openapi: 3.2.0
info:
  version: 1.6.0
  title: iBanFirst Fixed forward payment contract API
  description: "iBanFirst API for cross-border payments, FX trades, account management, beneficiaries, and webhooks.\n\n**Try it out in Postman:** [View Postman Collection](https://www.postman.com/productibf/ibanfirst-rest-api-workspace/collection/d24hl8d/ibanfirst-rest-api?action=share&creator=44872188)\n\n---\n\n## Authentication — X-WSSE\n\nEvery request must include an `X-WSSE` header. Plain HTTP calls will fail. The token is **stateless and expires after ~5 minutes**, so it must be computed fresh for each request.\n\n### Header format\n\n```\nX-WSSE: UsernameToken Username=\"<username>\", PasswordDigest=\"<digest>\", Nonce=\"<nonce_b64>\", Created=\"<timestamp>\"\n```\n\n### Fields\n\n| Field | Description |\n|---|---|\n| `Username` | The username assigned during onboarding. |\n| `Nonce` | A Base64-encoded random hex string (≥ 32 hex characters). |\n| `Created` | Current UTC timestamp in ISO 8601: `YYYY-MM-DDTHH:MM:SSZ`. |\n| `PasswordDigest` | `Base64( SHA-1( nonce_bytes ∥ created_bytes ∥ secret_bytes ) )` — SHA-1 **binary** digest, then Base64. |\n\n### Algorithm (step-by-step)\n\n1. Generate a random nonce: at least 32 lowercase hexadecimal characters (e.g. `d36e3162829ed4c89851497a717f0001`).\n2. Get the current UTC timestamp as an ISO-8601 string (e.g. `2026-05-12T10:30:00Z`).\n3. Encode the nonce string as UTF-8 bytes, the timestamp as UTF-8 bytes, and the API secret as UTF-8 bytes.\n4. Compute `SHA-1( nonce_bytes + created_bytes + secret_bytes )`. The hash **must** be the raw binary digest (not hex).\n5. `PasswordDigest` = `Base64( sha1_binary_digest )`\n6. `Nonce` = `Base64( nonce_utf8_bytes )`\n\n### Code samples\n\n**Python**\n```python\nimport base64, hashlib, os, binascii\nfrom datetime import datetime, timezone\n\ndef generate_xwsse(username: str, secret: str) -> str:\n    nonce = binascii.b2a_hex(os.urandom(16))          # 32 hex bytes\n    created = datetime.now(timezone.utc).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n    digest = base64.b64encode(\n        hashlib.sha1(nonce + created.encode() + secret.encode()).digest()\n    ).decode()\n    nonce_b64 = base64.b64encode(nonce).decode()\n    return f'UsernameToken Username=\"{username}\", PasswordDigest=\"{digest}\", Nonce=\"{nonce_b64}\", Created=\"{created}\"'\n```\n\n**JavaScript (Node.js)**\n```javascript\nconst crypto = require('crypto');\nfunction generateXWSSE(username, secret) {\n    const nonce = crypto.randomBytes(16);\n    const created = new Date().toISOString();\n    const digest = crypto.createHash('sha1')\n        .update(nonce)\n        .update(Buffer.from(created))\n        .update(Buffer.from(secret))\n        .digest('base64');\n    return `UsernameToken Username=\"${username}\", PasswordDigest=\"${digest}\", Nonce=\"${nonce.toString('base64')}\", Created=\"${created}\"`;\n}\n```\n\n**PHP**\n```php\nfunction generateXWSSE(string $username, string $secret): string {\n    $nonce = bin2hex(random_bytes(16));          // 32 hex chars\n    $created = gmdate('Y-m-d\\TH:i:s\\Z');\n    $digest = base64_encode(sha1($nonce . $created . $secret, true));\n    return sprintf('UsernameToken Username=\"%s\", PasswordDigest=\"%s\", Nonce=\"%s\", Created=\"%s\"',\n        $username, $digest, base64_encode($nonce), $created);\n}\n```\n\n### Environments\n\n| Environment | Base URL |\n|---|---|\n| Demo (testing) | `https://api-demo.ibanfirst.com/api` |\n| Live (production) | `https://api.ibanfirst.com/api` |\n\n### Forbidden characters in input fields\n\nThe following characters are rejected in route parameters, query parameters, and JSON bodies: `&` `<` `>` `%` `?` `\\` `/` `|`"
servers:
- url: https://api-demo.ibanfirst.com/api
security:
- X-WSSE: []
tags:
- name: Fixed forward payment contract
  description: "Book a fixed forward payment contracts instantly on iBanFirst without manual intervention.\n\n- Available currency pairs:\n  - **EUR/USD**\n  - **EUR/GBP**\n  - **GBP/USD**\n\n - Maturities: **up to 6 months**.\n\n - Transaction limit: **1M EUR** equivalent per transaction.\n\nBefore using fixed forward, you must have:\n - Credit approval.\n - Collateral in place.\n - Accepted the Autonomous Forward disclaimer.\n\nThe `deliveryDate` must satisfy the following conditions:\n - **Minimum date**: current date + 3 business days.\n - **Maximum date**: earlier between [current date + 6 months] and maximum maturity date allowed."
paths:
  /fixed-forwards/quote:
    post:
      summary: 'Ask for a fixed forward payment contract quote

        '
      tags:
      - Fixed forward payment contract
      description: 'This service allows you to ask for a fixed forward quote.


        The quote remains valid for **12 seconds** and can be used to book a fixed forward payment contract with the **Create fixed forward** service.


        The **delivery date** must fall between **D+3** and the earlier of **D+6 months and the maximum authorized maturity date**.

        '
      requestBody:
        $ref: '#/components/requestBodies/Quote'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  quote:
                    $ref: '#/components/schemas/FixedForwardQuote'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /fixed-forwards:
    post:
      summary: Create fixed forward
      tags:
      - Fixed forward payment contract
      description: 'This service allows you to book a fixed forward payment contract on the real-time Forex market.


        You must use a quote obtained with the **Ask for a fixed forward payment contract quote** service.

        '
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - quoteId
              - sourceAccountId
              - deliveryAccountId
              properties:
                quoteId:
                  $ref: '#/components/schemas/quoteRef'
                sourceAccountId:
                  $ref: '#/components/schemas/ID'
                deliveryAccountId:
                  $ref: '#/components/schemas/ID'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  fixedForward:
                    $ref: '#/components/schemas/FixedForwardTrade'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      summary: Get fixed forwards by status
      tags:
      - Fixed forward payment contract
      description: 'Retrieve the list of booked and executed fixed forward payment contract filtered by status.

        '
      parameters:
      - name: status
        in: query
        description: 'A code representing the status of the trades you want to get.

          '
        schema:
          type: string
          enum:
          - all
          - planified
          - finalized
          - canceled
          default: all
      - name: fromDate
        in: query
        description: 'The starting date to search for fixed forward payment contract.

          '
        required: false
        schema:
          type: string
          format: YYYY-MM-DD
      - name: toDate
        in: query
        description: 'The ending date to search for fixed forward payment contract.

          '
        required: false
        schema:
          type: string
          format: YYYY-MM-DD
      - name: page
        in: query
        description: 'Index of the page.

          '
        required: false
        schema:
          type: string
          default: '1'
      - name: per_page
        in: query
        description: 'Number of items returned.

          '
        required: false
        schema:
          type: string
          default: '50'
      - name: sort
        in: query
        description: 'A code representing the order of rendering objects.

          '
        required: false
        schema:
          type: string
          enum:
          - ASC
          - DESC
          default: DESC
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  fixedForwards:
                    type: array
                    items:
                      $ref: '#/components/schemas/FixedForwardTrade'
                  page:
                    type: integer
                    description: Index of the page.
                  pageSize:
                    type: integer
                    description: Number of items returned per page.
                  total:
                    type: integer
                    description: Number of items available.
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /fixed-forwards/{fixedForwardId}:
    get:
      summary: Get fixed forward details
      tags:
      - Fixed forward payment contract
      description: 'Retrieve the details of a fixed forward.

        '
      parameters:
      - name: fixedForwardId
        in: path
        description: 'The code identifying the fixed forward payment contract you want to retrieve.

          '
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  fixedForward:
                    $ref: '#/components/schemas/FixedForwardTrade'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Currency:
      type: string
      pattern: ^[A-Z]{3}$
      format: ^[A-Z]{3}$
      example: USD
      description: 'A String representing the Three-digit ISO 4217 Currency Code of a currency. This String only contains capitalized letters.

        '
    DatetimeFractionnal:
      type: string
      pattern: ^((19[0-9]{2}|2[0-9]{3})\-(0[1-9]|1[0-2])\-([0-2][0-9]|3[01])T([01][0-9]|2[0-3])\:([0-5][0-9])\:([0-5][0-9])\.[0-9]{1,9}Z)$
      format: ^((19[0-9]{2}|2[0-9]{3})\-(0[1-9]|1[0-2])\-([0-2][0-9]|3[01])T([01][0-9]|2[0-3])\:([0-5][0-9])\:([0-5][0-9])\.[0-9]{1,9}Z)$
      example: '2026-03-11T15:51:31.236943879Z'
      description: 'A string representing a UTC date-time in ISO 8601 format including year, month, day, hour, minute, second, and fractional seconds, terminated with the ''Z'' UTC designator.

        '
    QuotedDecimal:
      type: string
      pattern: ^((\-)?)[0-9]{12}((\.[0-9]{1,7})?)$
      format: ^((\-)?)[0-9]{12}((\.[0-9]{1,7})?)$
      example: '2.257'
      description: 'A String representing a formatted floating number.

        '
    ID:
      type: string
      pattern: ^[A-Za-z0-9]+$
      format: ^[A-Za-z0-9]+$
      example: Na5Dv6E
      description: 'A String representing the id of an object. This string contains alpha-numeric characters, including the capital ones.

        '
    Date:
      type: string
      pattern: ^[0-9]{4}\-[0-9]{2}\-[0-9]{2}$
      format: ^[0-9]{4}\-[0-9]{2}\-[0-9]{2}$
      example: '2016-01-01'
      description: "A String representing a date by its year, month and day in month.\n    \n"
    quoteRef:
      type: string
      pattern: ^ui[0-9]{4}-[0-9]{5}-[0-9]{13}$
      format: ^ui[0-9]{4}-[0-9]{5}-[0-9]{13}$
      example: ui9230-29830-1773244279236
      description: 'A String representing the unique ID of the quote.

        '
    CurrencyPair:
      type: string
      pattern: ^[A-Z]{6}$
      format: ^[A-Z]{6}$
      example: EURUSD
      description: "A String representing two concatenated Three-digit ISO 4217 Currency Code of a currency. This String only contains capitalized letters.\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n"
    Error:
      type: object
      description: 'Representation of an error.

        '
      properties:
        errorCode:
          type: number
          format: int
          description: 'The code referring the error.

            '
        errorType:
          type: string
          description: 'A short description identifying a general category for the error that occurred.

            '
        errorMessage:
          type: string
          description: Error description.
        link:
          type: string
          description: 'An hyperlink to access the page that describes more accurately the error.

            '
    Datetime:
      type: string
      pattern: ^((19[0,99]|2[0-9]{3})\-(0[1-9]|1[012])\-([012][0-9]|3[01])\ ([01][0-9]|2[0-3])\:([0-5][0-9])\:([0-5][0-9]))$
      format: ^((19[0,99]|2[0-9]{3})\-(0[1-9]|1[012])\-([012][0-9]|3[01])\ ([01][0-9]|2[0-3])\:([0-5][0-9])\:([0-5][0-9]))$
      example: '2016-01-01 00:00:00'
      description: 'A String representing a date by its year, month, day in month, hour, minute and second.

        '
    FixedForwardQuote:
      type: object
      description: 'Representation of a quote.

        '
      properties:
        quoteId:
          $ref: '#/components/schemas/quoteRef'
        currencyPair:
          $ref: '#/components/schemas/CurrencyPair'
        sourceAmount:
          $ref: '#/components/schemas/Amount'
        deliveredAmount:
          $ref: '#/components/schemas/Amount'
        appliedRate:
          $ref: '#/components/schemas/QuotedDecimal'
        expiresAt:
          $ref: '#/components/schemas/DatetimeFractionnal'
    FixedForwardTrade:
      type: object
      description: 'Representation of a fixed forward payment contract.

        '
      properties:
        fixedForwardId:
          $ref: '#/components/schemas/ID'
        appliedRate:
          $ref: '#/components/schemas/QuotedDecimal'
        currencyPair:
          $ref: '#/components/schemas/CurrencyPair'
        sourceAmount:
          $ref: '#/components/schemas/Amount'
        deliveredAmount:
          $ref: '#/components/schemas/Amount'
        createdDate:
          $ref: '#/components/schemas/Datetime'
        deliveryDate:
          $ref: '#/components/schemas/Date'
        status:
          description: The status of the fixed forward payment contract.
          type: string
          enum:
          - planified
          - finalized
          - canceled
        side:
          type: string
          description: The side representing the quote. `S` to sell and `B` to buy.
          enum:
          - B
          - S
        sourceAccountId:
          $ref: '#/components/schemas/ID'
        deliveryAccountId:
          $ref: '#/components/schemas/ID'
    Amount:
      type:
      - object
      - 'null'
      description: 'Representation of an amount.

        '
      required:
      - value
      - currency
      properties:
        value:
          $ref: '#/components/schemas/QuotedDecimal'
        currency:
          $ref: '#/components/schemas/Currency'
  requestBodies:
    Quote:
      content:
        application/json:
          schema:
            type: object
            required:
            - currencyPair
            - side
            - amount
            - deliveryDate
            properties:
              currencyPair:
                $ref: '#/components/schemas/CurrencyPair'
              side:
                description: 'The side representing the quote. `S` to sell and `B` to buy.

                  '
                type: string
                enum:
                - B
                - S
              amount:
                $ref: '#/components/schemas/Amount'
              deliveryDate:
                $ref: '#/components/schemas/Date'
      required: true
  securitySchemes:
    X-WSSE:
      type: apiKey
      in: header
      name: X-WSSE
      description: 'X-WSSE token-based authentication. The header value must be computed fresh for every request (tokens expire in ~5 minutes).


        Header value format:

        ```

        UsernameToken Username="<username>", PasswordDigest="<digest>", Nonce="<nonce_b64>", Created="<timestamp>"

        ```


        Algorithm:

        1. Generate a random nonce: ≥ 32 lowercase hex characters.

        2. Get current UTC timestamp in ISO 8601: `YYYY-MM-DDTHH:MM:SSZ`.

        3. Compute `PasswordDigest = Base64( SHA-1( nonce_bytes + created_bytes + secret_bytes ) )` — SHA-1 over the raw UTF-8 bytes concatenated in that order, result must be the binary digest before Base64 encoding.

        4. Compute `Nonce = Base64( nonce_utf8_bytes )`.


        See the `info.description` field at the top of this spec for full code samples in Python, JavaScript, PHP, Java, and Go.'