Batch request containing virtual account creation items and optional callback URL.
Bermuda Commercial Bank RESTful Open Banking API Implementation (v1)
The Bermuda Commercial Bank (BCB) RESTful Open Banking API provides secure, programmatic access to BCB's banking services, enabling developers to integrate financial services into their applications.
- Account details retrieval
- Internal transfers
- Payments (Swift)
- Virtual Accounts
- Transaction information access
- Robust security and compliance
- Comprehensive documentation
Request
Creates one or more virtual (sub) accounts for a corporate client. Virtual accounts allow funds to be segregated and tracked independently while remaining linked to a single settlement account.
Required Request Properties
- items: Array of virtual account creation requests (minimum 1, maximum 1000)
- currency: ISO-4217 currency code for the virtual account (e.g., USD, BMD)
- accountHolderName: Human-readable label for the virtual account
- accountName: Official account title that will appear on statements
Optional Request Properties
- dob: Date of birth of the account holder, if applicable.
- nativeLanguageName: Native name of the account holder's language, if applicable.
- callbackUrl: URL to receive notifications when the batch job completes (optional)
- clientReference: External reference provided by the client to aid reconciliation (max 35 characters) - per item
- customHeaders: Object of string key/value pairs to be echoed back in the completion callback. Limits: up to 10 headers; each key ≤ 50 characters; each value ≤ 500 characters.
Virtual account creation requests are processed asynchronously to ensure optimal performance and reliability:
- Immediate Response: You receive a job ID and status URLs immediately upon submission
- Status Monitoring: Use the provided status URL to monitor job progress
- Result Retrieval: Use the provided result URL to fetch final outcomes when complete
- Callback Notifications: Optionally provide a callback URL for automatic notifications afther job completes
All callback notifications sent to your callbackUrl are signed using HMAC-SHA256 for security and integrity verification. Detailed information about message signing, including verification steps and example code, is available in the Notifications endpoint documentation.
Each successfully created virtual account will contain the following properties:
{
"virtualAccountNumber": "1000327642",
"bicCode": "BPBKBMHMXXX",
"accountHolderName": "T1 Project Alpha Escrow",
"accountName": "New Title T2",
"currency": "USD",
"balance": {
"amount": "0",
"currency": "USD"
},
"category": "CMS Sub Acct"
}The response includes URLs for monitoring your batch job:
- Status URL: Poll this URL to check job progress and completion status
- Result URL: Access this URL to retrieve detailed results for each virtual account
- Job ID: Unique identifier for tracking your batch job
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided, the system stores the key and associates it with the batch job
- If the same idempotency key is received again, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000")
async function createVirtualAccounts() {
try {
const response = await fetch('https://api.bcb.bm/v1/virtual-accounts', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
callbackUrl: 'https://my-callback-url.com', // Optional
// Optional: custom headers echoed in the completion webhook
customHeaders: {
'X-Custom-Header-1': 'CustomValue1',
'X-Custom-Header-2': 'CustomValue2',
'X-Custom-Header-3': 'CustomValue3'
},
items: [
{
currency: 'USD',
accountHolderName: 'Test Company Ltd',
accountName: 'Test Virtual Account 001',
clientReference: 'BATCH-REF-001'
},
{
currency: 'USD',
accountHolderName: 'Test Company Ltd',
accountName: 'Test Virtual Account 002',
clientReference: 'BATCH-REF-002'
}
]
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Virtual account creation failed: ${JSON.stringify(errorData)}`);
}
// Parse JSON response
const batchResponse = await response.json();
// Display batch job information
console.log('Batch Job Created:');
console.log(` Job ID: ${batchResponse.jobId}`);
console.log(` Status: ${batchResponse.status}`);
console.log(` Status URL: ${batchResponse.statusUrl}`);
console.log(` Result URL: ${batchResponse.resultUrl}`);
// Store these URLs for monitoring the job
// Use statusUrl to check progress
// Use resultUrl to get final outcomes
return batchResponse;
} catch (error) {
console.error('Failed to create virtual accounts:', error.message);
throw error;
}
}
// Example usage:
// Create multiple virtual accounts
createVirtualAccounts();Required Permission: create-virtual-account
This endpoint requires the permission claim create-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Optional URL to receive asynchronous notifications about the async job processing status.
Optional custom headers to include in the account creation request. It will be sent back in callbacks. Max 10 headers, each key max 50 chars, each value max 500 chars
Payload containing the details of virtual accounts to be created in batch.
ISO 4217 currency code for the virtual account (e.g., USD, EUR, BMD). Must be a supported currency by the bank.
Human-readable nickname or label for the virtual account. Used for display purposes and client identification.
Official account name as it will appear on statements and official documents. This is the formal name of the virtual account.
Client-provided reference identifier for tracking and identification purposes. This reference should be unique within the client's system for easier reconciliation.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"callbackUrl": "https://my-callback-url.com",
"customHeaders": {
"X-Custom-Header-1": "Custom Value 1",
"X-Custom-Header-2": "Custom Value 2"
},
"items": [
{
"currency": "USD",
"accountHolderName": "Test Company Ltd",
"accountName": "Test Virtual Account 001",
"clientReference": "BATCH-REF-001",
"dateOfBirth": "1990-01-01T00:00:00.0000000",
"nativeLanguageName": "John Doe"
},
{
"currency": "USD",
"accountHolderName": "Test Company Ltd",
"accountName": "Test Virtual Account 002",
"clientReference": "BATCH-REF-002",
"dateOfBirth": null,
"nativeLanguageName": null
},
{
"currency": "USD",
"accountHolderName": "Test Company Ltd",
"accountName": "Test Virtual Account 003",
"clientReference": "BATCH-REF-003",
"dateOfBirth": null,
"nativeLanguageName": null
}
]
}'{ "jobId": "550e8400-e29b-41d4-a716-446655440001", "status": "Pending", "statusUrl": "https://api.bcb.bm/v1/jobs/550e8400-e29b-41d4-a716-446655440001", "resultUrl": "https://api.bcb.bm/v1/jobs/550e8400-e29b-41d4-a716-446655440001/results" }
Request
Retrieves all virtual accounts for the authenticated corporate client. This endpoint:
- Returns a paginated list of virtual accounts for the client
- Response contains the client’s real (non-virtual) accounts as well:
- Settlement Account – the primary clearing account used for cash movements. Account category: "CMS Settlement".
- Parent Account – the parent account under which all virtual accounts are organised. Account category: "CMS Parent Cate".
- Virtual accounts have the category "CMS Sub Acct".
- Supports optional currency filtering to return only accounts in a specific currency
- Supports pagination for efficient handling of large account datasets
Use the optional currency query parameter to filter results:
- Must be a valid 3-letter ISO currency code (e.g., USD, BMD, EUR)
- If omitted, accounts in all currencies are returned
This endpoint uses cursor-based pagination with server-side result-set management:
- First Request: Optionally specify
pageSize(default: 100, max: 1000). The server creates a cursor and returns apageToken. - Subsequent Requests: Use the
pageTokenfrom previous responses withpageStartto navigate pages. - Page Token: Contains encoded pagination context including pageSize, so don't specify
pageSizein subsequent requests. - Total Pages: Calculate using
Math.ceil(total_size / page_size)from the response metadata.
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts
async function getAllVirtualAccounts(currency = null, pageSize = 25) {
try {
// Build URL with optional parameters
let url = 'https://api.bcb.bm/v1/virtual-accounts';
const params = new URLSearchParams();
if (currency) {
params.append('currency', currency);
}
params.append('pageSize', pageSize.toString());
params.append('pageStart', '0');
url += '?' + params.toString();
const response = await fetch(url, {
method: 'GET',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json'
}
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Virtual accounts retrieval failed: ${JSON.stringify(errorData)}`);
}
// Parse JSON response
const result = await response.json();
// Access pagination info
const pagination = result.meta.pagination;
console.log(`Page: ${pagination.page_start}, Size: ${pagination.page_size}, Total: ${pagination.total_size}`);
// Process virtual accounts
result.data.forEach((account, index) => {
console.log(`Account ${index + 1}:`);
console.log(` Virtual Account Number: ${account.virtualAccountNumber}`);
console.log(` BIC: ${account.bicCode}`);
console.log(` Account Holder: ${account.accountHolderName}`);
console.log(` Account Name: ${account.accountName}`);
console.log(` Currency: ${account.currency}`);
console.log(` Balance: ${account.balance ? account.balance.amount + ' ' + account.balance.currency : 'N/A'}`);
console.log(` Category: ${account.category}`);
if (account.clientReference) {
console.log(` Client Reference: ${account.clientReference}`);
}
if (account.effectiveDate) {
console.log(` Effective Date: ${account.effectiveDate}`);
}
if (account.createdAt) {
console.log(` Created At: ${account.createdAt}`);
}
// Log parent/settlement account relationships
if (account.parentAccount) {
console.log(` Parent Account: ${account.parentAccount.accountNumber} (${account.parentAccount.accountName})`);
}
if (account.settlementAccount) {
console.log(` Settlement Account: ${account.settlementAccount.accountNumber} (${account.settlementAccount.accountName})`);
}
console.log('---');
});
return result;
} catch (error) {
console.error('Failed to retrieve virtual accounts:', error.message);
throw error;
}
}
// Example usage:
// Get all virtual accounts
getAllVirtualAccounts();
// Get only USD virtual accounts
getAllVirtualAccounts('USD');
// Get first 10 virtual accounts
getAllVirtualAccounts(null, 10);Required Permission: get-virtual-accounts
This endpoint requires the permission claim get-virtual-accounts to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Optional. The currency of the virtual accounts to filter by. If not specified, all virtual accounts will be returned.
Optional. Unique cursor ID received from previous response for subsequent requests. Contains encoded pagination context including page_size.
Optional. The record from which the response should be displayed (default: 1).
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts?currency=str&pageToken=string&pageStart=0&pageSize=0' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>'{ "meta": { "pagination": { … } }, "data": [ { … }, { … }, { … }, { … }, { … }, { … }, { … } ] }
Request
Updates an existing virtual (sub) account for a corporate client. Only the fields provided in the request body will be updated.
Updateable Properties
- accountHolderName: Human-readable label for the virtual account.
- accountName: Official account title that will appear on statements.
- clientReference: External reference provided by the client to aid reconciliation (max 35 characters).
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
async function updateVirtualAccount(virtualAccountNumber) {
try {
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${virtualAccountNumber}`, {
method: 'PATCH',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json'
},
body: JSON.stringify({
accountHolderName: 'Updated Project Alpha Escrow',
accountName: 'Updated Project Alpha Virtual Account',
clientReference: 'updated-reference-123'
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Virtual account update failed: ${JSON.stringify(errorData)}`);
}
// Parse JSON response
const result = await response.json();
const virtualAccount = result.data;
// Log updated details
console.log('Virtual Account Updated Successfully:');
console.log(` Account Number: ${virtualAccount.virtualAccountNumber}`);
console.log(` Account Holder: ${virtualAccount.accountHolderName}`);
console.log(` Account Name: ${virtualAccount.accountName}`);
console.log(` Currency: ${virtualAccount.currency}`);
console.log(` Category: ${virtualAccount.category}`);
if (virtualAccount.balance) {
console.log(` Balance: ${virtualAccount.balance.amount} ${virtualAccount.balance.currency}`);
}
if (virtualAccount.clientReference) {
console.log(` Client Reference: ${virtualAccount.clientReference}`);
}
console.log(` Effective Date: ${virtualAccount.effectiveDate}`);
console.log(` Created: ${virtualAccount.createdAt}`);
// Log parent/settlement account info
if (virtualAccount.parentAccount) {
console.log(` Parent Account: ${virtualAccount.parentAccount.accountNumber} (${virtualAccount.parentAccount.accountSubType})`);
}
if (virtualAccount.settlementAccount) {
console.log(` Settlement Account: ${virtualAccount.settlementAccount.accountNumber} (${virtualAccount.settlementAccount.accountSubType})`);
}
return result;
} catch (err) {
console.error('Error updating virtual account:', err);
throw err;
}
}
// Example usage:
updateVirtualAccount('1000327642');Required Permission: update-virtual-account
This endpoint requires the permission claim update-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Payload containing virtual account fields to update
Virtual account name Used for display purposes and client identification.
Official account title as it will appear on statements and official documents. This is the formal name of the virtual account.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X PATCH \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"accountHolderName": "Updated Project Alpha Escrow",
"accountName": "Updated Project Alpha Virtual Account",
"clientReference": "ref-1234567890"
}'{ "effectiveDate": "2025-06-20", "createdAt": "2025-07-25T08:23:00.0000000Z", "parentAccount": { "accountId": "1000326956-2000365", "cif": 2000365, "currency": "USD", "accountSubType": "CMS Parent Cate", "accountNumber": 1000326956, "status": "AUTH", "availableBalance": { … }, "owners": [ … ], "accountAttributes": [] }, "settlementAccount": { "accountId": "1000326948-2000365", "cif": 2000365, "currency": "USD", "accountSubType": "CMS Settlement", "accountNumber": 1000326948, "status": "AUTH", "availableBalance": { … }, "owners": [ … ], "accountAttributes": [] }, "virtualAccountNumber": 1000327642, "bicCode": "BPBKBMHMXXX", "accountHolderName": "T1 Project Alpha Escrow", "accountName": "New Title T2", "currency": "USD", "balance": { "currency": "USD", "amount": 0 }, "category": "CMS Sub Acct", "clientReference": "T12cc62d3fb446e7950ffd0797d0a6f41" }
Request
Retrieves comprehensive information about a specific virtual account, including all its sub-accounts, parent account details, and settlement account information. This endpoint:
- Returns the virtual account details as a single object
- Includes parent account information (the account this virtual account is derived from)
- Provides settlement account details (the account used for settlement operations)
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{accountNumber}
async function getVirtualAccountDetails(accountNumber) {
try {
const url = `https://api.bcb.bm/v1/virtual-accounts/${encodeURIComponent(accountNumber)}`;
const response = await fetch(url, {
method: 'GET',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json'
}
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Virtual account details retrieval failed: ${JSON.stringify(errorData)}`);
}
// Parse JSON response
const result = await response.json();
// Get the virtual account details (single object, not an array)
const virtualAccount = result.data;
console.log('Virtual Account Details:');
console.log(` Account Number: ${virtualAccount.virtualAccountNumber}`);
console.log(` BIC: ${virtualAccount.bicCode}`);
console.log(` Account Holder: ${virtualAccount.accountHolderName}`);
console.log(` Account Name: ${virtualAccount.accountName}`);
console.log(` Currency: ${virtualAccount.currency}`);
console.log(` Category: ${virtualAccount.category}`);
if (virtualAccount.balance) {
console.log(` Balance: ${virtualAccount.balance.amount} ${virtualAccount.balance.currency}`);
}
console.log(` Effective Date: ${virtualAccount.effectiveDate}`);
console.log(` Created: ${virtualAccount.createdAt}`);
if (virtualAccount.clientReference) {
console.log(` Client Reference: ${virtualAccount.clientReference}`);
}
// Log parent account details
if (virtualAccount.parentAccount) {
console.log(' Parent Account:');
console.log(` Account Number: ${virtualAccount.parentAccount.accountNumber}`);
console.log(` Account ID: ${virtualAccount.parentAccount.accountId}`);
console.log(` CIF: ${virtualAccount.parentAccount.cif}`);
console.log(` Currency: ${virtualAccount.parentAccount.currency}`);
console.log(` Sub Type: ${virtualAccount.parentAccount.accountSubType}`);
console.log(` Status: ${virtualAccount.parentAccount.status}`);
if (virtualAccount.parentAccount.availableBalance) {
console.log(` Available Balance: ${virtualAccount.parentAccount.availableBalance.amount} ${virtualAccount.parentAccount.availableBalance.currency}`);
}
if (virtualAccount.parentAccount.owners && virtualAccount.parentAccount.owners.length > 0) {
console.log(` Owner: ${virtualAccount.parentAccount.owners[0].displayName} (${virtualAccount.parentAccount.owners[0].accountHolderType})`);
}
}
// Log settlement account details
if (virtualAccount.settlementAccount) {
console.log(' Settlement Account:');
console.log(` Account Number: ${virtualAccount.settlementAccount.accountNumber}`);
console.log(` Account ID: ${virtualAccount.settlementAccount.accountId}`);
console.log(` CIF: ${virtualAccount.settlementAccount.cif}`);
console.log(` Currency: ${virtualAccount.settlementAccount.currency}`);
console.log(` Sub Type: ${virtualAccount.settlementAccount.accountSubType}`);
console.log(` Status: ${virtualAccount.settlementAccount.status}`);
if (virtualAccount.settlementAccount.availableBalance) {
console.log(` Available Balance: ${virtualAccount.settlementAccount.availableBalance.amount} ${virtualAccount.settlementAccount.availableBalance.currency}`);
}
if (virtualAccount.settlementAccount.owners && virtualAccount.settlementAccount.owners.length > 0) {
console.log(` Owner: ${virtualAccount.settlementAccount.owners[0].displayName} (${virtualAccount.settlementAccount.owners[0].accountHolderType})`);
}
}
return result;
} catch (error) {
console.error('Failed to retrieve virtual account details:', error.message);
throw error;
}
}
// Example usage:
// Get details for a specific virtual account
getVirtualAccountDetails('1000326808');Required Permission: get-a-virtual-account
This endpoint requires the permission claim get-a-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>'{ "effectiveDate": "2025-06-20", "createdAt": "2025-07-25T08:23:00.0000000Z", "parentAccount": { "accountId": "1000326956-2000365", "cif": 2000365, "currency": "USD", "accountSubType": "CMS Parent Cate", "accountNumber": 1000326956, "status": "AUTH", "availableBalance": { … }, "owners": [ … ], "accountAttributes": [] }, "settlementAccount": { "accountId": "1000326948-2000365", "cif": 2000365, "currency": "USD", "accountSubType": "CMS Settlement", "accountNumber": 1000326948, "status": "AUTH", "availableBalance": { … }, "owners": [ … ], "accountAttributes": [] }, "virtualAccountNumber": 1000327642, "bicCode": "BPBKBMHMXXX", "accountHolderName": "T1 Project Alpha Escrow", "accountName": "New Title T2", "currency": "USD", "balance": { "currency": "USD", "amount": 0 }, "category": "CMS Sub Acct", "clientReference": "T12cc62d3fb446e7950ffd0797d0a6f41" }
Request
Retrieves transaction entries for a specific virtual (sub) account within a given date range. This endpoint:
- Validates the provided date parameters. Accepted formats:
yyyy-MM-ddoryyyyMMdd. - Supports a maximum date range of one year.
- Supports both JSON and CSV response formats based on the Accept header.
- Uses cursor-based pagination with server-side result-set management.
This endpoint uses cursor-based pagination with server-side result-set management:
- First Request: Optionally specify
page_size(default: 100, max: 1000). The server creates a cursor and returns apage_token. - Subsequent Requests: Use the
page_tokenfrom previous responses withpage_startto navigate pages. - Page Token: Contains encoded pagination context including page_size, so don't specify
page_sizein subsequent requests. - Total Pages: Calculate using
Math.ceil(total_size / page_size)from the response metadata.
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}/transactions
// Get first page
async function getVirtualAccountTransactions(virtualAccountNumber, fromDate, toDate) {
const url = new URL(`https://api.bcb.bm/v1/virtual-accounts/${encodeURIComponent(virtualAccountNumber)}/transactions`);
url.searchParams.set('fromDate', fromDate); // yyyy-MM-dd or yyyyMMdd
url.searchParams.set('toDate', toDate); // yyyy-MM-dd or yyyyMMdd
url.searchParams.set('pageSize', '100'); // optional (first call only)
const response = await fetch(url.toString(), {
method: 'GET',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Accept': 'application/json'
}
});
if (!response.ok) {
const error = await response.json();
throw new Error(`Failed to get VA transactions: ${error.message || 'Unknown error'}`);
}
const result = await response.json();
// result.meta.pagination: { page_start, page_token, total_size, page_size }
// result.data: Array of VA transactions
// Example: inspect first item
if (result.data?.length) {
const t = result.data[0];
console.log('Tx:', t.id, t.description, t.valueDate, t.value?.amount, t.value?.currency, t.debitAccountNumber?.number, t.creditAccountNumber?.number);
}
return result;
}
// Paginate through all pages
async function getAllVirtualAccountTransactions(virtualAccountNumber, fromDate, toDate) {
let pageStart = 1;
let pageToken = null;
let totalPages = 0;
const all = [];
do {
const url = new URL(`https://api.bcb.bm/v1/virtual-accounts/${encodeURIComponent(virtualAccountNumber)}/transactions`);
url.searchParams.set('fromDate', fromDate);
url.searchParams.set('toDate', toDate);
if (pageStart === 1) {
url.searchParams.set('pageSize', '100'); // first call only
} else {
url.searchParams.set('pageStart', String(pageStart));
url.searchParams.set('pageToken', pageToken);
}
const res = await fetch(url.toString(), {
headers: { 'Authorization': 'Bearer YOUR_ACCESS_TOKEN', 'Accept': 'application/json' }
});
if (!res.ok) throw new Error('Request failed');
const body = await res.json();
if (pageStart === 1) {
const p = body.meta?.pagination;
pageToken = p?.page_token;
totalPages = Math.ceil((p?.total_size ?? 0) / (p?.page_size ?? 100));
console.log('First page meta:', p);
}
if (Array.isArray(body.data)) all.push(...body.data);
pageStart++;
} while (pageStart <= totalPages);
return all;
}Required Permission: get-virtual-account-transactions
This endpoint requires the permission claim get-virtual-account-transactions to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}/transactions
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}/transactions
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}/transactions
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}/transactions?fromDate=string&toDate=string&pageToken=string&pageStart=0&pageSize=0' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>'{ "meta": { "pagination": { … } }, "data": [ { … }, { … }, { … }, { … } ] }
Request
Retrieves detailed information for a specific virtual-account transaction identified by its globally unique transaction ID. This endpoint:
- Returns a single transaction detail object with full context (accounts, amounts, value date, narrative, attributes)
- Supports both JSON and CSV response formats based on the Accept header
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
The transaction detail response includes routing metadata for debitAccountNumber or/and creditAccountNumber depending of transaction type. Account entity contains an accountRoutings collection with up to four entries (when data is available):
BankId– BIC / SWIFT identifier of the bank handling the accountBankName– Legal name of the bankAccountName– Account holder or counterparty nameAccountAddress– Postal address details associated with the account
Entries are ordered as listed above and only appear when the upstream system returns the corresponding value. Consumers can rely on the scheme field to differentiate each routing record.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/transactions/{transactionId}
async function getVirtualAccountTransactionDetail(transactionId) {
const url = `https://api.bcb.bm/v1/virtual-accounts/transactions/${encodeURIComponent(transactionId)}`;
const response = await fetch(url, {
method: 'GET',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Accept': 'application/json'
}
});
if (!response.ok) {
const error = await response.json();
throw new Error(`Failed to get VA transaction detail: ${error.message || 'Unknown error'}`);
}
const result = await response.json();
// result is a single transaction detail object
console.log('Transaction ID:', result.id);
console.log('Description:', result.description);
console.log('Value Date:', result.valueDate);
if (result.value) {
console.log('Amount:', result.value.amount, result.value.currency);
}
return result;
}Required Permission: get-virtual-account-transactions
This endpoint requires the permission claim get-virtual-account-transactions to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/transactions/{transactionId}
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/transactions/{transactionId}
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/transactions/{transactionId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/transactions/{transactionId}' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>'{ "debitAccountNumber": { "number": 1111111111, "accountRoutings": [ … ] }, "creditAccountNumber": { "number": 2222222222, "accountRoutings": [ … ] }, "status": "COMPLETED", "counterpartyReference": "CTP-2024-000123", "id": "TX-2024-000123", "description": "Payout to sub-account", "bookingDate": "2025-08-04", "valueDate": "2025-08-04", "value": { "currency": "USD", "amount": 100 }, "proprietaryBankTransactionCode": "PARENT.TO.SUB" }
Request
Reverses a specific virtual-account transaction identified by its globally unique transaction ID. This endpoint:
- Reverses the specified transaction and returns the reversal details
- Supports both JSON and CSV response formats based on the Accept header
- Requires appropriate permissions to perform transaction reversals
- Same-Day Reversal Only: The current development design allows only to reverse records created on the same day
- Completed Status Required: The transaction status must have "Completed" status to be eligible for reversal
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/transactions/{transactionId}
async function reverseVirtualAccountTransaction(transactionId) {
const url = `https://api.bcb.bm/v1/virtual-accounts/transactions/${encodeURIComponent(transactionId)}`;
const response = await fetch(url, {
method: 'DELETE',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
}
});
if (!response.ok) {
const error = await response.json();
throw new Error(`Failed to reverse VA transaction: ${error.message || 'Unknown error'}`);
}
const result = await response.json();
// result is a transaction reversal object
console.log('Reversal Transaction ID:', result.transactionId);
console.log('Status:', result.status);
console.log('Transaction Status:', result.transactionStatus);
if (result.value) {
console.log('Amount:', result.value.amount, result.value.currency);
}
return result;
}Required Permission: reverse-virtual-account-transaction
This endpoint requires the permission claim reverse-virtual-account-transaction to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/transactions/{transactionId}
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/transactions/{transactionId}
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/transactions/{transactionId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X DELETE \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/transactions/{transactionId}' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>'Created - The transaction reversal was successful.
Unique identifier of the original (now reversed) transaction (e.g., FT1234567).
Reversal processing status reported by the core system (e.g., Reversed). Typically reflects the system's internal status code for the reversal lifecycle.
Unique correlation / tracking identifier supplied by or derived from the core system (e.g., message or processing reference).
{ "transactionId": "FT252255GBQS", "transactionStatus": "Reversed", "status": "success", "uniqueIdentifier": "FT252255GBQS", "value": { "currency": "USD", "amount": 0.03 } }
Request
Retrieves deposit transaction entries for a specific virtual (sub) account. This endpoint:
- Returns detailed deposit transaction information including account numbers, amounts, and transaction status.
- Supports both JSON and CSV response formats based on the Accept header.
- Uses cursor-based pagination with server-side result-set management.
This endpoint uses cursor-based pagination with server-side result-set management:
- First Request: Optionally specify
page_size(default: 100, max: 1000). The server creates a cursor and returns apage_token. - Subsequent Requests: Use the
page_tokenfrom previous responses withpage_startto navigate pages. - Page Token: Contains encoded pagination context including page_size, so don't specify
page_sizein subsequent requests. - Total Pages: Calculate using
Math.ceil(total_size / page_size)from the response metadata.
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}/deposits
// Get first page of deposits
async function getVirtualAccountDeposits(virtualAccountNumber, fromDate, toDate) {
const url = new URL(`https://api.bcb.bm/v1/virtual-accounts/${encodeURIComponent(virtualAccountNumber)}/deposits`);
url.searchParams.set('fromDate', fromDate); // yyyy-MM-dd or yyyyMMdd
url.searchParams.set('toDate', toDate); // yyyy-MM-dd or yyyyMMdd
url.searchParams.set('pageSize', '100'); // optional (first call only)
const response = await fetch(url.toString(), {
method: 'GET',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Accept': 'application/json'
}
});
if (!response.ok) {
const error = await response.json();
throw new Error(`Failed to get VA deposits: ${error.message || 'Unknown error'}`);
}
const result = await response.json();
// result.meta.pagination: { page_start, page_token, total_size, page_size }
// result.data: Array of VA deposit transactions
// Example: inspect first deposit
if (result.data?.length) {
const d = result.data[0];
console.log('Deposit:', d.id, d.valueDate, d.value?.amount, d.value?.currency, d.proprietaryBankTransactionCode);
console.log('From:', d.debitAccountNumber?.number, 'To:', d.creditAccountNumber?.number);
console.log('Status:', d.status);
}
return result;
}
// Paginate through all deposit pages
async function getAllVirtualAccountDeposits(virtualAccountNumber, fromDate, toDate) {
let pageStart = 1;
let pageToken = null;
let totalPages = 0;
const all = [];
do {
const url = new URL(`https://api.bcb.bm/v1/virtual-accounts/${encodeURIComponent(virtualAccountNumber)}/deposits`);
url.searchParams.set('fromDate', fromDate);
url.searchParams.set('toDate', toDate);
if (pageStart === 1) {
url.searchParams.set('pageSize', '100'); // first call only
} else {
url.searchParams.set('pageStart', String(pageStart));
url.searchParams.set('pageToken', pageToken);
}
const res = await fetch(url.toString(), {
headers: { 'Authorization': 'Bearer YOUR_ACCESS_TOKEN', 'Accept': 'application/json' }
});
if (!res.ok) throw new Error('Request failed');
const body = await res.json();
if (pageStart === 1) {
const p = body.meta?.pagination;
pageToken = p?.page_token;
totalPages = Math.ceil((p?.total_size ?? 0) / (p?.page_size ?? 100));
console.log('First page meta:', p);
}
if (Array.isArray(body.data)) all.push(...body.data);
pageStart++;
} while (pageStart <= totalPages);
return all;
}Required Permission: deposit-virtual-account
This endpoint requires the permission claim deposit-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}/deposits
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}/deposits
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}/deposits
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}/deposits?fromDate=string&toDate=string&pageToken=string&pageStart=0&pageSize=0' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>'{ "meta": { "pagination": { … } }, "data": [ { … }, { … }, { … } ] }
Request
Credits funds to a virtual account from a parent account. This endpoint allows clients to transfer funds into a virtual account.
The request must include source account details, the amount to be credited, and currency information.
- Transfers funds from a source account to a virtual account
- Supports idempotency to prevent duplicate transactions
- Validates account numbers and currency matching
- Supports both JSON and CSV response formats
- Automatic account number validation and matching
- The virtual account number (creditAccountNumber) is specified in the URL route, not in the request body
- Ensure the source account has sufficient funds before making the request
- Virtual accounts must be in an active state to receive credits
Virtual Account Hierarchy Virtual accounts are sub-accounts linked to a parent account:
Parent Account → Virtual Account (Sub-Account)When crediting a virtual account, funds flow from the parent account to the virtual account.
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{accountNumber}/transfers/credit
async function creditVirtualAccount() {
try {
const virtualAccountNumber = "1556008272";
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${virtualAccountNumber}/transfers/credit`, {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
debitAccountNumber: "1000320567",
debitAmountCurrency: "USD",
creditAmountCurrency: "USD", // Must match debitAmountCurrency
debitAmount: "100.00"
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Credit transfer failed: ${JSON.stringify(errorData)}`);
}
const data = await response.json();
console.log('Credit transfer result:', data);
// Example processing of the returned object
const { id, status, uniqueIdentifier, details, linkedActivities } = data;
const { debitAmount, valueDate, childTransactionId, creditAmountCurrency, debitAccountNumber, creditAccountNumber } = details;
// Log the main transfer details
console.log('Transaction ID:', id);
console.log('Status:', status);
console.log('Unique Identifier:', uniqueIdentifier);
console.log('Debit Amount:', debitAmount.amount, debitAmount.currency);
console.log('Value Date:', valueDate);
console.log('Child Transaction ID:', childTransactionId);
console.log('Credit Amount Currency:', creditAmountCurrency);
// Process debit account information
console.log('Debit Account Number:', debitAccountNumber.number);
// Process credit account information (virtual account)
console.log('Credit Account Number:', creditAccountNumber.number);
// Process linked activities
linkedActivities.forEach(activity => {
console.log('Linked Activity ID:', activity.id);
console.log('Linked Activity Transaction Status:', activity.transactionStatus);
console.log('Linked Activity Status:', activity.status);
console.log('Linked Activity Unique Identifier:', activity.uniqueIdentifier);
const { arrangementId, activityId, productId, currencyId, effectiveDate } = activity.activityDetails;
console.log('Linked Activity Arrangement ID:', arrangementId);
console.log('Linked Activity Activity ID:', activityId);
console.log('Linked Activity Product ID:', productId);
console.log('Linked Activity Currency ID:', currencyId);
console.log('Linked Activity Effective Date:', effectiveDate);
});
// Final status logging
if (status === 'success') {
console.log('The virtual account credit was successful.');
} else {
console.log('The virtual account credit failed:', status);
}
} catch (error) {
console.error('Error crediting virtual account:', error);
}
}
creditVirtualAccount();Required Permission: deposit-virtual-account
This endpoint requires the permission claim deposit-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
The credit transfer request details.
Gets or sets the currency code of the debit amount. Exactly 3 letters (ISO 4217).
The currency code for the credit amount, such as "USD", "EUR", etc. Exactly 3 letters (ISO 4217).
The amount of money to be transferred. Ensure the amount does not exceed the available balance in the debit account.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{accountNumber}/transfers/credit
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{accountNumber}/transfers/credit
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{accountNumber}/transfers/credit
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{accountNumber}/transfers/credit' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"debitAccountNumber": 1000320567,
"debitAmountCurrency": "USD",
"creditAmountCurrency": "USD",
"debitAmount": 100
}'The virtual account was credited successfully.
The current processing status of the transaction, e.g. Completed, Pending, Failed
List of related financial activities
The current processing status of the transaction.
A unique identifier specific to this instance of the activity.
Unique identifier for the arrangement associated with this activity.
Identifier for the type of activity.
Product identifier related to the activity.
{ "id": "AA25174JFTXZ", "status": "success", "uniqueIdentifier": "fc17c362-ae8c-47b9-9080-7e475ac31c96", "details": { "debitAmount": { … }, "valueDate": "2025-06-20", "childTransactionId": 292386, "creditAmountCurrency": "USD", "debitAccountNumber": { … }, "creditAccountNumber": { … } }, "linkedActivities": [ { … } ] }
Request
Initiates a debit transfer from a virtual (sub) account to transfer funds to the parent account and ultimately to the settlement account. This endpoint allows corporate clients to withdraw funds from their virtual accounts for settlement purposes.
Use Case: As a corporate client, I want to debit a sub account to transfer funds to the parent account and ultimately to the settlement account.
- Transfers funds from a virtual account to a main account
- Supports idempotency to prevent duplicate transactions
- Validates account numbers and currency matching
- Supports both JSON and CSV response formats
- Automatic account number validation and matching
- The virtual account number (debitAccountNumber) is specified in the URL route, not in the request body
- Ensure the virtual account has sufficient funds before making the request
Virtual Account Hierarchy Virtual accounts are sub-accounts linked to a parent account:
Virtual Account (Sub-Account) → Parent AccountWhen debiting a virtual account, funds flow from the virtual account to the parent account.
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{accountNumber}/transfers/debit
async function debitVirtualAccount() {
try {
const accountNumber = "1000000000"; // Virtual account number
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${accountNumber}/transfers/debit`, {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
debitAmount: "1000.00",
debitAmountCurrency: "USD",
creditAccountNumber: "1000320567", // Parent/settlement account
creditAmountCurrency: "USD", // Must match debitAmountCurrency
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Debit transfer failed: ${JSON.stringify(errorData)}`);
}
const data = await response.json();
console.log('Debit transfer result:', data);
// Example processing of the returned object
const { id, status, uniqueIdentifier, details, linkedActivities } = data;
const { debitAmount, valueDate, childTransactionId, creditAmountCurrency, debitAccountNumber, creditAccountNumber } = details;
// Log the main transfer details
console.log('Transaction ID:', id);
console.log('Status:', status);
console.log('Unique Identifier:', uniqueIdentifier);
console.log('Debit Amount:', debitAmount.amount, debitAmount.currency);
console.log('Value Date:', valueDate);
console.log('Child Transaction ID:', childTransactionId);
console.log('Credit Amount Currency:', creditAmountCurrency);
// Process debit account information
console.log('Debit Account Number:', debitAccountNumber.number);
// Process credit account information
console.log('Credit Account Number:', creditAccountNumber.number);
// Process linked activities
linkedActivities.forEach(activity => {
console.log('Linked Activity ID:', activity.id);
console.log('Linked Activity Transaction Status:', activity.transactionStatus);
console.log('Linked Activity Status:', activity.status);
console.log('Linked Activity Unique Identifier:', activity.uniqueIdentifier);
const { arrangementId, activityId, productId, currencyId, effectiveDate } = activity.activityDetails;
console.log('Linked Activity Arrangement ID:', arrangementId);
console.log('Linked Activity Activity ID:', activityId);
console.log('Linked Activity Product ID:', productId);
console.log('Linked Activity Currency ID:', currencyId);
console.log('Linked Activity Effective Date:', effectiveDate);
});
// Final status logging
if (status === 'SUCCESS') {
console.log('The debit transfer was successful.');
} else {
console.log('The debit transfer failed:', status);
}
} catch (error) {
console.error('Error debiting virtual account:', error);
}
}
// Execute example
debitVirtualAccount();Required Permission: withdraw-virtual-account
This endpoint requires the permission claim withdraw-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
The debit transfer request details.
Gets or sets the currency code of the debit amount. Exactly 3 letters (ISO 4217).
The currency code for the credit amount, such as "USD", "EUR", etc. Exactly 3 letters (ISO 4217).
The amount of money to be transferred. Ensure the amount does not exceed the available balance in the debit account.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{accountNumber}/transfers/debit
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{accountNumber}/transfers/debit
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{accountNumber}/transfers/debit
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{accountNumber}/transfers/debit' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"creditAccountNumber": 1556008272,
"debitAmountCurrency": "USD",
"creditAmountCurrency": "USD",
"debitAmount": 100
}'The virtual account was debited successfully.
The current processing status of the transaction, e.g. Completed, Pending, Failed
List of related financial activities
The current processing status of the transaction.
A unique identifier specific to this instance of the activity.
Unique identifier for the arrangement associated with this activity.
Identifier for the type of activity.
Product identifier related to the activity.
{ "id": "AA25174JFTXZ", "status": "success", "uniqueIdentifier": "fc17c362-ae8c-47b9-9080-7e475ac31c96", "details": { "debitAmount": { … }, "valueDate": "2025-06-20", "childTransactionId": 292386, "creditAmountCurrency": "USD", "debitAccountNumber": { … }, "creditAccountNumber": { … } }, "linkedActivities": [ { … } ] }
Request
Corporate Client initiates Settlement request to BCB to debit Settlement Account and credit to Counterparty Account. This endpoint allows clients to transfer funds from a settlement account to an internal counterparty account.
- Transfers funds from a settlement account to an internal counterparty account
- Supports idempotency to prevent duplicate transactions
- Validates account numbers and currency matching
- Supports both JSON and CSV response formats
- Automatic settlement account number validation
- The settlementAccountNumber in the route parameter identifies the source settlement account
- The creditAccountNumber in the request body specifies the destination counterparty account
- Ensure the settlement account has sufficient funds before making the request
- Settlement accounts must be in an active state to process transfers
Settlement accounts are special accounts used for counterparty transactions:
Settlement Account → Counterparty Account (Internal)When processing a settlement transfer, funds flow from the settlement account to the counterparty account.
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{settlementAccountNumber}/settlements/internal
async function processInternalSettlement() {
try {
const settlementAccountNumber = "1000320559";
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${settlementAccountNumber}/settlements/internal`, {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
debitCurrency: "USD",
creditAmount: {
amount: "1000.00",
currency: "USD"
},
creditAccountNumber: "1000076925"
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Internal settlement failed: ${JSON.stringify(errorData)}`);
}
const data = await response.json();
console.log('Internal settlement result:', data);
// Example processing of the returned object
const { id, status, uniqueIdentifier, details, linkedActivities } = data;
const { creditAmount, debitAmountCurrency, debitAccountNumber, creditAccountNumber, valueDate } = details;
// Log the main transfer details
console.log('Transaction ID:', id);
console.log('Status:', status);
console.log('Unique Identifier:', uniqueIdentifier);
console.log('Credit Amount:', creditAmount.amount, creditAmount.currency);
console.log('Debit Amount Currency:', debitAmountCurrency);
console.log('Value Date:', valueDate);
// Process debit account information (settlement account)
console.log('Debit Account Number:', debitAccountNumber.number);
// Process credit account information (counterparty account)
console.log('Credit Account Number:', creditAccountNumber.number);
// Final status logging
if (status === 'success') {
console.log('The internal settlement was successful.');
} else {
console.log('The internal settlement failed:', status);
}
} catch (error) {
console.error('Error processing internal settlement:', error);
}
}
processInternalSettlement();Required Permission: counter-party-settlement-transaction
This endpoint requires the permission claim counter-party-settlement-transaction to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Payload containing internal settlement transfer details.
The currency code for the debit amount (e.g., "USD", "EUR"). Exactly 3 letters (ISO 4217).
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{settlementAccountNumber}/settlements/internal
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{settlementAccountNumber}/settlements/internal
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{settlementAccountNumber}/settlements/internal
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{settlementAccountNumber}/settlements/internal' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"debitCurrency": "USD",
"creditAmount": {
"currency": "USD",
"amount": 0.01
},
"creditAccountNumber": 1000076925
}'The settlement transfer was processed successfully.
The current processing status of the transaction, e.g. Completed, Pending, Failed
List of related financial activities
The current processing status of the transaction.
A unique identifier specific to this instance of the activity.
Unique identifier for the arrangement associated with this activity.
Identifier for the type of activity.
Product identifier related to the activity.
{ "id": "FT252324K67K", "status": "success", "uniqueIdentifier": "IRFX252332872527361.00", "details": { "creditAmount": { … }, "debitAmountCurrency": "USD", "debitAccountNumber": { … }, "creditAccountNumber": { … }, "valueDate": "2025-08-20T07:36:00.0000000Z" }, "linkedActivities": [] }
Request
Corporate Client initiates External Settlement request to BCB to debit Settlement Account and credit to External Counterparty Account. This endpoint allows clients to transfer funds from a settlement account to an external counterparty account.
- Transfers funds from a settlement account to an external counterparty account
- Supports idempotency to prevent duplicate transactions
- Supports both JSON and CSV response formats
- Automatic settlement account number validation
- Includes beneficiary and ordering customer information for external transfers
- The settlementAccountNumber in the route parameter identifies the source settlement account
- The request body specifies the destination external counterparty account via
creditorAccount.identification - Ensure the settlement account has sufficient funds before making the request
- Settlement accounts must be in an active state to process transfers
- External transfers require additional beneficiary information for compliance
Settlement accounts are special accounts used for counterparty transactions:
Settlement Account → External Counterparty AccountWhen processing an external settlement transfer, funds flow from the settlement account to the external counterparty account.
External transfers require additional information for regulatory compliance:
- debitCurrency: Currency to debit from the settlement account (e.g., "USD")
- creditAmount: Amount and currency to credit externally (e.g., { amount: "19", currency: "GBP" })
- debtor: Ordering customer information (e.g., company name or reference)
- debtorAgent: Ordering bank/agent identifier (free text)
- creditorAccount.identification: External beneficiary account identifier
- creditorAccount.name / additionalInformation: Beneficiary name and auxiliary details
- chargesType: Who bears charges (e.g., OUR, BEN, SHA)
- creditorAgent: Beneficiary bank info (identification, name, additionalInformation)
- intermediaryAgent (optional): Intermediary bank info (identification, name, additionalInformation)
- remittanceInformation (optional): Unstructured remittance lines
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{settlementAccountNumber}/settlements/external
async function processExternalSettlement() {
try {
const settlementAccountNumber = "1000320559";
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${settlementAccountNumber}/settlements/external`, {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
debitCurrency: "USD",
creditAmount: {
amount: "19",
currency: "GBP"
},
debtor: "ACME GLOBAL TRADING INC.",
debtorAgent: "FIRST ATLANTIC BANK",
creditorAccount: {
identification: "GB29NWBK60161331926819",
name: "OMEGA INTERNATIONAL LTD.",
additionalInformation: ["LONDON", "GB"]
},
chargesType: "OUR",
creditorAgent: {
identification: "//ZZ123456789",
name: "OMEGA BANK",
additionalInformation: ["LONDON", "UK"]
},
intermediaryAgent: {
identification: "INTL",
name: "EURO CLEAR BANK",
additionalInformation: ["BRUSSELS", "BE"]
},
remittanceInformation: ["INVOICE 2025-00042"]
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`External settlement failed: ${JSON.stringify(errorData)}`);
}
const data = await response.json();
console.log('External settlement result:', data);
// Example processing of the returned object
const { id, status, uniqueIdentifier, details, linkedActivities } = data;
const { creditAmount, debitAmountCurrency, debitAccountNumber, creditAccountNumber, valueDate } = details;
// Log the main transfer details
console.log('Transaction ID:', id);
console.log('Status:', status);
console.log('Unique Identifier:', uniqueIdentifier);
console.log('Credit Amount:', creditAmount.amount, creditAmount.currency);
console.log('Debit Amount Currency:', debitAmountCurrency);
console.log('Value Date:', valueDate);
// Process debit account information (settlement account)
console.log('Debit Account Number:', debitAccountNumber.number);
// Process credit account information (external counterparty account)
console.log('Credit Account Number:', creditAccountNumber.number);
// Final status logging
if (status === 'success') {
console.log('The external settlement was successful.');
} else {
console.log('The external settlement failed:', status);
}
} catch (error) {
console.error('Error processing external settlement:', error);
}
}
processExternalSettlement();Required Permission: counter-party-settlement-transaction
This endpoint requires the permission claim counter-party-settlement-transaction to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Payload containing external settlement transfer details.
The currency code for the debit amount (e.g., "USD", "EUR"). Exactly 3 letters (ISO 4217).
The account number to which funds will be credited (destination account). Max length: 36 characters.
The ordering customer information or reference Max length: 35 characters.
The ordering customer agent (e.g., bank identifier code). Max length: 35 characters.
Unique identification of the party, such as a BIC (Bank Identifier Code) for financial institutions or an account number for account holders.
Name by which the party is known and which is usually used to identify the party.
Specifies which party/parties will bear the charges associated with the processing of the transaction, e.g. 'OUR' Max length: 3 characters.
Unique identification of the party, such as a BIC (Bank Identifier Code) for financial institutions or an account number for account holders.
Name by which the party is known and which is usually used to identify the party.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{settlementAccountNumber}/settlements/external
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{settlementAccountNumber}/settlements/external
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{settlementAccountNumber}/settlements/external
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{settlementAccountNumber}/settlements/external' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"debitCurrency": "USD",
"creditAmount": {
"currency": "GBP",
"amount": 19
},
"debtor": "ACME GLOBAL TRADING INC.",
"debtorAgent": "FIRST ATLANTIC BANK",
"creditorAccount": {
"identification": "GB29NWBK60161331926819",
"name": "OMEGA INTERNATIONAL LTD.",
"additionalInformation": [
"LONDON",
"GB"
]
},
"chargesType": "OUR",
"creditorAgent": {
"identification": "//ZZ123456789",
"name": "OMEGA BANK",
"additionalInformation": [
"LONDON",
"UK"
]
},
"intermediaryAgent": {
"identification": "INTL",
"name": "EURO CLEAR BANK",
"additionalInformation": [
"BRUSSELS",
"BE"
]
},
"remittanceInformation": [
"INVOICE 2025-00042"
]
}'The settlement transfer was processed successfully.
The current processing status of the transaction, e.g. Completed, Pending, Failed
List of related financial activities
The current processing status of the transaction.
A unique identifier specific to this instance of the activity.
Unique identifier for the arrangement associated with this activity.
Identifier for the type of activity.
Product identifier related to the activity.
{ "id": "FT252324K67K", "status": "success", "uniqueIdentifier": "IRFX252332872527361.00", "details": { "creditAmount": { … }, "debitAmountCurrency": "USD", "debitAccountNumber": { … }, "creditAccountNumber": { … }, "valueDate": "2025-08-20T07:36:00.0000000Z" }, "linkedActivities": [] }
Request
Initiates an internal withdrawal transfer from a virtual account to an internal destination account. This endpoint allows clients to withdraw funds from a virtual account to an internal account within the institution.
- Withdraws funds from a virtual account to an internal destination account
- Supports idempotency to prevent duplicate transactions
- Validates account numbers and currency matching
- Supports both JSON and CSV response formats
- Automatic virtual account number validation
- The virtualAccountId in the route parameter identifies the source virtual account
- The creditAccountNumber in the request body specifies the destination internal account
- Ensure the virtual account has sufficient funds before making the request
- Virtual accounts must be in an active state to process withdrawals
Virtual account withdrawals transfer funds from virtual accounts to internal accounts:
Virtual Account → Internal Destination AccountWhen processing a withdrawal transfer, funds flow from the virtual account to the internal destination account.
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{virtualAccountId}/withdrawals/internal
async function withdrawFromVirtualAccount() {
try {
const virtualAccountId = "1000320575";
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${virtualAccountId}/withdrawals/internal`, {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
debitCurrency: "USD",
creditAmount: {
currency: "USD",
amount: "100.00"
},
creditAccountNumber: "1000076925"
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Withdrawal transfer failed: ${JSON.stringify(errorData)}`);
}
const data = await response.json();
console.log('Withdrawal transfer result:', data);
// Example processing of the returned object
const { id, status, uniqueIdentifier, details, linkedActivities } = data;
const { debitAmount, valueDate, childTransactionId, creditAmountCurrency, debitAccountNumber, creditAccountNumber } = details;
// Log the main transfer details
console.log('Transaction ID:', id);
console.log('Status:', status);
console.log('Unique Identifier:', uniqueIdentifier);
console.log('Debit Amount:', debitAmount.amount, debitAmount.currency);
console.log('Value Date:', valueDate);
console.log('Child Transaction ID:', childTransactionId);
console.log('Credit Amount Currency:', creditAmountCurrency);
// Process debit account information (virtual account)
console.log('Debit Account Number:', debitAccountNumber.number);
// Process credit account information (internal destination)
console.log('Credit Account Number:', creditAccountNumber.number);
// Process linked activities
linkedActivities.forEach(activity => {
console.log('Linked Activity ID:', activity.id);
console.log('Linked Activity Transaction Status:', activity.transactionStatus);
console.log('Linked Activity Status:', activity.status);
console.log('Linked Activity Unique Identifier:', activity.uniqueIdentifier);
const { arrangementId, activityId, productId, currencyId, effectiveDate } = activity.activityDetails;
console.log('Linked Activity Arrangement ID:', arrangementId);
console.log('Linked Activity Activity ID:', activityId);
console.log('Linked Activity Product ID:', productId);
console.log('Linked Activity Currency ID:', currencyId);
console.log('Linked Activity Effective Date:', effectiveDate);
});
// Final status logging
if (status === 'success') {
console.log('The virtual account withdrawal was successful.');
} else {
console.log('The virtual account withdrawal failed:', status);
}
} catch (error) {
console.error('Error withdrawing from virtual account:', error);
}
}
// Example usage:
withdrawFromVirtualAccount();Required Permission: withdraw-virtual-account
This endpoint requires the permission claim withdraw-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Payload containing internal withdrawal transfer details.
The currency code for the debit amount (e.g., "USD", "EUR"). Exactly 3 letters (ISO 4217).
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountId}/withdrawals/internal
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{virtualAccountId}/withdrawals/internal
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{virtualAccountId}/withdrawals/internal
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountId}/withdrawals/internal' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"debitCurrency": "USD",
"creditAmount": {
"currency": "USD",
"amount": 0.01
},
"creditAccountNumber": 1000076925
}'The withdrawal transfer was processed successfully.
The current processing status of the transaction, e.g. Completed, Pending, Failed
List of related financial activities
The current processing status of the transaction.
A unique identifier specific to this instance of the activity.
Unique identifier for the arrangement associated with this activity.
Identifier for the type of activity.
Product identifier related to the activity.
{ "id": "FT252324K67K", "status": "success", "uniqueIdentifier": "IRFX252332872527361.00", "details": { "creditAmount": { … }, "debitAmountCurrency": "USD", "debitAccountNumber": { … }, "creditAccountNumber": { … }, "valueDate": "2025-08-20T07:36:00.0000000Z" }, "linkedActivities": [] }
Request
Corporate Client initiates External Withdrawal request to BCB to debit Virtual Account and credit to External Beneficiary Account. This endpoint allows clients to withdraw funds from a virtual account to an external beneficiary account.
- Withdraws funds from a virtual account to an external beneficiary account
- Supports idempotency to prevent duplicate transactions
- Supports both JSON and CSV response formats
- Automatic virtual account number validation
- Includes comprehensive beneficiary and ordering customer information for external transfers
- The virtualAccountId in the route parameter identifies the source virtual account
- The request body specifies the destination external beneficiary account via
creditorAccount.identification - Ensure the virtual account has sufficient funds before making the request
- Virtual accounts must be in an active state to process withdrawals
- External transfers require additional beneficiary information for compliance
Virtual account withdrawals transfer funds from virtual accounts to external beneficiary accounts:
Virtual Account → External Beneficiary AccountWhen processing an external withdrawal transfer, funds flow from the virtual account to the external beneficiary account.
External transfers require additional information for regulatory compliance:
- debitCurrency: Currency to debit from the virtual account (e.g., "USD")
- creditAmount: Amount and currency to credit externally (e.g., { amount: "2500.00", currency: "USD" })
- debtor: Ordering customer information (e.g., company name or reference)
- debtorAgent: Ordering bank/agent identifier (free text) - Optional
- creditorAccount.identification: External beneficiary account identifier
- creditorAccount.name / additionalInformation: Beneficiary name and auxiliary details
- chargesType: Who bears charges (e.g., OUR, BEN, SHA)
- creditorAgent: Beneficiary bank info (identification, name, additionalInformation)
- intermediaryAgent (optional): Intermediary bank info (identification, name, additionalInformation)
- remittanceInformation (optional): Unstructured remittance lines
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts/{virtualAccountId}/withdrawals/external
async function processExternalWithdrawal() {
try {
const virtualAccountId = "1000320575";
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${virtualAccountId}/withdrawals/external`, {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
debitCurrency: "USD",
creditAmount: {
currency: "USD",
amount: "2500.00"
},
debtor: "John Smith Corporation",
debtorAgent: "CHASUS33XXX",
creditorAccount: {
identification: "GB29NWBK60161331926819",
name: "Acme Manufacturing Ltd",
additionalInformation: [
"123 Business Street",
"London, UK SW1A 1AA"
]
},
chargesType: "OUR",
creditorAgent: {
identification: "NWBKGB2L",
name: "NatWest Bank",
additionalInformation: [
"250 Bishopsgate",
"London, UK EC2M 4AA"
]
},
intermediaryAgent: {
identification: "CHASUS33",
name: "JPMorgan Chase Bank",
additionalInformation: [
"383 Madison Avenue",
"New York, NY 10017"
]
},
remittanceInformation: [
"Withdrawal from Virtual Account VA-2024-001",
"Transfer to external beneficiary account",
"Reference: WD-2024-789456"
]
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`External withdrawal transfer failed: ${JSON.stringify(errorData)}`);
}
const data = await response.json();
console.log('External withdrawal transfer result:', data);
// Example processing of the returned object
const { id, status, uniqueIdentifier, details, linkedActivities } = data;
const { debitAmount, valueDate, childTransactionId, creditAmountCurrency, debitAccountNumber, creditAccountNumber } = details;
// Log the main transfer details
console.log('Transaction ID:', id);
console.log('Status:', status);
console.log('Unique Identifier:', uniqueIdentifier);
console.log('Debit Amount:', debitAmount.amount, debitAmount.currency);
console.log('Value Date:', valueDate);
console.log('Child Transaction ID:', childTransactionId);
console.log('Credit Amount Currency:', creditAmountCurrency);
// Process debit account information (virtual account)
console.log('Debit Account Number:', debitAccountNumber.number);
// Process credit account information (external beneficiary account)
console.log('Credit Account Number:', creditAccountNumber.number);
// Process linked activities
linkedActivities.forEach(activity => {
console.log('Linked Activity ID:', activity.id);
console.log('Linked Activity Transaction Status:', activity.transactionStatus);
console.log('Linked Activity Status:', activity.status);
console.log('Linked Activity Unique Identifier:', activity.uniqueIdentifier);
const { arrangementId, activityId, productId, currencyId, effectiveDate } = activity.activityDetails;
console.log('Linked Activity Arrangement ID:', arrangementId);
console.log('Linked Activity Activity ID:', activityId);
console.log('Linked Activity Product ID:', productId);
console.log('Linked Activity Currency ID:', currencyId);
console.log('Linked Activity Effective Date:', effectiveDate);
});
// Final status logging
if (status === 'success') {
console.log('The external withdrawal was successful.');
} else {
console.log('The external withdrawal failed:', status);
}
} catch (error) {
console.error('Error processing external withdrawal:', error);
}
}
// Example usage:
processExternalWithdrawal();Required Permission: withdraw-virtual-account
This endpoint requires the permission claim withdraw-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Payload containing external withdrawal transfer details.
The currency code for the debit amount (e.g., "USD", "EUR"). Exactly 3 letters (ISO 4217).
The account number to which funds will be credited (destination account). Max length: 36 characters.
The ordering customer information or reference Max length: 35 characters.
The ordering customer agent (e.g., bank identifier code). Max length: 35 characters.
Unique identification of the party, such as a BIC (Bank Identifier Code) for financial institutions or an account number for account holders.
Name by which the party is known and which is usually used to identify the party.
Specifies which party/parties will bear the charges associated with the processing of the transaction, e.g. 'OUR' Max length: 3 characters.
Unique identification of the party, such as a BIC (Bank Identifier Code) for financial institutions or an account number for account holders.
Name by which the party is known and which is usually used to identify the party.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountId}/withdrawals/external
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{virtualAccountId}/withdrawals/external
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{virtualAccountId}/withdrawals/external
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountId}/withdrawals/external' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"debitCurrency": "USD",
"creditAmount": {
"currency": "USD",
"amount": 2500
},
"debtor": "John Smith Corporation",
"debtorAgent": "CHASUS33XXX",
"creditorAccount": {
"identification": "GB29NWBK60161331926819",
"name": "Acme Manufacturing Ltd",
"additionalInformation": [
"123 Business Street",
"London, UK SW1A 1AA"
]
},
"chargesType": "OUR",
"creditorAgent": {
"identification": "NWBKGB2L",
"name": "NatWest Bank",
"additionalInformation": [
"250 Bishopsgate",
"London, UK EC2M 4AA"
]
},
"intermediaryAgent": {
"identification": "CHASUS33",
"name": "JPMorgan Chase Bank",
"additionalInformation": [
"383 Madison Avenue",
"New York, NY 10017"
]
},
"remittanceInformation": [
"Withdrawal from Virtual Account VA-2024-001",
"Transfer to external beneficiary account",
"Reference: WD-2024-789456"
]
}'The withdrawal transfer was processed successfully.
The current processing status of the transaction, e.g. Completed, Pending, Failed
List of related financial activities
The current processing status of the transaction.
A unique identifier specific to this instance of the activity.
Unique identifier for the arrangement associated with this activity.
Identifier for the type of activity.
Product identifier related to the activity.
{ "id": "FT252324K67K", "status": "success", "uniqueIdentifier": "IRFX252332872527361.00", "details": { "creditAmount": { … }, "debitAmountCurrency": "USD", "debitAccountNumber": { … }, "creditAccountNumber": { … }, "valueDate": "2025-08-20T07:36:00.0000000Z" }, "linkedActivities": [] }