Developer guidelines

1

Discover our available APIs and endpoints

Go through our API Reference to identify the API(s) and the endpoints you will need for your use case.

2

Sign up to the Developer Portal and create an app

By signing up to the Developer Portal and creating an app, you’ll be able to get all the authentication credentials you need to access the Sandbox environment (cf. demo below).

If the use case you’re interested in warrants it, our Partnership team will get in touch to support you in the integration and agree on a partnership contract.

3

Set up the Sandbox environment

Before making your first API calls, we strongly recommend you set up the Sandbox environment to play with dummy data and check if the API responses are the expected ones.

In the following steps, if any verification screen is prompted, please fill 123456.

Log in to the Sandbox web app

Create my own user (optional)

Create my own organization (optional)

4

Make your first API call

To call the Sandbox environment, you should use Sandbox base URLs not Production base URLs.

Set up Postman

Authenticate

5

Build your integration

Not a developer? Use Make or Zapier (no-code tools) to build your integration!

Here are some examples of the Business API most used capabilities:

List transactions

To do so, you will need to call 2 endpoints:

Retrieve the authenticated organization and list bank accounts

🔗 Endpoint GET https://thirdparty.qonto.com/v2/organization
🔒 Auth API Key or OAuth 2.0 (organization.read scope)
📲 SCA No

To learn more about this endpoint, click here.
List transactions

You will need to specify the idor the iban of the bank account retrieved with the previous API call.

🔗 Endpoint GET https://thirdparty.qonto.com/v2/transactions
🔒 Auth API Key or OAuth 2.0 (organization.read scope)
📲 SCA No

To learn more about this endpoint, click here.


🔗 Endpoint	`GET https://thirdparty.qonto.com/v2/organization`
🔒 Auth	API Key or OAuth 2.0 (`organization.read` scope)
📲 SCA	No


🔗 Endpoint	`GET https://thirdparty.qonto.com/v2/transactions`
🔒 Auth	API Key or OAuth 2.0 (`organization.read` scope)
📲 SCA	No

Initiate external transfers

There are 3 different ways of initiating external transfers:

Create external transfers with beneficiaries data

This endpoint is only accessible using Strong Customer Authentication 👉 it requires a user interaction during the external transfers creation flow: the authenticated membership needs to approve the external transfers in the Qonto mobile app (after receiving a push notification).


🔗 Endpoint	`POST https://thirdparty.qonto.com/v2/external_transfers/checkout`
🔒 Auth	OAuth 2.0 only (`payment.write` scope)
📲 SCA	Yes 👉 the external transfers creation will not be fully automated; the authenticated membership will receive a push notification and will have to approve the external transfers within 15 minutes.
👤 Beneficiary type	Any type of beneficiary (i.e. new or existing one, trusted or not); if the beneficiary doesn’t exist, it will be created once the transfer is successfully created.
🔢 Number of transfers	Up to 400

To learn more about this endpoint, click here.

Create an external transfer with trusted beneficiary

This endpoint doesn’t require any user interaction once the beneficiary is trusted. A beneficiary can only be trusted through Qonto app.


🔗 Endpoint	`POST https://thirdparty.qonto.com/v2/external_transfers`
🔒 OAuth scope	OAuth 2.0 only (`payment.write` scope)
📲 SCA	No 👉 the external transfer creation will be fully automated.
👤 Beneficiary type	Only trusted beneficiary; the list of trusted beneficiaries can be retrieved through the List beneficiaries endpoint.
🔢 Number of transfers	1

To learn more about this endpoint, click here.

Create a transfers request

This endpoint requires a user interaction after the transfers request creation: the transfers request must be approved by a membership of the authenticated organization with permissions to review requests.


🔗 Endpoint	`POST https://thirdparty.qonto.com/v2/requests/multi_transfers`
🔒 OAuth scope	OAuth 2.0 only (`request_transfers.write` scope)
📲 SCA	No 👉 the transfers request creation will be fully automated but not the external transfers creation since the request will have first to be approved by a membership in the Qonto app without any time constraints.
👤 Beneficiary type	Any type of beneficiary (i.e. new or existing one, trusted or not); if the beneficiary doesn’t exist, it will be created once the transfer is successfully created.
🔢 Number of transfers	Up to 400

To learn more about this endpoint, click here.

Here are some examples of the Business API most used capabilities:

List transactions

To do so, you will need to call 2 endpoints:

Retrieve the authenticated organization and list bank accounts

🔗 Endpoint GET https://thirdparty.qonto.com/v2/organization
🔒 Auth API Key or OAuth 2.0 (organization.read scope)
📲 SCA No

To learn more about this endpoint, click here.
List transactions

You will need to specify the idor the iban of the bank account retrieved with the previous API call.

🔗 Endpoint GET https://thirdparty.qonto.com/v2/transactions
🔒 Auth API Key or OAuth 2.0 (organization.read scope)
📲 SCA No

To learn more about this endpoint, click here.


🔗 Endpoint	`GET https://thirdparty.qonto.com/v2/organization`
🔒 Auth	API Key or OAuth 2.0 (`organization.read` scope)
📲 SCA	No


🔗 Endpoint	`GET https://thirdparty.qonto.com/v2/transactions`
🔒 Auth	API Key or OAuth 2.0 (`organization.read` scope)
📲 SCA	No

Initiate external transfers

There are 3 different ways of initiating external transfers:

Create external transfers with beneficiaries data

This endpoint is only accessible using Strong Customer Authentication 👉 it requires a user interaction during the external transfers creation flow: the authenticated membership needs to approve the external transfers in the Qonto mobile app (after receiving a push notification).


🔗 Endpoint	`POST https://thirdparty.qonto.com/v2/external_transfers/checkout`
🔒 Auth	OAuth 2.0 only (`payment.write` scope)
📲 SCA	Yes 👉 the external transfers creation will not be fully automated; the authenticated membership will receive a push notification and will have to approve the external transfers within 15 minutes.
👤 Beneficiary type	Any type of beneficiary (i.e. new or existing one, trusted or not); if the beneficiary doesn’t exist, it will be created once the transfer is successfully created.
🔢 Number of transfers	Up to 400

To learn more about this endpoint, click here.

Create an external transfer with trusted beneficiary

This endpoint doesn’t require any user interaction once the beneficiary is trusted. A beneficiary can only be trusted through Qonto app.


🔗 Endpoint	`POST https://thirdparty.qonto.com/v2/external_transfers`
🔒 OAuth scope	OAuth 2.0 only (`payment.write` scope)
📲 SCA	No 👉 the external transfer creation will be fully automated.
👤 Beneficiary type	Only trusted beneficiary; the list of trusted beneficiaries can be retrieved through the List beneficiaries endpoint.
🔢 Number of transfers	1

To learn more about this endpoint, click here.

Create a transfers request

This endpoint requires a user interaction after the transfers request creation: the transfers request must be approved by a membership of the authenticated organization with permissions to review requests.


🔗 Endpoint	`POST https://thirdparty.qonto.com/v2/requests/multi_transfers`
🔒 OAuth scope	OAuth 2.0 only (`request_transfers.write` scope)
📲 SCA	No 👉 the transfers request creation will be fully automated but not the external transfers creation since the request will have first to be approved by a membership in the Qonto app without any time constraints.
👤 Beneficiary type	Any type of beneficiary (i.e. new or existing one, trusted or not); if the beneficiary doesn’t exist, it will be created once the transfer is successfully created.
🔢 Number of transfers	Up to 400

To learn more about this endpoint, click here.

Create Qonto business accounts:

for companies which need to be created;
for existing companies.

6

Release your integration

All the API operations can be replicated from the Sandbox to the Production environment by following the next steps:

Get your Production credentials through the Developer Portal.

If you are using the Onboarding API, you will need to sign an ORIAS mandate (France only) and a partnership contract with Qonto in order to release your integration to Production.
Replace your Sandbox credentials by your Production credentials.

The X-Qonto-Staging-Token header is not necessary in Production.
Replace the endpoints base URL.
- Business API URLs
- Onboarding API URLs

If you are a licensed partner, you must identify yourself through your QSeal certificate when calling our Business API endpoints in Production (cf. the requirements); otherwise you will receive a 401 Unauthorized error to your API calls.

Your integration is ready to be released in Production!

We would be super grateful if you could take few minutes to share your feedback regarding our Public APIs: Tell us what you think

Get started

Use cases

Troubleshooting

Developer guidelines