IBAN List API

Description: Retrieve the list of IBANs under the current API account

Production API URL: #/api/iban/list Sandbox API URL: https://ibantest.yabandpay.com/api/iban/list

Method: POST

Header:

Authorization: Bearer {api_account_token}
Content-Type: application/json

0. API Signature Instructions (HMAC-SHA256)

The signature rule for IBAN APIs is consistent with the rest of the platform. All IBAN endpoints use HMAC-SHA256. Clients should compute sign as follows:

1. Remove the sign field from the raw request body. If a role field exists, it must also be excluded from signing.
2. Flatten all fields inside the data object to the top level, and merge them together with uid / timestamp / nonce.
3. Sort the flattened key/value pairs by key in ascending dictionary order (same as PHP ksort()).
4. Concatenate them into a query string using the form k1=v1&k2=v2&k3=v3.
5. Compute the signature using the account secret_key as the secret with HMAC-SHA256, lowercase the result, and use that value as sign in the request.

Signature formula:
sign = hash_hmac('sha256', implode('&', ksort(merge(data, {uid, timestamp, nonce})) ), secret_key)

Signature example (PHP):

$secretKey = 'your_account_secret_key';
$body = [
    'uid'       => '900001',
    'timestamp' => 1750000000,
    'nonce'     => 'Qe3CkH2xP8',
    'data'      => [
        'request_id'    => 'req_202411180049',
        'page'          => 1,
        'limit'         => 20,
        'keyword'       => 'YABN',
        'customer_type' => 'legal_entity',
        'access'        => 2,
        'status'        => 1,
    ],
];
$sign = getSignByYabandPayV3($body, $secretKey);
$body['sign'] = $sign;

Following the steps above, the resulting sign should match the one in the request example below: A1AC665F9B40F7C51212BCE080F5B987.

Notes:

• timestamp should be a UTC Unix timestamp in seconds. A large clock drift from the IBAN server may cause the request to be rejected.
• nonce should be a random string of 10 to 32 characters and unique per request to prevent replay attacks.
• Authorization Bearer Token and sign are two independent validation layers. Both must pass.
• Key ordering and casing are strictly sensitive. A different field order or accidental whitespace usually results in -1001 signature error.

1. Request Parameters (Top Level)

2. data Object (fields may be sent either at top level or inside data)

Permission isolation: the result set only contains IBANs bound to the API account represented by the Authorization Bearer Token (i.e. api_account_id = current account id). Cross-account queries are not allowed.

3. Request Example

{
    "uid": "900001",
    "timestamp": 1750000000,
    "nonce": "Qe3CkH2xP8",
    "sign": "A1AC665F9B40F7C51212BCE080F5B987",
    "data": {
        "request_id": "req_202411180049",
        "page": 1,
        "limit": 20,
        "keyword": "YABN",
        "customer_type": "legal_entity",
        "access": 2,
        "status": 1
    }
}

4. Response Example

Success

{
    "status": true,
    "code": 200,
    "message": "",
    "data": {
        "list": [
            {
                "id": 1,
                "customer_type": "legal_entity",
                "customer_id": "2012345678",
                "holder_name": "Company name",
                "alternative_name": "First_name Last_name",
                "creditor_identifier": "NL00ZZZ123456780000",
                "bic": "YABNNL22",
                "iban": "NL09YABN0192150222",
                "currency": "EUR",
                "balance": "1000.00",
                "access": 2,
                "access_label": "inbound",
                "status": 1,
                "status_label": "active",
                "remark": "Test remark",
                "api_account_id": 1,
                "created_at": 1784851200,
                "updated_at": 1784851800
            }
        ],
        "total": 1,
        "page": 1,
        "limit": 20,
        "page_size": 20,
        "total_page": 1,
        "request_id": "req_202411180049"
    }
}

Failure: Missing required parameters

{
    "status": false,
    "code": -3002,
    "message": "The given data was invalid.",
    "data": {}
}

Failure: Invalid Authorization / Disabled account

{
    "status": false,
    "code": -1010,
    "message": "api account error",
    "data": {}
}