openapi: 3.0.3
info:
  title: Kontomatik Account Information Service Aggregation Command API
  version: 1.0.0
  description: 'PSD2-regulated Account Information Service (AIS) for connecting to end-user

    bank accounts across Central and Eastern Europe. Supports Single Access

    (one-time data fetch) and Multiple Access (reusable consent token, up to

    180 days), redirection-based SignIn Flow, and mock-bank testing.

    '
  contact:
    name: Kontomatik Support
    email: support@kontomatik.com
    url: https://developer.kontomatik.com/
  license:
    name: Commercial — see https://kontomatik.com
servers:
- url: https://api.kontomatik.com/v1
  description: Production
- url: https://test.api.kontomatik.com/v1
  description: Test
security:
- ApiKeyAuth: []
tags:
- name: Command
  description: Background import commands and consent management
paths:
  /command/default-import.xml:
    post:
      tags:
      - Command
      summary: Start Default Data Import
      description: Initiates background import of transactions, accounts, and owner data from the authenticated session.
      operationId: startDefaultImport
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/DefaultImportRequest'
      responses:
        '200':
          description: Command accepted
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/CommandAccepted'
  /command/{id}.xml:
    get:
      tags:
      - Command
      summary: Get Command Status
      description: Polls the status of a previously issued import command and returns results when complete.
      operationId: getCommandById
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Command details
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/CommandResult'
  /command/reuse-multiple-access.xml:
    post:
      tags:
      - Command
      summary: Reuse Multiple Access Token
      description: Creates a new import session using an existing Multiple Access consent token (no end-user reauthentication).
      operationId: reuseMultipleAccess
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/ReuseMultipleAccessRequest'
      responses:
        '200':
          description: Reuse accepted
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/CommandAccepted'
  /command/delete-multiple-access.xml:
    post:
      tags:
      - Command
      summary: Delete Multiple Access Consent
      description: Revokes a Multiple Access consent token, ending continuous access.
      operationId: deleteMultipleAccess
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/DeleteMultipleAccessRequest'
      responses:
        '200':
          description: Consent revoked
components:
  schemas:
    Transaction:
      type: object
      properties:
        date:
          type: string
          format: date
        amount:
          type: number
          format: double
        currency:
          type: string
        description:
          type: string
        counterpartyName:
          type: string
        counterpartyAccount:
          type: string
        label:
          type: string
    CommandResult:
      type: object
      properties:
        id:
          type: string
        status:
          type: string
          enum:
          - QUEUED
          - RUNNING
          - COMPLETED
          - FAILED
        target:
          type: string
        owners:
          type: array
          items:
            $ref: '#/components/schemas/Owner'
        accounts:
          type: array
          items:
            $ref: '#/components/schemas/Account'
        multipleAccessToken:
          type: string
    ReuseMultipleAccessRequest:
      type: object
      required:
      - multipleAccessToken
      properties:
        multipleAccessToken:
          type: string
        since:
          type: string
          format: date
    DefaultImportRequest:
      type: object
      required:
      - sessionId
      - sessionIdSignature
      properties:
        sessionId:
          type: string
        sessionIdSignature:
          type: string
        since:
          type: string
          format: date
        ownerExternalId:
          type: string
    DeleteMultipleAccessRequest:
      type: object
      required:
      - multipleAccessToken
      properties:
        multipleAccessToken:
          type: string
    Owner:
      type: object
      properties:
        externalId:
          type: string
        name:
          type: string
        email:
          type: string
        nationalId:
          type: string
    CommandAccepted:
      type: object
      properties:
        id:
          type: string
        status:
          type: string
          enum:
          - QUEUED
          - RUNNING
    Account:
      type: object
      properties:
        number:
          type: string
        currency:
          type: string
        balance:
          type: number
          format: double
        availableBalance:
          type: number
          format: double
        transactions:
          type: array
          items:
            $ref: '#/components/schemas/Transaction'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key
      description: API key issued by Kontomatik; requests must originate from a whitelisted server.