Belvo API Docs (1.222.0)

Introduction

Reach new audiences and convert more users by easily and safely connecting to their financial data, understanding their behavior and enabling instant payments with open finance. Through our API, you can access:

Available Information and Payment Methods

Belvo is an open banking API for Latin America that allows companies to access banking and fiscal information in a secure as well as agile way.

Through our API, you can access:

Banking Information in Brazil
Employment Information in Brazil
Employment Information in Mexico
Fiscal Information in Mexico
Fiscal Information in Chile

You can also use our API to make payments in:

Brazil
Mexico

Data Dictionaries

If you woud like the response documentation in Excel or CSV form, please download them from our public GitHub Reposiitory: Belvo Open Finance Data Dictionaries.

Our EXCEL and CSV files are additionally localized into Spanish and Portuguese (Brazil).

Environments

We currently offer two environments: sandbox and production.

Sandbox

Available for:

🟢 Aggregation and Enrichment
⚪️ Payment Initiation

Use our Sandbox environment to build your integration. We offer dummy data that mimics that of real-world use cases, which means you can test out all the endpoints, use the widget, and implement webhooks - just as you would with real-world data!

All you need to get started with the Sandbox environment is to get your API keys. We really recommend that you start creating your integration in this environment.

Production

Available for:

🟢 Aggregation and Enrichment
🟢 Payment Initiation

After you have tested your integration in the Sandbox environment and are ready to go live, you'll need to request access to our Production environment. After you request access, our Sales Team will get in contact with you to schedule a meeting just to ensure your needs are met, and then you'll just need to go through a certification process with one of our engineers to make sure that your integration is running optimally. To prepare for the certification meeting, just follow our Integration checklist.

Once your integration is certified, all you'll need to do is:

Request Production API keys (and change your Sandbox API keys in the code to these new ones).
Change the base URL that you make requests to from sandbox.belvo.com to api.belvo.com.
If you're using webhooks, make sure to set a Production URL for your webhooks.

Response codes

We use the following HTTP status code in the response depending on the success or failure:

Status Code	Description
`200`	✅ Success - The content is available in the response body.
`201`	✅ Success - The content was created successfully on Belvo.
`204`	✅ Success - No content to return.
`400`	❌ Bad Request Error - Request returned an error, detail in the content.
`401`	❌ Unauthorized - The Belvo credentials provided are not valid.
`404`	❌ Not Found - The resource you try to access cannot be found.
`405`	❌ Method Not Allowed - The HTTP method you are using is not accepted for this resource.
`408`	❌ Request Timeout - The request timed out and was terminated by the server.
`428`	❌ MFA Token Required - MFA token was required by the institution to connect.
`500`	❌ Internal Server Error - The detail of the error is available in the response body.

Error handling

Belvo API errors are returned in JSON format. For example, an error might look like this:

[
    {
      "request_id": "a6e1c493d7a29d91aed4338e6fcf077d",
      "message": "This field is required.",
      "code": "required",
      "field": "link"
    }
]

Typically, an error response will have the following parameters:

request_id: a unique ID for the request, you should share it with the Belvo support team for investigations.
message: human-readable description of the error.
code: a unique code for the error. Check the table below to see how to handle each error code.
field (optional): The specific field in the request body that has an issue.

Request identifier

When you need help with a specific error, include the request identifier (request_id) in your message to the Belvo support team. This will speed up investigations and get you back up and running in no time at all.

Error codes and troubleshooting

For a full list of errors and how to troubleshoot them, please see our dedicated Error Handling article.

Retry policy

50x errors

Implement an automated exponential backoff of up to five retries. We recommend using a base interval of three seconds with a factor of two. For example, the first retry should be after three seconds, the second retry after six seconds (2 * 3), the third retry after 12 seconds (2 * 6), the fourth retry after 24 seconds (2 * 12), and the fifth retry after 48 seconds (2 * 24).

40x errors

You should not retry making requests if you receive a 40x response, as this is a client error.

The only exception is the “Too Many Sessions” error, as it means that your end-user is accessing the account from another browser at the same time. In this case, please implement the same retry policy as with 50x errors.

Deprecated fields

In our schema, you may see that a field has been marked as deprecated. This means that this field is no longer maintained by the Belvo team. You may still receive data for this field depending on the institution, however, you should not rely on this field.

OpenAPI: required and nullable fields

In our API specification, you'll see that some response parameters will have a required annotation. According to the OpenAPI specification, when a response parameter is marked as required, this means that the response key must be returned. However, the value of that response parameter can be null.

📘 Info
In short, any response parameter marked as required will be returned by our API, but the value can be set to null.

Download OpenAPI description

BelvoOpenApiSpec.json

BelvoOpenApiSpec.yaml

Overview

URL

https://developers.belvo.com

Need help?

support@belvo.com

Servers

Mock server

https://developers.belvo.com/_mock/apis/belvoopenapispec/

Sandbox

https://sandbox.belvo.com/

Institutions

An institution is an entity that Belvo can access information from. It can be a:

bank institution, such as Nubank Brazil.
fiscal institution, such as the Servicio de Administración Tributaria (SAT) in Mexico.
employment institutions, such as Instituto Mexicano del Seguro Social (IMSS) in Mexico or Instituto Nacional do Seguro Social (INSS) in Brazil.

Operations

Links

A Link is a set of credentials associated to an end-user's access to an institution. You will need to register a Link before accessing information from that specific end-user, such as account or transaction details.

We recommend using the Belvo Hosted Widget to manage the connection process.

Operations

Update a link's credentials

Request

Update the credentials of a specific link. If the successfully updated link is a recurrent one, we automatically trigger an update of the link. If we find fresh data, you'll receive historical update webhooks.

👍 Use our Connect Widget
We recommend using our Connect Widget to handle updating invalid or token_required links.

Security

basicAuth

Path

idstring(uuid)required

The link.id you want to update.

Bodyapplication/jsonrequired

passwordstringrequired

The end-user's password used to log in to the institution.

Example: "password"

password2string

The end-user's second password used to log in to the institution.

📘 Info
This is only required by some institutions. To know which institutions require a second password, see our List institution request and check the form_fields array in the response.

Example: "pin"

tokenstring

The MFA token generated by the institution which is required to continue a session.

Example: "1234ab"

curl -i -X PUT \
  -u <username>:<password> \
  'https://developers.belvo.com/_mock/apis/belvoopenapispec/api/links/{id}/' \
  -H 'Content-Type: application/json' \
  -d '{
    "password": "password",
    "password2": "pin",
    "token": "1234ab"
  }'

Responses

Bodyapplication/json

idstring(uuid)

Belvo's unique identifier for the current item.

Example: "0d3ffb69-f83b-456e-ad8e-208d0998d71d"

institutionstring

Belvo's name for the institution.

Example: "erebor_mx_retail"

access_modestring or null

The link type. For more information, see our Links article. We return one of the following enum values:

single
recurrent
null

Enum"single""recurrent"null

Example: "recurrent"

last_accessed_atstring or null(date-time)

The ISO-8601 timestamp of Belvo's most recent successful access to the institution for the given link.

Example: "2021-03-09T10:28:40.000Z"

created_atstring(date-time)

The ISO-8601 timestamp of when the data point was created in Belvo's database.

Example: "2022-02-09T08:45:50.406032Z"

external_idstring[ 3 .. 256 ] characters

An additional identifier for the link, provided by you, to store in the Belvo database. Cannot include any Personal Identifiable Information (PII). Must be at least three characters long.

If we identify that the identifier contains PII, we will force a null value. For more information, see our Link creation article.

Example: "56ab5706-6e00-48a4-91c9-ca55968678d9"

institution_user_idstring[A-Za-z0-9\-=_]{44}

📘 Info
Only applicable for links created after 08-02-2022.

A unique 44-character string that can be used to identify a user at a given institution.

📚 Check out our Avoiding duplicated links DevPortal article for more information and tips on how to use it.

Example: "sooE7XJWEKypZJR603ecaWYk-8Ap0oD8Nr1pBQ4eG9c="

statusstring

The current status of the link. For more information, see our Link article in the devportal. We return one of the following values:

valid
invalid
unconfirmed
token_required

Enum"valid""invalid""unconfirmed""token_required"

Example: "valid"

created_bystring(uuid)

The unique ID for the user that created this item.

Example: "bcef7f35-67f2-4b19-b009-cb38795faf09"

refresh_ratestring or null

The update refresh rate for the recurrent link. For more information, check out our recurrent link documentation in our DevPortal. We return one of the following enum values:

6h
12h
24h
7d (default)
30d (once a month)
null (for single links)

Default "7d"

Enum"6h""12h""24h""7d""30d"null

Example: "7d"

credentials_storagestring^(store|nostore|\d{1,3}d)$

Indicates whether or not to store credentials (and the duration for which to store the credentials).

For recurrent links, this is set to store by default (and cannot be changed).
For single links, this is set to 365d by default.

Can be either:

store to store credentials (until the link is deleted)
nostore to not store credentials
Any value between 1d and 365d to indicate the number of days you want the credentials to be stored.

For more information, check out the credentials_storage section of our Data retention controls article.

Example: "27d"

fetch_resourcesArray of strings

An array of resources that you will receive a historical update for.

Example: ["ACCOUNTS","TRANSACTIONS"]

stale_instring^\d{1,3}d$

Indicates how long any user-derived data should be stored in Belvo's database for the link (both single and recurrent). For example, if you send through 90d, Belvo will remove any data from its database relating to the user after 90 days. For more information, check out the stale_in section of our Data retention controls article.

📘 Info
Belvo will only remove data for links that have not been updated in the period you provide in stale_in. Belvo will only remove data for links that have not been updated in the period you provide in stale_in.

By default Belvo stores user data for 365 days, unless the link is deleted.

Example: "42d"

Response

application/json

{
  "id": "0d3ffb69-f83b-456e-ad8e-208d0998d71d",
  "institution": "erebor_mx_retail",
  "access_mode": "recurrent",
  "last_accessed_at": "2021-03-09T10:28:40.000Z",
  "created_at": "2022-02-09T08:45:50.406032Z",
  "external_id": "56ab5706-6e00-48a4-91c9-ca55968678d9",
  "institution_user_id": "sooE7XJWEKypZJR603ecaWYk-8Ap0oD8Nr1pBQ4eG9c=",
  "status": "valid",
  "created_by": "bcef7f35-67f2-4b19-b009-cb38795faf09",
  "refresh_rate": "7d",
  "credentials_storage": "27d",
  "fetch_resources": [
    "ACCOUNTS",
    "TRANSACTIONS"
  ],
  "stale_in": "42d"
}

Delete a link

Request

Delete a specific link and all the associated data (for example: transactions, accounts, invoices, tax returns, employments, and so on) for that link from your Belvo account. This action is irreversible, and you will not be able to recover the deleted data.

Use the X-Belvo-Request-Mode: async header

We highly recommend setting the X-Belvo-Request-Mode header to async to enable asynchronous deletion. This way, you will avoid the rate limit of 5 deletions per minute. When set, the endpoint will respond with a 202 Accepted status and provide a request ID for tracking the deletion process. Once the process is complete, you will receive a link_deleted webhook notification.

If you do not set this header, the endpoint will respond with a 204 No Content status, but you will be subject to the rate limit of 5 deletions per minute. If you exceed this limit, you will receive a 429 Too Many Requests error.

Security

basicAuth

Path

idstring(uuid)required

The link.id that you want to delete.

Headers

X-Belvo-Request-Modestring

Set to async to enable asynchronous deletion, which bypasses rate limiting. When set, the endpoint returns a 202 Accepted response with a request ID. You will later receive a webhook notification when the deletion is complete.

Value"async"

curl -i -X DELETE \
  -u <username>:<password> \
  'https://developers.belvo.com/_mock/apis/belvoopenapispec/api/links/{id}/' \
  -H 'X-Belvo-Request-Mode: async'

Responses

Accepted

Bodyapplication/json

request_idstring(uuid)required

The unique identifier for tracking the async deletion request.

Response

application/json

{
  "request_id": "266ea41d-adf5-480b-af50-15b940c2b846"
}

Trigger a historical update for a link

Request

Concurrent Request Limit

To prevent duplicate requests, this endpoint has a 10-minute cooldown period per link. If you attempt to refresh the same link within 10 minutes of a previous request, you will receive a 409 Conflict error with the message "The link has already been refreshed. Please wait X minutes before trying again.".

Use this method to trigger a historical update for a specific link (single or recurrent). Use the fetch_resources parameter to specify which resources you want to update. If you do not specify this parameter, the historical update will be performed for all resources supported by the institution that the link is associated with.

On a successful request, our API will respond with a 202 status code and a request_id that you can later use to associate a given historical_update webhook to this request.

Does not update link definition

This endpoint does not update the link definition itself, only the historical data for the specified resources. If you want to change the link's fetch_resources permanently, you should use the Modify a link's data retrieval method instead.

Security

basicAuth

Path

idstring(uuid)required

The link.id you want to refresh.

Example: e4bb1afb-4a4f-4dd6-8be0-e615d233185b

Bodyapplication/json

fetch_resourcesArray of strings

An array of resources that you would like to receive a historical update for. If you do not specify this field, the historical update will be performed for all resources supported by the institution.

Unsupported Resources for a Link

If you specify a resource that is not supported by the institution, we return a 400 Bad Request error, specifying which resources are supported for the given link.

Example: ["ACCOUNTS","TRANSACTIONS","OWNERS"]

curl -i -X POST \
  -u <username>:<password> \
  https://developers.belvo.com/_mock/apis/belvoopenapispec/api/links/e4bb1afb-4a4f-4dd6-8be0-e615d233185b/refresh/ \
  -H 'Content-Type: application/json' \
  -d '{
    "fetch_resources": [
      "ACCOUNTS",
      "TRANSACTIONS",
      "OWNERS"
    ]
  }'

Responses

Historical Refresh Request Accepted

Bodyapplication/json

request_idstringrequired

The unique ID for this request. We recommend you store this value to later identify which webhook event relates to an asynchronous request.

Example: "b5d0106ac9cc43d5b36199fe831f6bbe"

Response

application/json

{
  "request_id": "b5d0106ac9cc43d5b36199fe831f6bbe"
}

Consents

A consent is a permission given by the end user to access their financial data in the Open Finance Network in Brazil.

Operations

Owners

An owner represents the person who has access to a Link and is the owner of all the accounts inside the Link.

You can use this endpoint in order to get useful information about your client, such as:

their full name
key contact information
information about the ID document they used when opening the account

Operations

Accounts

An account is the representation of a bank account inside a financial institution. A user can have one or more accounts in an institution.

For example, one user (or link) can have a checking account, several credit cards, and a loan account.

Querying for a user's account information is useful as you can get information regarding:

what types of accounts the user has.
the balance for each account (savings, checking, credit card, loan, and so on).
detailed information regarding their credit card spending.
the current situation of any loans they may have.

Operations

Balances

A balance is the amount of money available in a given bank account (checking or savings) at a given time.

Operations

Transactions

A transaction contains the detailed information of each movement inside an account. For example, a purchase at a store or a restaurant.

Operations

Bills

A bill refers to the credit card bill a user receives for a given account.

Operations

Investments Brazil

Operations

Investment Transactions Brazil

Operations

Employments Brazil

Our employments resource for Brazil lets you get a comprehensive view of your user's current employment history and salary information.

For each user, we return the:

work history (including occupations and employer data)
historical and current salary information (per employer)

At the moment, the employments resource is available for:

🇧🇷 Brazil (INSS)

Operations

Employment Records Mexico

Our employment records resource for Mexico lets you get a comprehensive view of your user’s current social security contributions and employment history.

With Belvo's employment records resource for Mexico, you can access information about your user's current social security contributions and employment history. For the each user, we return the:

personal data
work history
historical and current daily base salary
and more!

At the moment, the employment records resource is available for:

🇲🇽 Mexico (IMSS)
🇲🇽 Mexico (ISSSTE)

Operations

Current Employments Mexico

The Current Employments resource provides real-time access to the current employment status of individuals in Mexico. This resource offers detailed information about whether an individual is currently employed or unemployed, along with their active employment records.

Operations

Invoices

Operations

Tax compliance status

Operations

Tax returns

Operations

Tax retentions

Operations

Tax status

Operations

Financial Statements

Operations

Invoices Chile

Operations

Tax Status Chile

Operations

Debt Reports Chile

Operations

Incomes

Use the Incomes endpoint to gather insights on an account's income sources for the past 365 days. The endpoint is particularly useful when you want to verify a person's income.

📘 Info
The incomes resource is only available for Checking and Savings accounts associated with banking links.

Operations

Recurring Expenses

Belvo's Recurring Expenses API allows you to identify a user's regular payments for subscription services, such as Netflix or gym memberships, as well as utility payments, such as electricity or phone bills. We return information for up to 365 days.

📘 Info
The recurring expenses resource is only available for Checking, Savings and Credit Card accounts associated with banking links.

Operations

Risk Insights

Operations

Employment Metrics

Operations

Payment Institutions (Brazil)

A payment institution is an entity that Belvo can access information from. You can see a complete list of institutions available for payments by making a List request to this endpoint.

Operations

Customers (Brazil)

A customer is the payer that's going to push funds into your bank account. You need to create a customer in order to receive inflow payments to your organization's bank account.

Operations

Bank Accounts (Brazil)

To receive inflow payments to your organization's bank account, you must register the bank accounts (individual and business) using Belvo's Payments API.

Individual bank accounts must be created for each payer (your customer).
Business bank accounts need to be created for the beneficiary of the payment (your organization).

Operations

Payment Links (Brazil)

This is a Payment link.

Operations

Payment Intents (Brazil)

A payment intent is a single point of access to create payments using any payment method offered by Belvo.

A payment intent captures all payment information (such as the amount to be charged, the description of the payment, the provider, and so on) and guides your customers through the payment flow.

Note: For institutions that require the username_type in the form_fields array, you must send through this value in your PATCH request.

Operations

Payment Authorizations (Brazil)

A Payment Authorization is the consent that your user gives you to charge (debit money from) their accounts. You need to perform one Payment Authorization per ‘contract’ (for example, if your company does both electricity and water but they are billed separately, then you will create two separate Payment Authorizations).

Once the user confirms the authorization, you will need to listen for a a PAYMENT_AUTHORIZATION webhook with the status set to AUTHORIZED. Once you receive this webhook, the authorization process is complete, and you will be able to charge your user.

What is a charge?

A charge represents the individual payment (debit) that your customer will make.

Version Header

The Payment Authorization resource requires that you send through the X-Belvo-API-Resource-Version header set to Payments-BR.V2.

Operations

Enrollments (Brazil)

Operations

Payment Transactions (Brazil)

Each time you receive an inflow payment from your customer, a transaction is created in the Belvo database.

You can use the Payment Transactions resource in order to get useful information about a transaction as well as the specific charge associated with it.

Operations

Belvo API Docs (1.222.0)

Introduction

Available Information and Payment Methods

Data Dictionaries

Environments

Sandbox

Production

Response codes

Error handling

Request identifier

Error codes and troubleshooting

Retry policy

50x errors

40x errors

Deprecated fields

OpenAPI: required and nullable fields

Institutions

Links

Update a link's credentials

Request

Responses

Was this helpful?

Delete a link

Request

Responses

Was this helpful?

Trigger a historical update for a link

Request

Responses

Was this helpful?

Widget Access Token

Consents

Owners

Accounts

Balances

Transactions

Bills

Investments Brazil

Investment Transactions Brazil

Employments Brazil

Employment Records Mexico

Current Employments Mexico

Invoices

Tax compliance status

Tax returns

Tax retentions

Tax status

Financial Statements

Invoices Chile

Tax Status Chile

Debt Reports Chile

Incomes

Recurring Expenses

Risk Insights

Employment Metrics

Payment Institutions (Brazil)

Customers (Brazil)

Bank Accounts (Brazil)

Payment Links (Brazil)

Payment Intents (Brazil)

Payment Authorizations (Brazil)

Biometric Pix Widget Access Token (Brazil)

Enrollments (Brazil)

Payment Transactions (Brazil)