YAP (Nexi) API integration & OpenBanking services

1. Family budgeting & parental oversight

YAP is widely used by parents and teens (minimum age 12 with parental consent). A budgeting app can authorize the parent's child account, pull the prepaid card transactions and weekly top-ups, and render a shared spending plan. The integration touches the statement API, peer-to-peer transfer events (parent → child), and the notification webhook so guardians see purchases live.

2. Accounting export for self-employed users

A solopreneur using YAP for low-volume client receipts via SEPA can connect their account to an accounting tool. The integration consumes inbound IBAN credits, tags them by counterparty, and generates Italian-format invoices and quarterly summaries. The same flow exposes Mastercard purchases for input-VAT capture where eligible.

3. Group expense and bill-split apps

YAP's "Send" and "Ask money" features are widely used to split pizza bills, manage holiday funds, and collect group gifts. A travel or roommates app can normalize these P2P events into shared ledgers, settle imbalances, and reconcile against external apps such as Splitwise, Tricount, or Settle Up via an OpenFinance-style pipeline.

4. AML, fraud, and risk control

Compliance teams at lenders or marketplaces can ingest YAP transaction histories and top-up sources to score risk: detect rapid card-to-card cycling, flag mismatched merchant categories, or monitor cross-border MCCs. The integration combines statement queries, top-up provenance and KYC state through a consent-based PSD2 channel.

5. Loyalty & cashback engines

Retailers and cashback platforms can correlate YAP purchases (merchant, MCC, geolocation hint from contactless taps) with their loyalty IDs, granting in-app rewards in near real time. The pipeline relies on the notification webhook plus the statement API for periodic reconciliation.

Deliverables checklist

• OpenAPI / Swagger specification for the YAP-facing endpoints
• Protocol and auth flow report (token / OTP / biometric step-up chain)
• Runnable source code in Python or Node.js for login, statement, top-up reconciliation
• Webhook receiver template for real-time spend events
• Postman collection, sample CSV / JSON exports and replay logs
• Compliance notes: PSD2 SCA, GDPR retention, Italian Garante guidance
• Two engagement models: source-code delivery from $300 or pay-per-call hosted API

API example: statement query

// 1) Fetch prepaid card statement for a YAP user (pseudocode)
POST /api/v1/yap/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>

{
  "account_id": "yap_user_8f2c",
  "iban": "IT60X05428...",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "type":      ["CARD","SEPA_IN","P2P","TOPUP"],
  "page":      1,
  "page_size": 100
}

// Response (truncated)
{
  "items": [
    {"id":"tx_001","ts":"2026-03-04T19:21:11Z","amount":-12.40,
     "currency":"EUR","merchant":"PIZZERIA NAPOLI","mcc":"5812",
     "channel":"GOOGLE_PAY","status":"SETTLED"},
    {"id":"tx_002","ts":"2026-03-05T08:00:02Z","amount":+50.00,
     "currency":"EUR","counterparty":"Mario Rossi","channel":"SEPA_IN"}
  ],
  "page":1,"total":237
}

API example: webhook + auth refresh

// 2) Real-time spend webhook delivered to your endpoint
POST https://your-app.example/yap/events
X-Yap-Signature: t=1714291200,v1=4d0...
Content-Type: application/json

{
  "event":"card.transaction.authorized",
  "account_id":"yap_user_8f2c",
  "amount":-2.50,
  "currency":"EUR",
  "merchant":"BAR CENTRO",
  "ts":"2026-04-02T08:14:55Z"
}

// 3) Refresh the YAP session when access expires
POST /api/v1/yap/auth/refresh
{ "refresh_token":"<REFRESH>" }
=> { "access_token":"...","expires_in":1800 }
// On 401 from the upstream YAP service, re-trigger SCA via OTP
//   plus biometric step-up before retrying the original call.

Data flow / architecture

A typical YAP integration follows a clean four-stage pipeline:

1. Client App / SDK — End-user authorizes access with SCA (OTP + biometric).
2. Ingestion / API gateway — Our bridge calls login, statement, balance, P2P and top-up endpoints, normalizes payloads.
3. Storage — Encrypted at rest (AES-256), partitioned by account; PII fields tokenized.
4. Output — Customer-facing REST API, webhook stream, or scheduled JSON / CSV / Parquet drop to S3.

Compliance & privacy

YAP is regulated under European rules. Our integrations operate under explicit user authorization and respect:

• PSD2 / SCA — Strong Customer Authentication, 90-day re-consent, AISP-style scoping.
• GDPR — Lawful basis, data minimization, retention policies, right to erasure.
• Italian Garante della Privacy — Local guidance on financial data handling for resident users.
• Banca d'Italia / EBA RTS — Logging, traceability, and customer consent records.
• PCI-DSS-aligned handling — Card metadata is masked at the boundary; full PANs are never stored.

About our studio

We are an independent technical studio focused on App interface integration and authorized API integration for OpenData, OpenFinance, and OpenBanking projects. Our engineers come from backgrounds in payments, mobile reverse engineering, and cloud platforms, and have shipped integrations with prepaid card products, neobanks, and merchant acquirers across Europe and beyond. Our service model is intentionally simple: tell us the target app and the data you need, and we hand back source code or a hosted API.

• Payments, digital banking, prepaid cards, and SEPA / IBAN data flows
• Protocol analysis (network capture, request signing, mobile-side flow tracing)
• Custom Python / Node.js / Go SDKs and webhook receivers
• Full pipeline: protocol analysis → build → validation → compliance → handover
• Source code delivery from $300 — runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted YAP-bridge API and pay only per call, no upfront cost

Contact

For a quote, sandbox access, or to scope a YAP integration, open our contact page and tell us which data you need (statements, IBAN credits, P2P, top-ups, notifications) and your target stack.

Contact page

NDAs available on request. We work strictly under user authorization or documented public APIs.

Engagement workflow

1. Scope confirmation — which YAP data (statements, IBAN inflows, P2P, top-ups, notifications) and which output format (REST, webhook, CSV drop).
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build and internal validation against a sandbox or authorized test account (3–8 business days).
4. Documentation, sample payloads, and replayable test cases (1–2 business days).
5. Typical first delivery: 5–15 business days; PSD2 consent flows or third-party approvals may extend the timeline.

FAQ

What do you need from us to start?

Do you provide both source code and a hosted API?

How do you handle PSD2 and GDPR?

Can you also integrate Hype, Revolut, or Postepay for the same customer?