Feature Requests

I'd love the capability to purchase prepaid tokens through the Investec API. I'm most interested in being able to purchase prepaid electricity tokens so I can implement some automation around property management. Currently I need to manually do this through the app, or integrate with a third party, and I think this would be a great addition to the API. Let me know if there's any more input I can provide here!

Steps to reproduce the bug Go to https://developerbeta.investec.com/za/api-products/documentation/U0ElMjBDSUIlMjBBY2NvdW50JTIwSW5mb3JtYXRpb24%3D Try to build a client that interfaces with the described API Realise the documentation is incomplete Expected behaviour: I expect the API documentation to accurately reflect the API's behaviour. Actual behaviour: The provided urls are incorrect, eg: http://api.investec.com/za/bb/v1/accounts should be https://openapi.investec.com/za/bb/v1/accounts . The example requests suggest using a Basic auth header, though Bearer <token> also works. The response-type information provided by the documentation is incomplete. More information The response schema for http://api.investec.com/za/bb/v1/accounts , as far as I can determine with the CIB accounts I have access to can be represented as follows: (note: in order to figure out what is actually returned I'm validating the responses with Joi) const investecCIBAccountsResponseSchema = Joi.object({ data: Joi.object({ accounts: Joi.array().items( Joi.object({ AccountFormat: Joi.allow('99'), // TODO: some enum? AccountFullName: Joi.string().allow(''), AccountHolderAddress: Joi.object({ AddressLine1: Joi.string().allow(''), AddressLine2: Joi.string().allow(''), City: Joi.string().allow(''), Country: Joi.string().allow(''), CountryCode: Joi.string().allow(''), }), // TODO: investigate AccountId: Joi.string(), AccountName: Joi.string(), AccountNumber: Joi.string(), AccountOpenDate: Joi.string().isoDate(), AccountType: Joi.string(), AccountTypeId: Joi.string(), ActiveFlag: Joi.string().allow('Y', 'N'), // TODO: some enum? AlternativeAccNo: Joi.string().allow(''), AutomaticPaymentOrder: Joi.string(), BackOfficeCustomerCode: Joi.string(), BackOfficeType: Joi.string().allow(''), // TODO: some enum? Balances: Joi.object({ CapitalBalance: Joi.number(), AvailableBalance: Joi.number(), PrincipalAmount: Joi.number(), ValueDate: Joi.string().isoDate(), ClosingBalance: Joi.number(), PendingCardBalance: Joi.number(), // TODO: more properties? nullable? }), BankAccountProductType: Joi.string().allow(''), Banks: Joi.object({ Branch: Joi.array().items(Joi.object({ Number: Joi.string().allow('') })), ChipsUID: Joi.string().allow(''), Name: Joi.string(), PostalAddress: Joi.object({ AddressLine1: Joi.string().allow(''), AddressLine2: Joi.string().allow(''), City: Joi.string().allow(''), Country: Joi.string().allow(null), // TODO: more properties? nullable? }), // TODO: more properties? nullable? }), Category: Joi.string().allow('Invest'), // TODO: some enum? CreatedDate: Joi.string().isoDate(), CreditLastCycleToNextBusinessDate: Joi.string().isoDate(), CreditLimit: Joi.number(), CumulativeNoticesAmount: Joi.number(), Currencies: Joi.object({ CurrencyCode: Joi.string().allow('ZAR'), // TODO: which currency codes are supported // TODO: more properties? nullable? }), CustomerAccountType: Joi.string().allow(''), DealReference: Joi.string().allow(''), DebitAccountBankName: Joi.string().allow(''), DebitAccountNumber: Joi.string().allow(''), DebitLastCycleToNextBusinessDate: Joi.string().isoDate(), Description: Joi.string(), DueDateOfPayment: Joi.string().isoDate(), ElectronicAccountNumber: Joi.string().allow(''), EmailAddress: Joi.string().allow(''), InstantAvailableNoticeBalance: Joi.number(), InterestDistribution: Joi.string().allow(''), // TODO: some enum? Interests: Joi.object({ Amount: Joi.number(), Rate: Joi.number(), RateMaturity: Joi.number(), RateCredit: Joi.number(), RateDebit: Joi.number(), AccruedCreditInterest: Joi.number(), AccruedDebitInterest: Joi.number(), // TODO: more properties? nullable? }), LinkedAccount: Joi.string().allow(''), // TODO: what does this mean? loggedOnUser: Joi.object({ UserFirstName: Joi.string(), UserLastName: Joi.string(), UserCompany: Joi.string(), // TODO: more properties? nullable? }), MaturityAmount: Joi.number(), MinimimAmountLimit: Joi.number(), // TODO: spelling? MinimumAmountLimit: Joi.number(), ModifiedDate: Joi.string().isoDate(), NickName: Joi.string(), NoticeInterestAccount: Joi.string().allow(''), noticeInterestAccountName: Joi.string().allow(''), NoticeInterestBank: Joi.string().allow(''), NoticeInterestNominated: Joi.number(), NoticesBalance: Joi.number(), NumberOfCardHolders: Joi.number(), OwnerType: Joi.string(), // TODO: some enum? PendingTransactions: Joi.number(), PreviousStatementPeriod: Joi.string().isoDate(), Products: Joi.object({ StartDate: Joi.string().isoDate(), EndDate: Joi.string().isoDate(), OverdraftLimit: Joi.number(), MaxTransferLimit: Joi.number(), // TODO: more properties? nullable? }), RoutingBIC: Joi.string().allow(''), StatementDay: Joi.string(), // TODO: probably numeric? StatementFrequency: Joi.string().allow(''), StatementMonth: Joi.string().allow(''), StatementNumber: Joi.string().allow(''), }) ), }), meta: Joi.object({ totalPages: Joi.number(), }), links: Joi.object({ self: Joi.string().allow(null), }), });

Sandbox credentials are helpfully provided for auth on the API for individual use. Would be nice to have something similar for the 3-legged OAuth - for example an everlasting authorization code so one can test the API flow from the perspective of an OAuth'd user.

When attempting to access the cards endpoint ( https://openapi.investec.com/za/v1/cards ) with a token that does not have cards included in it's scope, a non-informative 200-response is returned: { "data": { "cards": "Error" }, "links": { "self": null }, "meta": { "totalPages": 1 } } It would be cool if this could return a 403 response explaining that the token does not have the cards scope.

As far as I know there are three scopes: cards , accounts and transactions . Only accounts is documented here Only accounts and transactions are documented here