swagger: '2.0' info: license: name: Yodlee Developer License url: https://developer.yodlee.com/terms/condition#_Services_1 contact: email: developer@yodlee.com description: 'This file describes the Yodlee Platform APIs using the swagger notation. You can use this swagger file to generate client side SDKs to the Yodlee Platform APIs for many different programming languages. Yodlee API v1.1 - Overview.

You will have to set the header before making the API call. The following headers apply to all the APIs:Note: If there are any API-specific headers, they are mentioned explicitly in the respective API''s description.' termsOfService: https://developer.yodlee.com/terms/condition title: Yodlee Core APIs Account Token Auth API version: 1.1.0 basePath: / tags: - name: Auth description: Auth API paths: /auth/token: post: summary: Generate Access Token deprecated: false produces: - application/json;charset=UTF-8 description: Generate Access Token using client credential authentication.
This service returns access tokens required to access Yodlee 1.1 APIs. These tokens are the simplest and easiest of several alternatives for authenticating with Yodlee servers.
The most commonly used services obtain data specific to an end user (your customer). For these services, you need a user access token. These are simply tokens created with the user name parameter (loginName) set to the id of your end user.

Note: You determine this id and you must ensure it's unique among all your customers.

Each token issued has an associated user. The token passed in the http headers explicitly names the user referenced in that API call.

Some of the APIs do administrative work, and don't reference an end user.
One example of administrative work is key management. Another example is registering a new user explicitly, with POST /user/register call or subscribe to webhook, with POST /config/notifications/events/{eventName}.
To invoke these, you need an admin access token. Create this by passing in your admin user login name in place of a regular user name.

This service also allows for simplified registration of new users. Any time you pass in a user name not already in use, the system will automatically implicitly create a new user for you.
This user will naturally have very few associated details. You can later provide additional user information by calling the PUT user/register service.

Notes: operationId: generateAccessToken responses: 201: schema: $ref: '#/definitions/ClientCredentialTokenResponse' description: OK 400: schema: $ref: '#/definitions/YodleeError' description: 'Y800 : Invalid value for loginName
Y806 : Invalid input
Y801 : Invalid length for loginName
Y303 : clientId or secret is missing
Y301 : Invalid clientId or secret
Y305 : Access token can be issued only for pre-registered users
Y004 : Inactive user
Y901 : Service not supported
' 401: schema: $ref: '#/definitions/YodleeError' description: 'Y016 : loginName header missing
Y015 : Unauthorized User
Y016 : Api-Version header missing
Y020 : Invalid token in authorization header
Y027 : Unsupported authentication type' 404: description: Not Found parameters: - in: formData name: clientId description: clientId issued by Yodlee is used to generate the OAuth token for authentication. type: string required: false - in: formData name: secret description: secret issued by Yodlee is used to generate the OAuth token for authentication. type: string required: false tags: - Auth consumes: - application/x-www-form-urlencoded delete: summary: Delete Token deprecated: false produces: - application/json;charset=UTF-8 description: This endpoint revokes the token passed in the Authorization header. This service is applicable for JWT-based (and all API key-based) authentication and also client credential (clientId and secret) based authentication. This service does not return a response body. The HTTP response code is 204 (success with no content).
Tokens generally have limited lifetime of up to 30 minutes. You will call this service when you finish working with one user, and you want to delete the valid token rather than simply letting it expire.

Note:
  • Revoking an access token (either type, admin or a user token) can take up to 2 minutes, as the tokens are stored on a distributed system.
    operationId: deleteToken responses: 401: schema: $ref: '#/definitions/YodleeError' description: 'Y020 : Invalid token in authorization header
    Y023 : Token has expired
    Y016 : Api-Version header missing
    Y015 : Unauthorized User
    Y027 : Unsupported authentication type
    Y007 : Authorization header missing
    Y020 : Invalid token in authorization header' 204: description: No Content 404: description: Not Found tags: - Auth /auth/apiKey/{key}: delete: summary: Delete API Key deprecated: false produces: - application/json;charset=UTF-8 description: 'This endpoint allows an existing API key to be deleted.
    You can use one of the following authorization methods to access this API:
    1. cobsession
    2. JWT token
    Notes:
  • This service is not available in developer sandbox environment and will be made availablefor testing in your dedicated environment. ' operationId: deleteApiKey responses: 201: description: OK 400: schema: $ref: '#/definitions/YodleeError' description: 'Y807 : Resource not found
    Y806 : Invalid input' 401: description: Unauthorized 204: description: No Content 404: description: Not Found parameters: - in: path name: key description: key type: string required: true tags: - Auth /auth/apiKey: post: summary: Generate API Key deprecated: false produces: - application/json;charset=UTF-8 description: 'This endpoint is used to generate an API key. The RSA public key you provide should be in 2048 bit PKCS#8 encoded format.
    A public key is a mandatory input for generating the API key.
    The public key should be a unique key. The apiKeyId you get in the response is what you should use to generate the JWT token.
    You can use one of the following authorization methods to access
    this API:
    1. cobsession
    2. JWT token
    Alternatively, you can use base 64 encoded cobrandLogin and cobrandPassword in the Authorization header (Format: Authorization: Basic )

    Note:
  • This service is not available in developer sandbox environment and will be made available for testing in your dedicated environment. The content type has to be passed as application/json for the body parameter.
    • ' operationId: generateApiKey responses: 201: schema: $ref: '#/definitions/ApiKeyResponse' description: OK 400: schema: $ref: '#/definitions/YodleeError' description: 'Y800 : Invalid value for RS512 publicKey
    Y806 : Invalid input
    Y824 : The maximum number of apiKey permitted is 5
    Y811 : publicKey value already exists' 401: description: Unauthorized 404: description: Not Found parameters: - schema: $ref: '#/definitions/ApiKeyRequest' in: body name: apiKeyRequest description: apiKeyRequest required: true tags: - Auth consumes: - application/json get: summary: Get API Keys deprecated: false produces: - application/json;charset=UTF-8 description: 'This endpoint provides the list of API keys that exist for a customer.
    You can use one of the following authorization methods to access this API:
    1. cobsession
    2. JWT token
    Notes:
  • This service is not available in developer sandbox environment and will be made available for testing in your dedicated environment. ' operationId: getApiKeys responses: 200: schema: $ref: '#/definitions/ApiKeyResponse' description: OK 401: description: Unauthorized 404: description: Not Found tags: - Auth definitions: ClientCredentialToken: type: object title: ClientCredentialToken properties: expiresIn: format: int32 description: Time in seconds after which the issued accessToken expires.

    Endpoints: readOnly: true type: integer issuedAt: description: The date and time on which accessToken was created for the customer.

    Endpoints: readOnly: true type: string accessToken: description: Access Token to access YSL 1.1 services.

    Endpoints: readOnly: true type: string ApiKeyOutput: type: object title: ApiKeyOutput properties: expiresIn: format: int64 description: Time in seconds after which the JWT token created for users expires.

    Endpoints: type: integer createdDate: description: The date on which the apiKey was created for the customer.

    Endpoints: type: string publicKey: minLength: 1 description: Public key uploaded by the customer while generating ApiKey.

    Endpoints: type: string maxLength: 2147483647 key: description: ApiKey or the issuer key used to generate the JWT token for authentication.

    Endpoints: type: string ApiKeyRequest: type: object title: ApiKeyRequest properties: publicKey: minLength: 1 description: Public key uploaded by the customer while generating ApiKey.

    Endpoints: type: string maxLength: 2147483647 ApiKeyResponse: type: object title: ApiKeyResponse properties: apiKey: description: ApiKey customer details.

    Endpoints: type: array items: $ref: '#/definitions/ApiKeyOutput' ClientCredentialTokenResponse: type: object title: ClientCredentialTokenResponse properties: token: $ref: '#/definitions/ClientCredentialToken' YodleeError: type: object title: YodleeError properties: errorMessage: description: The descriptive message that explains the error scenario. readOnly: true type: string errorCode: description: The error code follows the format YNNN. The error codes do not change. New error codes may be added as we introduce new features and enhance functionalities. readOnly: true type: string referenceCode: description: Unique Yodlee identifier used to troubleshoot issues at Yodlee's end. readOnly: true type: string