Getting Started

Devengo Access Verifications API allows you to confirm that any provided entity has access to a specified bank account. The access verification is implemented by sending a micropayment of 1 euro cents to the specified bank account with a secret code in the description. As only entities with access to the account transactions can see the code, once the correct confirmation code is provided the access is verified.

Please notice that this service does NOT verify account ownership, only access to the account. If you want to verify that a given entity is the legal account holder of a bank account please use our Holder Verifications API to verify account ownership.

This is an asynchronous process and the micropayment will be sent as a background task. If you need to have detailed control over the process you should create a webhook to receive our callbacks.

Create a Sandbox Account

The first step, unless you are already using other Devengo products, is to create a Sandbox Account. The Sandbox Account allows you to test the functions without using real bank accounts or transactions. To create a Sandbox Account, follow these steps:

1. Create your account by filling out this form.
2. You will receive a confirmation email. Once confirmed, you will have full access to the Devengo API.

Create a session token

To interact with the Devengo API, you need to generate a session token. This token authenticates your requests and provides access to the API. To create a new session token, you will have to provide the email and password used in the signup form.

curl -X POST 'https://api.sandbox.devengo.com/v1/auth/tokens' \
-H 'Content-Type: application/json' \
-d '{"email": "[email protected]", "password": "your_password"}'

{
   "token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX25kIjoibWFuXzRuakRLSTNFQmJjYWtyQXEyMENCSVohLCJ1c2VyX3R5cG6iOiJNYW5hZ2VyIiwiY29xcGFueV9pZCI6bnVsbCwiZXhwIjoiMTY4NjA1MHA0MiJ9.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
   "refresh_token": "eyJhbGciOiJIvzI1NiJ9.eyJ1c2VyX2lkIjoibWFuXzRuakRLSTNFQmJjYWtyQXEyMENCSVHiLCJ1c2VyX3R5cGUiOiJNYW5hZ2VyIiwiY29tcGFueV9pZCI6bnVsbCwicmVmcmVzaF90b2tlbl9pZCI6InRva18yNUg4ajZHMEFiUUp4VkZHdDJkTWxqIiwiZXhwIjoiMTY4NzI5ODg0MiJ9.IcTS5-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Create the first Access Verification

Once you have a session token, you can start creating Access Verifications. In this example, Devengo will send a micropayment to the specified John Doe bank account with a secret code.

curl -X POST https://api.sandbox.devengo.com/v1/access_verifications \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer THE_SESSION_TOKEN' \
-d '{
   "destination": { "iban": "ES7667130002000000000223" },
   "recipient": "John Doe"
}'

{
  "verification": {
    "id": "vrf_2KX8KGkSUMr37APZsRb2l2",
    "third_party": {
      "name": "John Doe",
      "account": {
        "identifiers": [
          {
            "type": "iban",
            "iban": "ES7667130002000000000223"
          }
        ],
        "bank": {
          "name": "Prepaid Financial Services Limited, S.E",
          "bic": "PFSSESM1XXX"
        }
      }
    },
    "status": "created",
    "company_reference": null,
    "metadata": {},
    "expired_at": "2023-06-28T09:14:05Z",
    "created_at": "2023-06-21T09:14:05Z",
    "eta": "2023-06-21T09:14:15Z",
    "attempts": 0,
    "error": null
  }
}

At this point, the recipient receives the transaction in their account with a description including the secret code they should provide. This code is a 6-digit random number, for example, 950145.

Confirm an Access Verification

Once the recipient provides you with the received secret code, you can make a confirmation attempt.

Note: Please note that in the Sandbox environment, all Access Verifications can be confirmed using the code "000000" for testing purposes.

curl -X POST https://api.sandbox.devengo.com/v1/access_verifications/vrf_4wr2ZKhRa2E6nehBUlpgZo/confirm \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer THE_SESSION_TOKEN' \
--data '{
   "code": "000000"
}'

If the provided code is valid, the response will be a 200 OK and the Access Verification status will be changed to confirmed.

Next steps

• Understand the Access Verification lifecycle.
• Create a webhook.