and international banks, payment gateways, acquiring networks, and fintech startups, and we have delivered dozens of Open Banking / Open Finance connectors across LATAM, EMEA, and APAC.

• Protocol analysis, Open Finance Brasil connectors, and ERP banking modules
• FAPI / mTLS security reviews and consent-management implementations
• Python / Node.js / Go / Kotlin SDKs, CI test harnesses, and observability
• End-to-end pipeline: discovery → protocol analysis → build → validation → compliance handover
• Source code delivery from $300 — runnable API source code + documentation; pay after delivery upon satisfaction
• Pay-per-call hosted API — use our managed endpoints and pay only for the calls you make, no upfront fee

Contact

Send us the target app and your requirements — we'll respond with scope, timeline, and pricing within one business day.

Open contact page

NDAs on request. Service area: Brazil & global clients integrating Brazilian PJ banking.

Engagement workflow

1. Scope confirmation — integration scenarios, data list, regions, and volume targets.
2. Protocol analysis & API design — 2–5 business days; includes Open Finance Brasil mapping and FAPI security plan.
3. Build & internal validation — 3–8 business days, sandbox or authorized production credentials.
4. Documentation, samples, and test cases — 1–2 business days.
5. First delivery — typically 5–15 business days; third-party approvals (e.g. BCB registrations) may extend timelines.

FAQ

What do you need from me?

How long does delivery take?

How do you handle compliance?

Do you support the Itaú Emps (2024) app too?