openapi: 3.0.1 info: title: Envestnet Aggregation APIs Account Token Auth API description: 'This file describes the Yodlee Aggregation product APIs using the swagger notation that you can use to build your financial application. You can generate the client SDK in Python, JavaScript, PHP, or any other languages according to your development needs. For more details about the APIs, refer to Yodlee API v1.1 - Overview.

You will have to set the header before making the API call. The following headers apply to all the APIs:Note: If there are any API-specific headers, they are mentioned explicitly in the respective API''s description.' termsOfService: https://developer.yodlee.com/terms/condition contact: email: developer@yodlee.com license: name: Yodlee Developer License url: https://developer.yodlee.com/terms/condition#_Services_1 version: 1.1.0 servers: - url: / tags: - name: Auth description: Auth API paths: /auth/apiKey/{key}: delete: tags: - Auth summary: Envestnet Delete API Key description: 'This endpoint allows an existing API key to be deleted.
You can use one of the following authorization methods to access this API:
  1. cobsession
  2. JWT token
Notes:
  • This service is not available in developer sandbox environment and will be made availablefor testing in your dedicated environment. ' operationId: deleteApiKey parameters: - name: key in: path description: key required: true schema: type: string responses: 201: description: OK content: {} 204: description: No Content content: {} 400: description: 'Y807 : Resource not found
    Y806 : Invalid input' content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/YodleeError' 401: description: Unauthorized content: {} 404: description: Not Found content: {} deprecated: false /auth/apiKey: get: tags: - Auth summary: Envestnet Get API Keys description: 'This endpoint provides the list of API keys that exist for a customer.
    You can use one of the following authorization methods to access this API:
    1. cobsession
    2. JWT token
    Notes:
  • This service is not available in developer sandbox environment and will be made available for testing in your dedicated environment. ' operationId: getApiKeys responses: 200: description: OK content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/ApiKeyResponse' 401: description: Unauthorized content: {} 404: description: Not Found content: {} deprecated: false post: tags: - Auth summary: Envestnet Generate API Key description: 'This endpoint is used to generate an API key. The RSA public key you provide should be in 2048 bit PKCS#8 encoded format.
    A public key is a mandatory input for generating the API key.
    The public key should be a unique key. The apiKeyId you get in the response is what you should use to generate the JWT token.
    You can use one of the following authorization methods to access
    this API:
    1. cobsession
    2. JWT token
    Alternatively, you can use base 64 encoded cobrandLogin and cobrandPassword in the Authorization header (Format: Authorization: Basic )

    Note:
  • This service is not available in developer sandbox environment and will be made available for testing in your dedicated environment. The content type has to be passed as application/json for the body parameter.
    • ' operationId: generateApiKey requestBody: description: apiKeyRequest content: application/json: schema: $ref: '#/components/schemas/ApiKeyRequest' required: true responses: 201: description: OK content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/ApiKeyResponse' 400: description: 'Y800 : Invalid value for RS512 publicKey
    Y806 : Invalid input
    Y824 : The maximum number of apiKey permitted is 5
    Y811 : publicKey value already exists' content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/YodleeError' 401: description: Unauthorized content: {} 404: description: Not Found content: {} deprecated: false /auth/token: post: tags: - Auth summary: Envestnet Generate Access Token description: Generate Access Token using client credential authentication.
    This service returns access tokens required to access Yodlee 1.1 APIs. These tokens are the simplest and easiest of several alternatives for authenticating with Yodlee servers.
    The most commonly used services obtain data specific to an end user (your customer). For these services, you need a user access token. These are simply tokens created with the user name parameter (loginName) set to the id of your end user.

    Note: You determine this id and you must ensure it's unique among all your customers.

    Each token issued has an associated user. The token passed in the http headers explicitly names the user referenced in that API call.

    Some of the APIs do administrative work, and don't reference an end user.
    One example of administrative work is key management. Another example is registering a new user explicitly, with POST /user/register call or subscribe to webhook, with POST /config/notifications/events/{eventName}.
    To invoke these, you need an admin access token. Create this by passing in your admin user login name in place of a regular user name.

    This service also allows for simplified registration of new users. Any time you pass in a user name not already in use, the system will automatically implicitly create a new user for you.
    This user will naturally have very few associated details. You can later provide additional user information by calling the PUT user/register service.

    Notes: operationId: generateAccessToken requestBody: content: application/x-www-form-urlencoded: schema: properties: clientId: type: string description: clientId issued by Yodlee is used to generate the OAuth token for authentication. secret: type: string description: secret issued by Yodlee is used to generate the OAuth token for authentication. responses: 201: description: OK content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/ClientCredentialTokenResponse' 400: description: 'Y800 : Invalid value for loginName
    Y806 : Invalid input
    Y801 : Invalid length for loginName
    Y303 : clientId or secret is missing
    Y301 : Invalid clientId or secret
    Y305 : Access token can be issued only for pre-registered users
    Y004 : Inactive user
    Y901 : Service not supported
    ' content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/YodleeError' 401: description: 'Y016 : loginName header missing
    Y015 : Unauthorized User
    Y016 : Api-Version header missing
    Y020 : Invalid token in authorization header
    Y027 : Unsupported authentication type' content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/YodleeError' 404: description: Not Found content: {} deprecated: false delete: tags: - Auth summary: Envestnet Delete Token description: This endpoint revokes the token passed in the Authorization header. This service is applicable for JWT-based (and all API key-based) authentication and also client credential (clientId and secret) based authentication. This service does not return a response body. The HTTP response code is 204 (success with no content).
    Tokens generally have limited lifetime of up to 30 minutes. You will call this service when you finish working with one user, and you want to delete the valid token rather than simply letting it expire.

    Note:
  • Revoking an access token (either type, admin or a user token) can take up to 2 minutes, as the tokens are stored on a distributed system.
    operationId: deleteToken responses: 204: description: No Content content: {} 401: description: 'Y020 : Invalid token in authorization header
    Y023 : Token has expired
    Y016 : Api-Version header missing
    Y015 : Unauthorized User
    Y027 : Unsupported authentication type
    Y007 : Authorization header missing
    Y020 : Invalid token in authorization header' content: application/json;charset=UTF-8: schema: $ref: '#/components/schemas/YodleeError' 404: description: Not Found content: {} deprecated: false components: schemas: ClientCredentialTokenResponse: title: ClientCredentialTokenResponse type: object properties: token: $ref: '#/components/schemas/ClientCredentialToken' ClientCredentialToken: title: ClientCredentialToken type: object properties: expiresIn: type: integer description: Time in seconds after which the issued accessToken expires.

    Endpoints: format: int32 readOnly: true issuedAt: type: string description: The date and time on which accessToken was created for the customer.

    Endpoints: readOnly: true accessToken: type: string description: Access Token to access YSL 1.1 services.

    Endpoints: readOnly: true ApiKeyResponse: title: ApiKeyResponse type: object properties: apiKey: type: array description: ApiKey customer details.

    Endpoints: items: $ref: '#/components/schemas/ApiKeyOutput' YodleeError: title: YodleeError type: object properties: errorMessage: type: string description: The descriptive message that explains the error scenario. readOnly: true errorCode: type: string description: The error code follows the format YNNN. The error codes do not change. New error codes may be added as we introduce new features and enhance functionalities. readOnly: true referenceCode: type: string description: Unique Yodlee identifier used to troubleshoot issues at Yodlee's end. readOnly: true ApiKeyOutput: title: ApiKeyOutput type: object properties: expiresIn: type: integer description: Time in seconds after which the JWT token created for users expires.

    Endpoints: format: int64 createdDate: type: string description: The date on which the apiKey was created for the customer.

    Endpoints: publicKey: maxLength: 2147483647 minLength: 1 type: string description: Public key uploaded by the customer while generating ApiKey.

    Endpoints: key: type: string description: ApiKey or the issuer key used to generate the JWT token for authentication.

    Endpoints: ApiKeyRequest: title: ApiKeyRequest type: object properties: publicKey: maxLength: 2147483647 minLength: 1 type: string description: Public key uploaded by the customer while generating ApiKey.

    Endpoints: