# Citizens Financial Group > Citizens Financial Group (Citizens Bank, N.A.) is one of the oldest and largest financial > institutions in the United States. Its commercial-banking API program is published through an IBM > API Connect developer portal at developer.citizensbank.com: an FDX-aligned account and statement > surface, an RTP/ACH payments surface, account validation, information reporting, internal account > transfer, an identity/authorize surface, and ATM/branch locators. Twelve machine-readable contracts > are published (4 OpenAPI 3.0.0, 8 Swagger 2.0). Access is partner-gated: an Implementation Manager > provisions IP allowlisting, mTLS certificates and portal credentials before any key is issued. Generated by API Evangelist on 2026-09-05 from artifacts in this repository. Source of every fact is the Citizens developer portal or a Citizens-published PDF user guide; nothing here is inferred. ## How to call these APIs - Auth: 2-legged OAuth 2.0 client_credentials with a private_key_jwt client assertion over mutual TLS. Citizens states conformance with FAPI 1.0 Part 2 Advanced. - Token endpoint (production): https://apis.citizensbank.com/as/token.oauth2 - Token endpoint (sandbox): https://sandboxapis.citizensbank.com/as/token.oauth2 - Required headers on the commercial-banking surface: Authorization (Bearer), X-IBM-Client-Id, x-fapi-trace-id (UUID, max 36 chars). Optional: x-fapi-channel-id, requestid. - Scopes seen in published contracts and samples: ir:read, av:read, transfer:initiate, Payment:Initiate, Payment:Query. - There is no self-service signup. Sandbox testing and message signing are required before production. ## APIs - [Payments v3](https://developer.citizensbank.com/product/commercial-banking/api/payments-v3): RTP and ACH payment initiation, payment status, and RTP participant status. Base https://apis.citizensbank.com/v3/payments. Operations: checkParticipantStatus, initiatePayment, retrievePaymentStatus. - [Account Transfer v1](https://developer.citizensbank.com/product/commercial-banking/api/accounttransfer-v1): single same-day transfers between a client's own Citizens accounts. Future-dated transfers are not supported. Base https://apis.citizensbank.com/v1/account-transfer. Operation: initiateTransfer. - [Account Validation v1](https://developer.citizensbank.com/product/commercial-banking/api/accountvalidation-v1): validate account number, routing number and beneficiary name before paying. Base https://apis.citizensbank.com/v1/account-validation. Operations: getAccountInquiry, getAccountInquiryByRefId. Charged at $1.25 per validation; no charge when the account is not found. - [Information Reporting v1](https://developer.citizensbank.com/product/commercial-banking/api/informationreporting-v1): account list, balances and transaction history for checking and savings accounts. Base https://apis.citizensbank.com/v1/information-reporting. Operations: getAccountList, getAccountDetails, getTransactions. - [Accounts (FDX)](https://developer.citizensbank.com/product/accounts/api/70): FDX-aligned account, contact, payment-network and transaction resources. Base https://api.citizensbank.com/fdx/v1.0 (production); FDX v2.1 in sandbox. - [Statements (FDX)](https://developer.citizensbank.com/product/statements/api/statements-v1): statement list and statement retrieval. Base https://api.citizensbank.com/fdx/v1.0. - [Authorize / IDP](https://developer.citizensbank.com/product/88/api/73): token revocation for partner authentication. Base https://api.citizensbank.com/authorize/v1.0. - [ATM Locator v1](https://sandboxdeveloper.citizensbank.com/product/127/api/103): find ATMs by postal code, state/city or latitude/longitude. Published on the sandbox portal only. - [Branch Locator v1](https://sandboxdeveloper.citizensbank.com/product/127/api/106): find branches by postal code, state/city, latitude/longitude or routing number. Sandbox portal only. ## Documentation - [Developer portal](https://developer.citizensbank.com/) - [API catalog](https://developer.citizensbank.com/api) - [API products and plans](https://developer.citizensbank.com/product) - [Support / FAQ](https://developer.citizensbank.com/support) - [Sandbox portal](https://sandboxdeveloper.citizensbank.com/) - [Payments user guide (PDF)](https://developer.citizensbank.com/content/qut/CitizensPaymentAPIUserGuide.pdf) - [Account Transfer user guide (PDF)](https://developer.citizensbank.com/content/qut/CitizensAccountTransferAPIUserGuide.pdf) - [Account Validation user guide (PDF)](https://developer.citizensbank.com/content/qut/CitizensAccountValidationAPIUserGuide.pdf) - [Information Reporting user guide (PDF)](https://developer.citizensbank.com/content/qut/CitizensInformationReportingAPIUserGuide.pdf) ## Agent Skills Packaged flows written by API Evangelist against the published contracts. Every operation named is a real operationId in a Citizens contract; none were invented. Index: skills/_index.yml. - [Initiate a Citizens payment](skills/citizens-financial-group-initiate-payment.md): checkParticipantStatus, initiatePayment, retrievePaymentStatus. Moves money, no reversal. - [Validate a payee account](skills/citizens-financial-group-validate-payee-account.md): getAccountInquiry, getAccountInquiryByRefId. Billable at $1.25; status readable three times only; the inquiry auto-cancels after 24 hours. - [Transfer between a client's own accounts](skills/citizens-financial-group-transfer-between-own-accounts.md): initiateTransfer. Same-day only, no duplicate protection, no status lookup, no reversal. - [Report balances and transactions](skills/citizens-financial-group-report-balances-and-transactions.md): getAccountList, getAccountDetails, getTransactions. Watch for 206 partial content on batch balances. - [Find an ATM or branch](skills/citizens-financial-group-find-atm-or-branch.md): findAtmsByPostalCode, findBranchesByPostalCode. No OAuth; Partner-ID header; sandbox-only. ## Contract notes worth knowing before you generate a client - Eight of the twelve contracts are Swagger 2.0 and declare **no operationIds at all** - both FDX Accounts, both FDX Statements, both Authorize, and every locator path except the postal-code one. - Those same eight declare **only 200 responses**. No 4xx or 5xx is machine-readable anywhere on the FDX, Authorize or locator surfaces; the real code registry lives in the PDF user guides. - Both locator contracts write the coordinate path as `/latitude/\{latitude}/longitude/{longitude}` - a literal backslash escapes the brace, so a generated client puts it on the wire. - The FDX and Authorize surfaces are a major version ahead in sandbox (FDX v2.1, Authorize v2.0) than in production (FDX v1.0, Authorize v1.0), with no published migration note. - OpenAPI Overlays capturing all of the above, per contract, are in overlays/. The harvested contracts themselves are never mutated. ## Rate limits Limits attach to the portal plan an application subscribes to, not to the endpoint. commercial-banking Default Plan: 100 calls/hour. accounts Limited: 1 call/second (Bronze, Silver and Gold are advertised unlimited). statements Platinum: 3 calls/second, GOLD: 1 call/second. Sandbox Accounts and Marketing DEFAULT: 1000 calls/hour. Exhaustion returns AT-429 / IR-429 / AV-4001. No RateLimit-* or Retry-After response headers are published. ## Errors Proprietary JSON envelope: { result: FATAL | WARNING, source, errorDetails[] { code, description } }. Not RFC 9457. 207 documented error codes across the four commercial-banking APIs, plus 85 RTP reject codes drawn from the ISO 20022 external status-reason vocabulary. Persistent failures go to Citizens Client Services, 877-550-5933, clientservices@mail.client.citizensbank.com, 24x7. ## Things this API does NOT have Stated plainly so an agent does not go looking: - No SDKs or client libraries in any package registry. - No MCP server, no A2A agent card, no /.well-known/ documents of any kind. - No status page, no changelog, no release notes, no deprecation or sunset policy. - No Idempotency-Key header. Payments uses a client-assigned unique paymentId and rejects a replay with PMT1003 rather than replaying the original response. - No cancel, void, refund or reversal operation on any money-movement endpoint. - No public pricing except $1.25 per account validation. - No public sign-up. Everything is provisioned by a Citizens Implementation Manager. ## Security - [Responsible disclosure program](https://citizensbank.responsibledisclosure.com/hc/en-us) (Synack) - [Security, Privacy and Legal](https://www.citizensbank.com/account-safeguards/overview.aspx) - [Privacy policy](https://www.citizensbank.com/account-safeguards/privacy.aspx) - [Terms of use](https://www.citizensbank.com/account-safeguards/terms-of-use.aspx) ## Optional - [Citizens corporate finance](https://www.citizensbank.com/corporate-finance/overview.aspx) - [Investor relations](https://investor.citizensbank.com/) - [Open Banking API announcement, 2025-03-27](https://investor.citizensbank.com/about-us/newsroom/latest-news/2025/2025-03-27.aspx)