The Ledger API provides unified read and write access to customers, accounts, cards, account balances, transactions, and fund movement.
What the API covers
- Customers: customer creation, retrieval and update.
- Accounts: account creation, edit, retrieval and virtual IBAN generation.
- Cards: card creation and card-to-account linking.
- Balances: account balance retrieval (single and aggregated views).
- Transactions: cross-type transaction search with rich filtering and pagination.
- Transfers: account-to-account transfers (same-currency or cross-currency with FX).
- Deposits: cash-in operations from external funding sources.
- Withdrawals: cash-out operations to external funding destinations.
PWS and REST operations
Customer and card operations are exposed in two styles: the PWS operations, marked PWS in their titles, are a 1-to-1 mapping to the upstream LUME APIs, and the REST-style operations, marked REST, are their replacements.
Authentication
Every request must include an OAuth 2.0 access token in the Authorization: Bearer <token> header.
Amounts
Monetary amounts are represented as strings of digits in minor units of the relevant currency (e.g., "10000" = 100.00 in the given currency).
Checking results
Customer, account and card calls can report a business error, such as an unknown account, in a successful HTTP response. Check the result code in every response before you continue.
Transaction status
Deposits, transfers and withdrawals can return 201 even when declined. Check status in the response: only COMPLETED means the funds moved. A business decline, such as insufficient funds, has status: REJECTED and a failure_reason.
Idempotency
transaction_reference is the idempotency key for deposits, transfers and withdrawals, so these calls are safe to retry. Resending the same request returns the original result, or retries it if the first attempt failed. Reusing a reference with a different body returns 409 IDEMPOTENCY_CONFLICT. Use a new reference for each new operation.
Request identifiers
Customer, account and card requests that send a body need a unique api_call_unique_identifier.