Build on the Rapid API
API version: v1 · Last updated: 1 Nov 2026
Authenticate with OAuth 2.0, then retrieve account statements and balances as ISO 20022 XML, routed securely through Rapid Bridge.
Available APIs
Before you start
Three things to have in place before your first API call.
Register with Rapid to get your client_id, client_secret and, for client credentials, account_secret. You also register your redirect_uri at the same time. The Rapid team will guide you through registration.
Run Rapid Bridge on your server. Balance and statement calls go through it.
Set up Rapid Bridge →Upload your public keys to the Rapid User Portal. This is part of the Bridge setup.
client_secret and account_secret on your backend. Never put them in a browser or mobile app.Base URLs
Two placeholders appear in every endpoint on this page.
Rapid's authorization server, for consent and token calls.
Your own Rapid Bridge, for balance and statement calls. Set up Rapid Bridge →
What are you building?
/api/v1/oauth/authorize- You send
client_id,redirect_uri,scope,state, PKCEcode_challenge- You get
- An authorization code, sent to your
redirect_uri
/api/v1/oauth/token- You send
code,client_secret, PKCEcode_verifier- You get
access_token(under 1 min) andrefresh_token(1 year or more)
/api/v1/resource/statement or /balanceSent to your Rapid Bridge
- You send
Authorization: Bearer …and a JSON body whosemessagefield holds thecamt.060XML- You get
- JSON whose
messagefield holds thecamt.053statement orcamt.052balance XML
/api/v1/oauth/token with your refresh_token to get a new access token and refresh token. Refresh details/api/v1/oauth/token- You send
client_id,client_secret,account_secret,account_no- You get
access_token(under 1 min). Authorization is built into this call.
/api/v1/resource/statement or /balanceSent to your Rapid Bridge
- You send
Authorization: Bearer …and a JSON body whosemessagefield holds thecamt.060XML- You get
- JSON whose
messagefield holds thecamt.053statement orcamt.052balance XML
Compare the two approaches
Both end at the same resource APIs. The difference is how you get the access token.
| Property | Authorization code | Client credentials |
|---|---|---|
| Steps | 3: authorize, get token, call API | 2: get token, call API |
| Use case | User-facing apps needing consent | Server-to-server / M2M |
| User interaction | Required | Not required |
| Access token | Yes (under 1 min) | Yes (under 1 min) |
| Refresh token | Yes (1 year or more) | No |
| PKCE | Required (S256 only) | Not applicable |
account_secret | Not required | Required |
offline scope | Supported | Not applicable |
OAuth 2.0: Authorization code flow
offline scope if you want a refresh token.Supported scopes
Pass scopes as a space-separated string in the scope parameter.
| Scope | Description | Flow |
|---|---|---|
statement | Retrieve account statements (transaction history) for the authorized account. | Authorization code, Client credentials |
balance | Retrieve the current balance for the authorized account. | Authorization code, Client credentials |
offline | Issues a refresh token so you can get new access tokens without re-authenticating the user. | Authorization code only |
%20 in the URL). Include offline to get a refresh token.
In the client credentials flow you don't pass scope. The token response's scope field shows what was granted.
Authorization consent endpoint
Starts the authorization process and redirects the user to a consent page.
{{rapid_server_url}}/api/v1/oauth/authorizeQuery parameters
| Parameter | Type | Description |
|---|---|---|
client_id | string | Unique identifier for the client application. |
redirect_uri | string | Must exactly match the redirect_uri you registered. |
response_type | string | Use code for the authorization code flow. |
scope | string | Space-separated permissions, for example statement balance offline. |
state | string | A cryptographically random string. Store it in the user’s session, and check that it matches before you use the returned code. |
account_no | string | Account number whose resources are being accessed. |
code_challenge | string | Required. base64url(sha256(code_verifier)), without = padding. |
code_challenge_method | string | Required. Must be S256. |
Create a new PKCE pair for every consent request. Keep code_verifier on your backend and send only code_challenge in the consent URL. The consent URL is shown on several lines for readability. Send it as one URL.
Response
Returns a 303 redirect to the consent page. On grant, code and state are appended to redirect_uri. On denial, error and error_description are appended.
Token generation (authorization code)
Exchanges an authorization code for an access token and refresh token.
{{rapid_server_url}}/api/v1/oauth/tokenapplication/x-www-form-urlencodedRequest body
| Parameter | Type | Description |
|---|---|---|
code | text | Authorization code from the authorization server. |
grant_type | text | Must be authorization_code. |
redirect_uri | text | Must match the URI used during authorization. |
client_id | text | Unique identifier for the client application. |
client_secret | text | Secret key for the client application. |
code_verifier | text | The original random string (43–128 characters) you created the code_challenge from. |
Response fields
| Field | Description |
|---|---|
access_token | Token for authenticating API requests. Short-lived (under 1 minute). |
expires_in | Validity in seconds. |
refresh_token | Long-lived token (1 year or more) for obtaining new access tokens. |
scope | Scope of access granted. |
token_type | Bearer |
Token calls follow the token rules: each call invalidates earlier tokens, so store the new tokens right away.
Token generation via refresh token
Gets a new access token without re-authenticating the user.
{{rapid_server_url}}/api/v1/oauth/tokenapplication/x-www-form-urlencodedRequest body
| Parameter | Type | Description |
|---|---|---|
grant_type | string | Must be refresh_token. |
client_id | string | Unique identifier for the client application. |
client_secret | string | Secret key for the client application. |
refresh_token | string | Refresh token from a previous token call. |
Each refresh returns a new refresh_token and invalidates the previous one. See the token rules.
- Access tokens last under a minute. Use your refresh token to get a new access token before each API call.
- Each call to the token endpoint, for a code or a refresh, immediately invalidates all tokens issued before it.
- Each refresh returns a new
refresh_tokenand invalidates the previous one. Save the new one right away. - Make token calls one at a time. Two parallel calls invalidate each other’s tokens.
- If you lose the latest refresh token, the user has to go through consent again.
OAuth 2.0: Client credentials flow
Token generation (client credentials)
{{rapid_server_url}}/api/v1/oauth/tokenapplication/x-www-form-urlencodedThis flow takes no scope parameter.
Request body
| Parameter | Type | Description |
|---|---|---|
grant_type | text | Must be client_credentials. |
client_id | text | Unique identifier for the client application. |
client_secret | text | Secret key for the client application. |
account_secret | text | Secret associated with the account being accessed. |
account_no | text | Account number to which access is requested. |
- No refresh token is issued in this flow.
- Store
client_secretandaccount_secretsecurely. - Request a new access token before each API call or on expiry.
Resources
Both paths end here. Call these APIs with the access token you got from either path, and send the headers below. Bodies are JSON. The message field holds the ISO 20022 XML as a string.
Required headers
| Header | Type | Description |
|---|---|---|
Authorization | string | Bearer <access_token>. The Bridge forwards it to Rapid. |
X-Source-Slug | string | Your application slug. It must match the slug you set up with init app. How to set it up → |
X-Destination-Slug | string | The bank’s slug. It must match the slug you set up with init bank. How to set it up → |
X-Key-Version | string | Your key version, created by init app. Where to find it → |
Content-Type | string | application/json |
Request fields
Paths are relative to Document/AcctRptgReq/. Every field listed is required for the endpoints that use it.
| Field | XML path | Balance | Statement | Description |
|---|---|---|---|---|
MsgId | GrpHdr/MsgId | ✓ | ✓ | Unique sender-assigned message ID |
CreDtTm | GrpHdr/CreDtTm | ✓ | ✓ | UTC creation timestamp (ISO 8601) |
ReqdMsgNmId | RptgReq/ReqdMsgNmId | camt.052.001.12 | camt.053.001.12 | Must be the value shown for the endpoint |
AcctId | RptgReq/Acct/Id/Othr/Id | ✓ | ✓ | Target account number |
SchmeNm | RptgReq/Acct/Id/Othr/SchmeNm/Cd | BBAN | BBAN | Must be BBAN |
AcctOwnr | RptgReq/AcctOwnr/Pty/Nm | ✓ | ✓ | Account owner name |
FrDt | RptgReq/RptgPrd/FrToDt/FrDt | ✓ | Period start date, YYYY-MM-DD | |
ToDt | RptgReq/RptgPrd/FrToDt/ToDt | ✓ | Period end date, YYYY-MM-DD | |
Tp | RptgReq/RptgPrd/Tp | ✓ | Use CHNG for new or changed entries only | |
Limit | SplmtryData/Envlp/PaginationData/Limit | ✓ | Max results per page | |
Page | SplmtryData/Envlp/PaginationData/Page | ✓ | Page number, starting at 1 |
Account statement request
Generates account statements for a date range. Request: camt.060.001.07. Response: camt.053.001.12.
{{rapid_bridge_url}}/api/v1/resource/statementapplication/jsonRequest body
The body is JSON with one field, message. Its value is the ISO 20022 XML as a single string, with every " inside the XML escaped as \".
{"message": "<camt.060 XML as a string>"}
See Request fields for where each value goes in the XML.
Response
The response is JSON in the same shape. message holds the response XML.
Response fields
Show all response fields
| Field | Description |
|---|---|
MsgId, CreDtTm | Bank-assigned message ID and creation timestamp (GrpHdr). |
PgNb, LastPgInd | Current page number; true if this is the last page. |
Stmt/Id | Unique statement identifier. |
FrDtTm, ToDtTm | Statement period start and end. |
Acct | Account number (Id/Othr/Id), currency (Ccy, e.g. NPR) and owner name (Ownr/Nm). |
Bal | Type OPBD (opening booked) or ITBD (interim booked), amount, CdtDbtInd and date. |
Ntry/NtryRef | Unique transaction reference. |
Ntry/Amt | Transaction amount (5-decimal precision), with CRDT or DBIT. |
Sts/Cd | BOOK means fully posted to the ledger. |
BookgDt, ValDt | Posting date/time and effective date for interest calculation. |
AcctSvcrRef | Bank internal transaction ID. |
Avlbty | Date funds become available and the amount tracked for availability. |
TxDtls/Refs/TxId | Sub-transaction identifier. |
SplmtryData | Category (PlcAndNm, e.g. “Particular 1”) and description (Envlp/Item). |
AddtlNtryInf | Human-readable transaction description. |
BalwithOPBDis the opening booked balance andITBDis the interim booked balance.- In each
Ntry,CdtDbtIndisCRDTfor a credit andDBITfor a debit. - Paging: request
Page= 2, 3, … untilGrpHdr/MsgPgntn/LastPgIndistrue. Use a newMsgIdfor each request.
2026-10-27T12:52:38.863565447+05:45. Some date-only values carry one too, for example 2026-01-01Z or 2026-01-01+05:45. Use a parser that accepts both.Account balance request
Retrieves the current balance. Request: camt.060.001.07. Response: camt.052.001.12.
{{rapid_bridge_url}}/api/v1/resource/balanceapplication/jsonUses the same required headers as the statement API.
Request body
The body is JSON with one field, message. Its value is the ISO 20022 XML as a single string, with every " inside the XML escaped as \".
{"message": "<camt.060 XML as a string>"}
See Request fields for where each value goes in the XML.
Response
The response is JSON in the same shape. message holds the response XML.
Response fields
| Field | Description |
|---|---|
MsgId, CreDtTm | Bank-assigned message ID and creation timestamp. |
Rpt/Id | Unique report identifier. |
Rpt/Acct | Account number, currency (e.g. NPR) and owner name. |
Bal/Tp | ITAV (interim available) or ITBD (interim booked). The response has both. |
Bal/Amt, CdtDbtInd | Current balance; CRDT positive, DBIT overdrawn. |
Bal/Dt/DtTm | Balance date and timestamp. |
The response has two balances: ITAV (interim available) and ITBD (interim booked). Find each balance by its Cd value, not by its position.
2026-10-27T12:52:38.863565447+05:45. Some date-only values carry one too, for example 2026-01-01Z or 2026-01-01+05:45. Use a parser that accepts both.
