Feature Requests

The /za/pb/v1/accounts/beneficiaries endpoint doesn't seem to return approved beneficiaries e.g. City of Joburg municipality account. Municipalities don't provide raw bank account details anymore so there's no real workaround to make payments to municipalities. Could we get these beneficiaries returned in the API so we can make payments to them programmatically?

I'd love the capability to purchase prepaid tokens through the Investec API. I'm most interested in being able to purchase prepaid electricity tokens so I can implement some automation around property management. Currently I need to manually do this through the app, or integrate with a third party, and I think this would be a great addition to the API. Let me know if there's any more input I can provide here!

Steps to reproduce the bug Go to https://developerbeta.investec.com/za/api-products/documentation/U0ElMjBDSUIlMjBBY2NvdW50JTIwSW5mb3JtYXRpb24%3D Try to build a client that interfaces with the described API Realise the documentation is incomplete Expected behaviour: I expect the API documentation to accurately reflect the API's behaviour. Actual behaviour: The provided urls are incorrect, eg: http://api.investec.com/za/bb/v1/accounts should be https://openapi.investec.com/za/bb/v1/accounts . The example requests suggest using a Basic auth header, though Bearer <token> also works. The response-type information provided by the documentation is incomplete. More information The response schema for http://api.investec.com/za/bb/v1/accounts , as far as I can determine with the CIB accounts I have access to can be represented as follows: (note: in order to figure out what is actually returned I'm validating the responses with Joi) const investecCIBAccountsResponseSchema = Joi.object({ data: Joi.object({ accounts: Joi.array().items( Joi.object({ AccountFormat: Joi.allow('99'), // TODO: some enum? AccountFullName: Joi.string().allow(''), AccountHolderAddress: Joi.object({ AddressLine1: Joi.string().allow(''), AddressLine2: Joi.string().allow(''), City: Joi.string().allow(''), Country: Joi.string().allow(''), CountryCode: Joi.string().allow(''), }), // TODO: investigate AccountId: Joi.string(), AccountName: Joi.string(), AccountNumber: Joi.string(), AccountOpenDate: Joi.string().isoDate(), AccountType: Joi.string(), AccountTypeId: Joi.string(), ActiveFlag: Joi.string().allow('Y', 'N'), // TODO: some enum? AlternativeAccNo: Joi.string().allow(''), AutomaticPaymentOrder: Joi.string(), BackOfficeCustomerCode: Joi.string(), BackOfficeType: Joi.string().allow(''), // TODO: some enum? Balances: Joi.object({ CapitalBalance: Joi.number(), AvailableBalance: Joi.number(), PrincipalAmount: Joi.number(), ValueDate: Joi.string().isoDate(), ClosingBalance: Joi.number(), PendingCardBalance: Joi.number(), // TODO: more properties? nullable? }), BankAccountProductType: Joi.string().allow(''), Banks: Joi.object({ Branch: Joi.array().items(Joi.object({ Number: Joi.string().allow('') })), ChipsUID: Joi.string().allow(''), Name: Joi.string(), PostalAddress: Joi.object({ AddressLine1: Joi.string().allow(''), AddressLine2: Joi.string().allow(''), City: Joi.string().allow(''), Country: Joi.string().allow(null), // TODO: more properties? nullable? }), // TODO: more properties? nullable? }), Category: Joi.string().allow('Invest'), // TODO: some enum? CreatedDate: Joi.string().isoDate(), CreditLastCycleToNextBusinessDate: Joi.string().isoDate(), CreditLimit: Joi.number(), CumulativeNoticesAmount: Joi.number(), Currencies: Joi.object({ CurrencyCode: Joi.string().allow('ZAR'), // TODO: which currency codes are supported // TODO: more properties? nullable? }), CustomerAccountType: Joi.string().allow(''), DealReference: Joi.string().allow(''), DebitAccountBankName: Joi.string().allow(''), DebitAccountNumber: Joi.string().allow(''), DebitLastCycleToNextBusinessDate: Joi.string().isoDate(), Description: Joi.string(), DueDateOfPayment: Joi.string().isoDate(), ElectronicAccountNumber: Joi.string().allow(''), EmailAddress: Joi.string().allow(''), InstantAvailableNoticeBalance: Joi.number(), InterestDistribution: Joi.string().allow(''), // TODO: some enum? Interests: Joi.object({ Amount: Joi.number(), Rate: Joi.number(), RateMaturity: Joi.number(), RateCredit: Joi.number(), RateDebit: Joi.number(), AccruedCreditInterest: Joi.number(), AccruedDebitInterest: Joi.number(), // TODO: more properties? nullable? }), LinkedAccount: Joi.string().allow(''), // TODO: what does this mean? loggedOnUser: Joi.object({ UserFirstName: Joi.string(), UserLastName: Joi.string(), UserCompany: Joi.string(), // TODO: more properties? nullable? }), MaturityAmount: Joi.number(), MinimimAmountLimit: Joi.number(), // TODO: spelling? MinimumAmountLimit: Joi.number(), ModifiedDate: Joi.string().isoDate(), NickName: Joi.string(), NoticeInterestAccount: Joi.string().allow(''), noticeInterestAccountName: Joi.string().allow(''), NoticeInterestBank: Joi.string().allow(''), NoticeInterestNominated: Joi.number(), NoticesBalance: Joi.number(), NumberOfCardHolders: Joi.number(), OwnerType: Joi.string(), // TODO: some enum? PendingTransactions: Joi.number(), PreviousStatementPeriod: Joi.string().isoDate(), Products: Joi.object({ StartDate: Joi.string().isoDate(), EndDate: Joi.string().isoDate(), OverdraftLimit: Joi.number(), MaxTransferLimit: Joi.number(), // TODO: more properties? nullable? }), RoutingBIC: Joi.string().allow(''), StatementDay: Joi.string(), // TODO: probably numeric? StatementFrequency: Joi.string().allow(''), StatementMonth: Joi.string().allow(''), StatementNumber: Joi.string().allow(''), }) ), }), meta: Joi.object({ totalPages: Joi.number(), }), links: Joi.object({ self: Joi.string().allow(null), }), });

Sandbox credentials are helpfully provided for auth on the API for individual use. Would be nice to have something similar for the 3-legged OAuth - for example an everlasting authorization code so one can test the API flow from the perspective of an OAuth'd user.

When attempting to access the cards endpoint ( https://openapi.investec.com/za/v1/cards ) with a token that does not have cards included in it's scope, a non-informative 200-response is returned: { "data": { "cards": "Error" }, "links": { "self": null }, "meta": { "totalPages": 1 } } It would be cool if this could return a 403 response explaining that the token does not have the cards scope.

As far as I know there are three scopes: cards , accounts and transactions . Only accounts is documented here Only accounts and transactions are documented here

Just some inconsistencies I've picked up: Account & transactions have their data contents in data.accounts / data.transactions , but beneficiary categories does not have an equivalent categories array. PB docs have incorrect key casing for the get beneficiaries call, and the beneficiary categories doc has outdated key names (e.g. id instead of CategoryId). Key casing on beneficiary categories is PascalCase instead of camelCase as used everywhere else.

Would love (actually need - without this, the API is of no use to our business) to be able to transact more than the currently fixed limit of R20k.

Allow to make use of PayShap via API

Instead of having to query for all beneficiaries and then filter, add an endpoint to get a specific beneficiary