Product Overview
Business Account Insight provides real‑time access to transaction data for business accounts. It is available to both third‑party providers and direct Rabobank customers.
To receive instant notifications regarding changes to your account, you can integrate with Account Notification Service.
This API allows you or your clients (with Rabobank business payment and savings accounts) to receive account information, such as actual balances and transaction details through your application using Rabobank.
Using BAI, you can optimize the customer journey in your web service.
Prerequisites
To ensure a smooth start with the Business Account Insight API, your business should meet the following conditions:
- High degree of automation.
- Professional IT environment and good infrastructure.
- Permanently available security expertise to use Accounts & Payments APIs and safeguarding its security.
- An EV SSL certificate for transport .
- An EV SSL signing certificate for signing messages.
- An active Rabobank business account.
How to connect with the Business Account Insight API
The API can be used in two ways, depending on your use case.
The options below explain each approach:
- If you execute API requests from your own account, then you are a Direct Connector (DC).
- If you execute API requests on behalf of your customers (Rabo account holders), then you are a Third Party (TP).
If you decide to use both options of this API (Direct Connector AND Third Party), you must create separate Apps. One app with a subscription on the DC product and the other app with a subscription on the TP product.
More information: Rabo Banking Link manual for third parties, Rabo Banking Link manual for direct connectors
Business Account Insight:
- Subscribe your application to Business Account Insight.
- Use the OAuth scope:
bai.accountinformation.read.
Authentication & Authorization
The APIs use token-based authentication, which consists of 2 things:
- Consent granted by the account holder.
- Access token, with the integrated consent.
To set this up use Authorization Services.
With the /authorize endpoint the account holder is requested to give consent for a certain API (scope). After consent, an authorization code is returned. This authorization code should be used in the /token call to retrieve an access token. This access token is a Bearer token that you use in the Authorization header of each request.
Read more Oauth PSD2 and Premium.
Relevant scope for oauth2 access code flow
| Scope name | Description |
|---|---|
| bai.accountinformation.read | Allow read from Business Account Insight services |
| bai.piggybanks.read | Allow read for Piggy Banks from Business Account Insight services |
Consent required for Third Parties and Direct Connectors:
- Third Party
- Performing actions on behalf of your customers (Rabo account holders)
- The account holder must provide consent to the third party to Rabobank on behalf of their organisation for the specified account(s) and scopes (provide access to specific actions). This consent is continuous.
- Direct Connector
- Performing actions on/from your own account
- You must provide consent for technical reasons for the specified account(s) and scopes (provide access to specific actions). This is a one time action.
Make sure that you use the Authorization and Token URL as provided by the Authorization Services.
Rate Limiting
A default rate limit plan is set for all APIs. The rate limit can be shared or individual (defined per operation).
The table below describes the rate limiting for BAI.
| Operation | Type | Limit (API calls / s) | Counts towards shared limit |
|---|---|---|---|
GET /accounts | Shared | 20 | Yes |
GET /accounts/{account-id} | Shared | 20 | Yes |
GET /accounts/{account-id}/balances | Shared | 20 | Yes |
GET /accounts/{account-id}/transactions | Shared | 20 | Yes |
| All (premium) Oauth calls | Shared | 20 | Yes |
Updated about 23 hours ago