Polish Bank Association (ZBP)

PolishAPI

Polandv3.0.1maintainedPublisher docs ↗

A distinct national standard with its own AIS/PIS/CAF split and a strong emphasis on JWS-signed request bodies. Notable for explicit page-based transaction paging.

Security profile

Client authentication
mTLS with QWAC.
Message signing
JWS signature over the whole request body, mandatory.
Tokens
OAuth2 authorization_code with a Polish-specific consent object.
Certificates
eIDAS QWAC + QSealC.

SCA approaches

RedirectDecoupled

What bites integrators

  • All operations are POST, including reads. Do not assume REST verb semantics.
  • Paging uses pageId tokens that expire; restarting a long transaction pull means starting from scratch.

APIs and endpoints

AIS

AIS

Account and transaction access with cursor paging.

  • POST/accounts/v3_0.1/getAccountsList accounts
  • POST/accounts/v3_0.1/getTransactionsDoneRead booked transactions
  • POST/accounts/v3_0.1/getTransactionsPendingRead pending transactions

PIS

PIS

Domestic, EEA and tax payments as separate operations.

  • POST/payments/v3_0.1/domesticDomestic transfer
  • POST/payments/v3_0.1/EEAEEA transfer
  • POST/payments/v3_0.1/taxTax payment