# The Bank of London > The Bank of London (TBOL) is a UK principal clearing bank and Banking-as-a-Service provider, > authorised by the Bank of England's Prudential Regulation Authority and regulated by the FCA and > PRA (FRN 930379). Its Developer Studio publishes a public OpenAPI 3.0.3 contract — 58 operations > over accounts, customer onboarding, virtual accounts, Confirmation of Payee, Faster Payments, > Bacs, CHAPS, agency and cross-border payments, standing orders, direct-debit mandates, > transactions, statements and webhooks — backed by a free sandbox that requires no NDA. GENERATED BY API EVANGELIST. The Bank of London does not publish an llms.txt; both https://developer.bankoflondon.com/llms.txt and https://www.bankoflondon.com/llms.txt return 404 (probed 2026-08-30). This file is assembled from the provider's own published OpenAPI and documentation and is served from the API Evangelist profile, not from the bank. ## What an agent needs to know first - **You cannot call this API with a bearer token.** Every request carries a detached JSON Web Signature (PS256) in the `x-jws-signature` header, signed with the private key of an API key pair created in the Developer Studio. The signature payload binds `request-target`, `method`, `content-type`, a SHA-256 `content-digest` of the unindented body, a single-use `nonce`, and a `created` UNIX timestamp. Signatures older than 5 minutes are rejected and a nonce may not be reused within a 5-minute interval. - **The published OpenAPI declares no securitySchemes.** `components.securitySchemes` is an empty object. Do not conclude the API is unauthenticated — the `x-jws-signature` header parameter is required on all 58 operations. - **Idempotency is a body field, not a header.** Payment and standing-order creates take `idempotencyId` (string, 5–72 chars, UUID in the examples). A replay returns 409 `IDEMPOTENCY_ID_CONFLICT`. Account, customer, virtual-account and webhook creates have NO idempotency primitive — do not blind-retry those. - **Money movement is mostly irreversible.** CHAPS payments cannot be reversed. Faster Payments have no documented recall. A Bacs payment can be recalled only up to 5.30PM on the day it is initiated, and only by contacting uksupport@thebankoflondon.com or +44 3301 659 131 — there is no API operation for it. - **Rate limit: 1,000 requests per 10-minute window, per API key.** Exhaustion returns 429. No RateLimit-*/Retry-After headers are returned, so you cannot read your remaining budget. - **Every error carries `x-correlation-id`** as a required response header. Quote it to support. - **Enums are extensible.** Payment statuses, standing-order statuses and webhook event types can gain values without a major version change. Always default-case unknown values. ## Environments - Live: https://api.bankoflondon.com/ (the guides also name api.thebankoflondon.com) - Sandbox: https://sandbox-api.bankoflondon.com/ (guides: sandbox-api.thebankoflondon.com) - Mock server: https://developer.bankoflondon.com/api/mock/the-bank-of-london-api - An API key is permanently bound to one environment at creation and cannot be moved. ## Docs - [Developer Studio](https://developer.bankoflondon.com/) - [API Reference](https://developer.bankoflondon.com/apis/the-bank-of-london-api) - [Getting Started](https://developer.bankoflondon.com/docs/guides/getting-started-guide) - [Authentication / message signature](https://developer.bankoflondon.com/docs/overviews/authentication-message-signature-guide) - [Architecture and Security](https://developer.bankoflondon.com/docs/overviews/architecture-security-guide) - [Using the Sandbox](https://developer.bankoflondon.com/docs/overviews/using-sandbox-guide) - [Versioning](https://developer.bankoflondon.com/docs/overviews/versioning) - [API Rate Limiting](https://developer.bankoflondon.com/docs/overviews/api-rate-limiting) - [Manage Webhooks](https://developer.bankoflondon.com/docs/guides/manage-webhooks-guide) - [Manage Apps and Keys](https://developer.bankoflondon.com/docs/guides/manage-apps-keys-guide) - [Virtual Account Management](https://developer.bankoflondon.com/docs/overviews/virtual-account-management) - [Cross Border Payments](https://developer.bankoflondon.com/docs/payments/cross-border-payments) - [Status page](https://status.bankoflondon.com/) - [PSD2 / Third Party Providers](https://developer.bankoflondon.com/psd2-third-party-providers) ## Operation surface (58 operations, 10 tags) - **Accounts** — CreateAccount, GetAccounts, GetAccount, UpdateAccount, CloseAccount - **Customer Management** — CreateIndividual, GetIndividuals, GetIndividual, PatchIndividual, CreateOrganisationV3, GetOrganisationsV3, GetOrganisationV3, PatchOrganisationV3 - **Virtual Account Management** — GetVirtualAccounts, CreateVirtualAccount, GetAVirtualAccount, UpdateAVirtualAccount, CloseVirtualAccount, GetVirtualAccountTransactionsV3, GetVirtualAggregatorNodes, CreateVirtualAggregatorNode, GetVirtualAggregatorNode, UpdateVirtualAggregatorNode, GetHierarchy, CreateVirtualAccountHierarchy - **Confirmation of Payee** — ConfirmPayee - **Payments V2** — CreateAnFXQuoteV2, GetAnFXQuoteV2, CreateAnInternalPayment, CreateAFasterPayment, CreateABacsPayment, CreateACHAPSPayment, CreateAgencyPayment, CreatePaymentV2, GetPayments, GetPayment - **Standing Orders** — CreateAFasterPaymentStandingOrder, CreateAnInternalStandingOrder, GetStandingOrders, GetStandingOrder, UpdateStandingOrder, CancelStandingOrder - **Transactions** — GetTransactionsV3, GetTransactionV3, InitiateTransactionExportV3, GetTransactionExportV3, GetTransactionExportsByAccountIdV3 - **Mandates (Direct Debits)** — GetMandates, GetMandate, CancelMandate - **Statements** — GetStatements, DownloadStatements - **Webhook Management** — CreateWebhook, GetWebhooks, PatchWebhook, DeleteWebhook, CreateTestEvent, RegenerateWebhookKey ## Conventions - Versioning: URL path prefix. `v2` current; `v3` already live for organisations, transactions and transaction exports. Breaking changes get a new version. Adding an enum value is NOT breaking. - Pagination: `page` (default 1) and `pageSize` (default 20, max 50), with a `metaData` envelope carrying `totalRecords`, `page`, `pageSize`. - Errors: vendor JSON envelope `{status, name, message, code, details}` — NOT RFC 9457 problem+json. 108 enumerated `code` values across 20 operation-specific error refinements. - Webhooks: six event types, at-least-once delivery, no ordering guarantee, up to 20 minutes latency, 15 retry attempts, PS256 JWS signature verified with a per-webhook public key. ## Not published - No MCP server. TBOL(R) AI is a code assistant inside the Developer Studio, not an agent endpoint. - No A2A agent card at `/.well-known/agent-card.json` or `/.well-known/agent.json` on any host. - No SDK in any package registry, no public GitHub organisation, no Postman workspace, no CLI. - No `/.well-known/` documents at all — no security.txt, no api-catalog, no OIDC discovery. - No dated changelog or release-notes page. No published SLA. - No AsyncAPI document, despite a fully documented webhook surface. ## Open Banking (separate interface) The PSD2 / UK Open Banking Read/Write v3.1 TPP interface (AIS, PIS, PIIS, dynamic client registration, OIDC) is operated on the bank's behalf by Salt Edge Priora under provider code `tbol`, live since 3 April 2024. Docs: https://priora.saltedge.com/docs/open_banking/tbol/v3.1 — availability and quarterly performance statistics at .../availability. No machine-readable contract is published for it by either party. ## Profile - [API Evangelist profile](https://apis.io/provider/the-bank-of-london) - [Harvested OpenAPI](openapi/the-bank-of-london-api-openapi.json)