Quick answer
A banking API is a secure, rule-based doorway into your bank's systems. An app asks for a specific permission, your bank checks it is you, then gives the app an access token limited to that permission. The app presents the token to fetch data or send a payment instruction[2][3].
Key points
- An API (application programming interface) is a set of rules that lets one computer system ask another for data or actions in a controlled way.
- Open banking APIs build on OAuth 2.0: your bank gives the app an access token instead of your password.
- In the UK standard, every token is tied to one customer and one consent, so it cannot be reused for something you did not approve.
- Security profiles such as the OpenID Foundation's FAPI add stricter rules for financial-grade APIs.
- Regulators set performance expectations; the US 1033 rule, for example, sets a 99.5% monthly response-rate standard.
On this page
#What is an API, in plain English?
An API, or application programming interface, is a published set of rules that says: if you send me a request in this exact format, I will answer in that exact format. Think of a restaurant: you do not walk into the kitchen; you order from a menu, and the waiter brings back what you ordered. The menu is the API. In banking, the 'kitchen' is the bank's core systems, and the menu lists what an outside app may ask for, such as a balance or a list of transactions. Our API glossary entry has a short definition.
In the UK, the published menu is the Open Banking Read/Write API standard, which Open Banking Limited describes as RESTful APIs that let third-party providers access information and initiate payments for customers, securely and with customer consent[1]. 'RESTful' simply means the API is organised around web addresses (resources) and standard web actions.
#Who takes part in a banking API call?
Open banking APIs build on OAuth 2.0, an internet standard published by the Internet Engineering Task Force in 2012. It lets a third-party application obtain limited access to a service on behalf of the resource owner, by arranging an approval step between the owner and the service[2]. The UK standard uses OAuth clients and access tokens[1][3], and the FAPI security profile used in the UK, Australia and Brazil is itself an OAuth 2 profile[4]. OAuth names four roles, and each maps neatly to open banking.
| OAuth role | Official meaning | In open banking |
|---|---|---|
| Resource owner | The entity that can grant access; when a person, the end-user[2] | You, the account holder |
| Client | The application making requests on the owner's behalf and with their authorisation[2] | The budgeting, lending or payment app |
| Authorization server | Issues access tokens after authenticating the owner and getting authorisation[2] | Your bank's login and consent system |
| Resource server | Hosts the protected data and accepts requests carrying access tokens[2] | Your bank's API that returns balances and transactions |
#What happens, step by step, when an app connects to your bank?
The consent flow in the UK Open Banking standard
The app registers with the bank
Before talking to customers' accounts, the provider registers as an OAuth client with each bank, using a process the standard calls Dynamic Client Registration[1].
The app creates a consent ('intent')
The app tells the bank what it wants, for example read access to balances and transactions, and receives an intent ID[3].
You are redirected to your bank
The app sends you to your bank with that intent ID. You log in at the bank, not in the app[3].
You approve and the bank issues a token
The bank authenticates you and issues an access token bound to you and to that single intent[3].
The app calls the API
The app presents the token with each request, and the bank's API returns only what the consent covers.
The access token is the heart of the system. OAuth defines it as a credential used to access protected resources: a string representing an authorisation issued to the client[2]. In the UK standard, an access token is bound to a single customer and a single intent[3]. Compare that with giving an app your password, which unlocks everything you can do in online banking; the trade-offs are covered in screen scraping vs APIs.
#What does a banking API request look like?
Requests are ordinary web requests. The UK profile uses the standard HTTP methods GET (read), POST (create), PUT (update) and DELETE (remove), and every message body is JSON, a simple text format for data, encoded in UTF-8[3]. Addresses follow a pattern: a base path, a version, a group such as 'aisp' (account information) or 'pisp' (payment initiation), then the resource[3].
| API family | What it covers | Example resource path |
|---|---|---|
| Account and Transaction | Accounts, balances, transactions, direct debits, standing orders, statements and more[3] | /aisp/accounts/1234/transactions |
| Account access consent | Creating and managing the permission itself[3] | /aisp/account-access-consents |
| Payment Initiation | Starting payments from the customer's account[3] | /pisp/domestic-payments |
| Confirmation of Funds | Checking whether enough funds are available for a payment[3] | /cbpii/funds-confirmation-consents |
| Variable Recurring Payments | Recurring payments managed by an authorised provider[3][5] | Defined in the VRP profile |
Paths as shown in the Read/Write Data API Profile v4.0.1; '1234' is a placeholder account ID.
Notice the separation: reading data and moving money use different groups and different consents. An app allowed to read your transactions cannot use that permission to start a payment. For how payment consents work in practice, see pay by bank explained.
#How are banking APIs kept secure?
Plain OAuth is flexible, so finance uses stricter profiles on top. The OpenID Foundation's FAPI working group describes FAPI as a general-purpose, high-security OAuth 2 profile for API protection. FAPI 2.0 was approved as a final specification on 19 February 2025, and the foundation lists Open Banking UK (FAPI 1.0 since 13 January 2018), Australia's Consumer Data Right (FAPI 1.0 since 1 July 2020) and Open Banking Brasil among its adopters[4].
Law adds further layers. In the EU, the PSD2 technical standards require strong customer authentication and a dedicated communication channel through which authorised providers access the data they need[6]; the security side is explained in strong customer authentication explained. In the US, the 1033 rule says a bank must not let a third party reach its developer interface using the credentials a consumer uses to log in[7].
#How fast and reliable do banking APIs need to be?
Reliability is regulated because an app is only as good as the bank's API. Under the US 1033 rule, at least 99.5% of requests in each calendar month must receive a proper response, excluding scheduled downtime[7]. In the EU, a bank's dedicated interface had to pass a three-month prototype test and a three-month live test before it could be exempted from providing a fallback route[6]. In the UK, Open Banking Limited publishes performance figures for the largest banks: in June 2026 the average API response time was 349 milliseconds and weighted availability was 99.80%[8].
Worked example
Worked example: what 2.81 billion calls a month means
Open Banking Limited reported 2.81 billion API calls in June 2026, a 30-day month[8]. Spreading that evenly (real traffic peaks and dips) gives a feel for the load. Calculated with code.
- Calls per day: 2,810,000,000 ÷ 30
- about 93.7 million
- Calls per second: 93,666,667 ÷ 86,400
- about 1,084
- Three sequential calls at the 349 ms average (consent, balance, transactions)
- about 1,047 ms, roughly one second
Common beginner mistakes about banking APIs
Thinking an API is an app
An API has no screen. It is the doorway an app uses to talk to the bank's systems.
Believing the app stores your bank password
With OAuth-based open banking the app holds a token, not your credentials[2].
Assuming one permission covers everything
Each token is tied to one consent[3]. Reading data and making payments need separate approvals.
Expecting identical APIs everywhere
The UK, EU, US, Brazil and Australia use different standards and rules, even where they share building blocks like FAPI[4].
The bottom line
A banking API is a controlled conversation: the app asks for a specific consent, you approve it at your bank, and the bank hands over a token that unlocks only that consent. Standards such as OAuth 2.0 and FAPI define the mechanics, and regulators set reliability and security rules on top. Knowing the steps makes it easier to tell a genuine connection from a trick.
Frequently asked questions
Do I need to understand APIs to use open banking?
No. You only see the consent screens. Knowing that the app receives a limited token rather than your password helps you spot unsafe requests.
What is an access token?
A credential, in the form of a string, that represents an authorisation issued to the app; the app presents it to get protected data[2].
Can a bank API be used to move money?
Yes, through payment initiation endpoints such as the UK's domestic-payments resource, but only with a separate payment consent that you approve[3].
What is FAPI?
A high-security OAuth 2 profile maintained by the OpenID Foundation and used by open banking systems including the UK's[4].
Sources
- Open Banking API specifications (latest version 4.0.1) — Open Banking Limited, 2026 Primary
- RFC 6749: The OAuth 2.0 Authorization Framework — Internet Engineering Task Force (RFC Editor), 2012 Primary
- Read/Write Data API Profile v4.0.1 — Open Banking Limited, 2026 Primary
- FAPI Working Group — OpenID Foundation, 2025 Primary
- Prioritisation statement: commercial variable recurring payments — Financial Conduct Authority and Payment Systems Regulator, 2025 Primary
- Payment Services Directive (PSD2): Regulatory Technical Standards (RTS) enabling consumers to benefit from safer and more innovative electronic payments (MEMO/17/4961) — European Commission, 2017 Primary
- 12 CFR 1033.311 — Requirements applicable to developer interface — eCFR (US Code of Federal Regulations), 2026 Primary
- Open Banking surpasses one billion payments and 100 billion API calls — Open Banking Limited, 2026 Primary
.jpg){kind=link}
.jpg){kind=link}
