# Northmill

> Northmill Bank AB is a Swedish technology-driven bank (Stockholm, founded 2006, banking licence
> from Finansinspektionen in 2019, org.nr 556709-4866) serving roughly 600,000 private customers and
> 2,500 businesses in Sweden, Norway and Finland. Its public developer surface is the Northmill Flo
> API — a Swagger 2.0 REST contract with 199 operations for point-of-sale and commerce — plus a PSD2
> open-banking interface for third-party providers.
>
> This file is GENERATED by API Evangelist from the artifacts in this repository. Northmill does not
> publish an llms.txt: https://www.northmill.com/llms.txt returned 404 on 2026-08-26.

## APIs

- [Northmill Flo API](https://api.moreflo.com/swagger/ui/index): Point-of-sale and commerce REST API.
  125 paths, 199 operations, HTTP Basic auth. Base URL https://api.moreflo.com. Articles and pricing,
  stock, article sets, campaigns, brands, groups, suppliers, locations, customers, cashier users,
  orders (v2 and v3), booking orders, ticket orders, service orders, vouchers, receipts, cash cards,
  SMS, accounting settings, online/webshop/self-scan/catering settings and webhook subscriptions.
  Every collection is also addressable per store at /v2/stores/{externalStoreId}/...
- [Northmill Bank Open Banking API for TPPs](https://developer.token.io/northmill_rest_api_doc/content/e-rest/dashboard-intro.htm):
  PSD2 AIS and confirmation-of-funds (CBPII) interface for licensed third-party providers. Base URL
  https://api.token.io — the interface is delivered by Token.io as Northmill Bank's technical service
  provider, and the Swagger reference sits behind the Northmill Bank Dashboard sign-in.

## Specs

- [Flo API Swagger 2.0 (verbatim)](openapi/northmill-flo-api-swagger.json) — fetched from
  https://api.moreflo.com/swagger/docs/v2
- [API Evangelist overlay](overlays/northmill-flo-api-overlay.yaml)

## Runtime semantics

- [Conventions, idempotency and reversibility](conventions/northmill-conventions.yml)
- [Authentication](authentication/northmill-authentication.yml)
- [Error behaviour](errors/northmill-problem-types.yml) — no 4xx/5xx is documented anywhere; a 200
  can still be a failure, so check `Success` and `ExtraInformation` on every response.
- [Rate limits](rate-limits/northmill-rate-limits.yml) — the Flo API publishes none; the TPP interface
  caps a member at 1,000 requests/minute.
- [Webhooks](asyncapi/northmill-flo-webhooks.yml) — ArticleStockChanged and ReceiptCreated.
- [Data model](data-model/northmill-data-model.yml)
- [Lifecycle and versioning](lifecycle/northmill-lifecycle.yml)
- [Sandbox](sandbox/northmill-sandbox.yml) — https://test.api.moreflo.com serves the same contract.
- [Conformance](conformance/northmill-conformance.yml)

## Agent surfaces

- [Agent Skills](skills/_index.yml)
- [MCP candidate tool list](mcp/northmill-mcp.yml) — Northmill ships NO MCP server; this is derived.
- No A2A agent card is served. /.well-known/agent-card.json and /.well-known/agent.json returned 404
  on www.northmill.com and api.moreflo.com on 2026-08-26.

## Docs and company

- [Flo API reference (Swagger UI)](https://api.moreflo.com/swagger/ui/index)
- [Company site](https://www.northmill.com/)
- [Merchant help centre](https://www.northmill.com/se/foretag/hjalp/)
- [Business support](https://www.northmill.com/se/foretag/support/)
- [Pricing](https://www.northmill.com/se/foretag/vara-priser/)
- [Operational status](https://www.northmill.com/se/foretag/hjalp/uppdateringar/driftstatus/)
- [Release notes](https://www.northmill.com/se/foretag/hjalp/uppdateringar/)
- [Security](https://www.northmill.com/se-en/about-us/security/) ·
  [security.txt](https://www.northmill.com/.well-known/security.txt) · security@northmill.com
- [Corporate governance](https://www.northmill.com/se-en/about-us/corporate-governance/)
- [Terms](https://www.northmill.com/se/foretag/villkor/) ·
  [Privacy](https://www.northmill.com/se/integritetspolicy/)

## Caveats for agents

- No first-party SDK exists on npm, PyPI, NuGet, RubyGems, Packagist or crates.io, and there is no
  public GitHub organization.
- DELETE is terminal on account codes, brands, campaigns, groups, locations, suppliers and webhooks —
  there is no restore.
- Repeated creates are made safe by setting a stable `ExternalReference` (or `ArticleNumber`) and
  `UpdateOnExisting: true`. There is no Idempotency-Key header.