Welcome to LAFISE Open Banking API documentation. LAFISE Open Banking API is a cutting-edge financial solution that leverages on our vast banking experience over the past 30 years. With this API, LAFISE brings its expertise to the digital age, providing customers with easy-to-use, secure and reliable access to a range of financial services.
Note:This documentation is for developers and technical managers who want to integrate with our services to offer a financial solution. For program details, rules, and further implementation guidance, please contact your LAFISE representative.
📝 Open Banking Overview
With our API, businesses can leverage our extensive experience in the financial industry to offer their customers a comprehensive suite of banking services, while reducing development time and costs. Our API supports a wide range of use cases, from simple balance inquiries to more complex financial transactions, providing businesses with the flexibility and scalability needed to stay competitive in today's digital landscape.
📢 Who can use it
Our Open Banking API enables third-party developers, startups, and fintechs to seamlessly integrate our financial products and services into their digital platforms.
Note:The diagram above illustrates a Client that is a Home Institution that integrates Open Banking API.
📖 How it works
We offer various endpoints such as Account Information, Payment Initiation, Fund Transfer, Payment Status, Transaction History, and Account Holder, which allow users to manage their financial activities with ease. LAFISE's API utilizes advanced security measures, including OAuth 2.0 Authentication, SSL Encryption, Rate Limiting, and User Permissions, to ensure the security and stability of the platform. With LAFISE Open Banking API, our customers can access financial services seamlessly and efficiently, thus helping them to manage their finances more effectively.
LAFISE Open Banking is organized around REST and uses built-in HTTP features, standard response codes, authentication and verbs, allowing for quick implementation with standard HTTP packages used in all languages. The API accepts requests with a JSON body and returns JSON responses.
🔑 API Credentials
To start using our API, you must first obtain credentials for your team, interested parties need to become an Open Banking Allied by contacting our Open Banking Corporate Banking Office. Our team will provide all the necessary information and support to help customers become an Open Banking Allies and gain access to the API. At LAFISE, we are committed to providing our customers with exceptional service and support, and our Corporate Banking team is always available to assist with any queries related to our Open Banking API. So, if you're interested in accessing our API and becoming an Open Banking Allied, please reach out to our Corporate Banking team today.
📋 Next steps
Once a relationship with LAFISE has been established, customers will receive three key pieces of information: a client_id, a secret, and an API key. These credentials are essential for accessing and using our Open Banking API, and will be provided to customers by our Corporate team.
Once you have your credentials, to authenticate a request, you must first generate an Authorization Token using the "Authentication" API endpoint.
✅ IP Address Whitelist
As an additional security layer, LAFISE Open Banking API requires that your application's IP address be whitelisted before you can use the API. This means that we will only allow requests from the specific IP addresses that you have provided to us. By doing this, we help ensure that only authorized applications are accessing the API, thereby enhancing the security of our platform and protecting user data.
To whitelist your application's IP address, please contact our Corporate Banking team and provide the necessary details. Our team will guide you through the process and ensure that your application is granted access to the API as soon as possible. At LAFISE, we take security very seriously, and this additional layer of protection is just one of the ways we ensure that our customers' data is safe and secure when using our Open Banking API.
🌎 Regional Scope API
Our Open Banking API is regional, covering Central America. To make requests to the API, you must specify the country code where your customer is located. The scope of the API currently covers five countries: Nicaragua (BLNI), Honduras (BLHN), Costa Rica (BLCR), Panamá (BLPA), and Dominican Republic (BLRD). This is an important feature as it allows you, as a developer, to target all the countries where LAFISE is present with a single integration to our API, streamlining the development process and reducing time-to-market for your products and services.
The following country codes will allow you identifying which bank the request will be sent to and all related information.
| Code | Description |
|---|---|
BLNI | Banco LAFISE Nicaragua |
BLCR | Banco LAFISE Panamá |
BLPA | Banco LAFISE República Dominicana |
BLHN | Banco LAFISE Costa Rica |
BLRD | Banco LAFISE Honduras |
📝 Glossary
| Term | Description |
|---|---|
| Access Token | A token which is retrieved by the Client after a successful access authorization flow. The access token is used by the API to authenticate Clients. The access token does not contain any information that the Client (or client's application) can use. |
| API | Application Programming Interface. A set of definitions, protocols, and tools that can be used to create applications, interact with other applications, and exchange data. |
| API Call | API call is a request towards an API which produces a response. The API is by design stateless, and therefore it does not "remember" anything about previous requests, i.e., there is no session. Therefore every request made towards the API must contain certain headers so that the API can authenticate and authorize the client. |
| ASPSP | Account Servicing Payment Services Provider. An entity authorized to operate customer accounts, with a line of credit and payment facilities online. |
| Authorization | Authorization is the process through which the Client obtains permission to access the Resource Owner's data and services at the bank. |
| Authorization Code | An authorization code is a code provided to the Client during the access authorization flow; this code is short-lived and exchanged for an Access Token. |
| Authorizer | Authorizer - Authorizers are strictly required for both account access and payment initiation requests. The minimum number of Authorizers is 1 although the customer may demand that two or more Authorizers act together, on the Resource Owner's behalf, to confirm any request. |
| Authorizer Authentication | Authorizer authentication: the process which provides the correct identity of an Authorizer acting to confirm the access request or payment confirmation on behalf of the Resource Owner. |
| Client | The client refers to the consumer of the API. This is commonly an application provided by the corporate customer or a regulated third-party provider. |
| Consent | Consent is agreed between the Resource Owner (customer) and the Client (TPP). It includes what data may be shared, what services may be performed on the Resource Owner's behalf, the duration of the agreement and to what purpose the data/services are provided. Consent agreed between Resource Owner and Client, informs the access authorization flow. |
| Sandbox | Sandbox, in the context of the Corporate APIs, is a test environment facility where the data returned by the API consists of example data. Its purpose is to mimic the real / production version of the API. The sandbox will always have available the latest published version of the API, this means that all new versions appear in sandbox before they are introduced into the production. |
| Third-Party Provider (TPP) | A TPP is a regulated provider of one or more applications which Resource Owners (customers) can use to access their accounts/services via the API. A TPP is one type of API client/consumer. See also Corporate Direct Access. |