Batch request containing virtual account creation items and optional callback URL.
- Get All Virtual Accounts
Bermuda Commercial Bank RESTful Open Banking API Implementation (v1)
The Bermuda Commercial Bank (BCB) RESTful Open Banking API provides secure, programmatic access to BCB's banking services, enabling developers to integrate financial services into their applications.
- Account details retrieval
- Internal transfers
- Payments (Swift)
- Virtual Accounts
- Transaction information access
- Robust security and compliance
- Comprehensive documentation
Request
Creates one or more virtual (sub) accounts for a corporate client. Virtual accounts allow funds to be segregated and tracked independently while remaining linked to a single settlement account.
Required Request Properties
- items: Array of virtual account creation requests (minimum 1, maximum 1000)
- currency: ISO-4217 currency code for the virtual account (e.g., USD, BMD)
- accountHolderName: Human-readable label for the virtual account (required unless
unallocatedis true). Immutable after first update. - accountName: Official account title that will appear on statements (required unless
unallocatedis true). Immutable after first update.
Optional Request Properties
- unallocated: When set to
true, creates the account in "for allocation" mode with placeholder values ("UNALLOCATED") foraccountHolderNameandaccountName. This allows bulk pre-creation of virtual accounts for later assignment to end-customers via a one-time PATCH update. - dob: Date of birth of the account holder, if applicable. Immutable after first update.
- nativeLanguageName: Native name of the account holder's language, if applicable (max 255 characters). Immutable after first update.
- callbackUrl: URL to receive notifications when the batch job completes (optional)
- clientReference: External reference provided by the client to aid reconciliation (max 35 characters) - per item
- customHeaders: Object of string key/value pairs to be echoed back in the completion callback. Limits: up to 10 headers; each key ≤ 50 characters; each value ≤ 500 characters.
Operationally, clients often need to pre-create many virtual accounts to allocate later. The unallocated flag enables a safe "for allocation" mode:
- Creates accounts with generic placeholder values: "UNALLOCATED" for
accountHolderNameandaccountName - When
unallocatedistrue, theaccountHolderNameandaccountNamefields become optional - Allows a one-time update via PATCH when the account is assigned to a real end-customer
- Important: The following fields are immutable after the first update:
accountHolderName,accountName,dob, andnativeLanguageName
Virtual account creation requests are processed asynchronously to ensure optimal performance and reliability:
- Immediate Response: You receive a job ID and status URLs immediately upon submission
- Status Monitoring: Use the provided status URL to monitor job progress
- Result Retrieval: Use the provided result URL to fetch final outcomes when complete
- Callback Notifications: Optionally provide a callback URL for automatic notifications afther job completes
Callback notifications are signed. When your client configuration enables response signing, callbacks use the asymmetric option (RSA-PSS + SHA-256) and include Bcb-Signature, Bcb-Timestamp, Bcb-Nonce, and Bcb-Signature-Version (e.g., rsa-v1). If asymmetry is not configured, callbacks use the HMAC option with your Message Signing Secret and no Bcb-Signature-Version header. See the Message Signing guide for verification steps.
Each successfully created virtual account will contain the following properties:
{
"virtualAccountNumber": "1000327642",
"bicCode": "BPBKBMHMXXX",
"accountHolderName": "T1 Project Alpha Escrow",
"accountName": "New Title T2",
"currency": "USD",
"balance": {
"amount": "0",
"currency": "USD"
},
"category": "CMS Sub Acct"
}The response includes URLs for monitoring your batch job:
- Status URL: Poll this URL to check job progress and completion status
- Result URL: Access this URL to retrieve detailed results for each virtual account
- Job ID: Unique identifier for tracking your batch job
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided, the system stores the key and associates it with the batch job
- If the same idempotency key is received again, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000")
async function createVirtualAccounts() {
try {
const response = await fetch('https://api.bcb.bm/v1/virtual-accounts', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json',
'Idempotency-Key': '123e4567-e89b-12d3-a456-426614174000' // Optional
},
body: JSON.stringify({
callbackUrl: 'https://my-callback-url.com', // Optional
// Optional: custom headers echoed in the completion webhook
customHeaders: {
'X-Custom-Header-1': 'CustomValue1',
'X-Custom-Header-2': 'CustomValue2',
'X-Custom-Header-3': 'CustomValue3'
},
items: [
{
currency: 'USD',
accountHolderName: 'Test Company Ltd',
accountName: 'Test Virtual Account 001',
clientReference: 'BATCH-REF-001'
},
{
currency: 'USD',
accountHolderName: 'Test Company Ltd',
accountName: 'Test Virtual Account 002',
clientReference: 'BATCH-REF-002'
},
// Example: Pre-create unallocated accounts for later assignment
{
currency: 'USD',
unallocated: true,
clientReference: 'UNALLOC-001'
}
]
})
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Virtual account creation failed: ${JSON.stringify(errorData)}`);
}
// Parse JSON response
const batchResponse = await response.json();
// Display batch job information
console.log('Batch Job Created:');
console.log(` Job ID: ${batchResponse.jobId}`);
console.log(` Status: ${batchResponse.status}`);
console.log(` Status URL: ${batchResponse.statusUrl}`);
console.log(` Result URL: ${batchResponse.resultUrl}`);
// Store these URLs for monitoring the job
// Use statusUrl to check progress
// Use resultUrl to get final outcomes
return batchResponse;
} catch (error) {
console.error('Failed to create virtual accounts:', error.message);
throw error;
}
}
// Example usage:
// Create multiple virtual accounts
createVirtualAccounts();Required Permission: create-virtual-account
This endpoint requires the permission claim create-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Optional URL to receive asynchronous notifications about the async job processing status.
Optional custom headers to include in the account creation request. It will be sent back in callbacks. Max 10 headers, each key max 50 chars, each value max 500 chars
Payload containing the details of virtual accounts to be created in batch.
ISO 4217 currency code for the virtual account (e.g., USD, EUR, BMD). Must be a supported currency by the bank.
Human-readable nickname or label for the virtual account. Used for display purposes and client identification. Optional when Unallocated is true; otherwise required.
Official account name as it will appear on statements and official documents. This is the formal name of the virtual account. Optional when Unallocated is true; otherwise required.
Client-provided reference identifier for tracking and identification purposes. This reference should be unique within the client's system for easier reconciliation.
Native name of the account holder's language, if applicable.
Indicates whether the virtual account is pre-created for future allocation. When set to true, the account is created in "for allocation" mode with placeholder values ("UNALLOCATED") for AccountHolderName and AccountName, which become optional. This allows clients to bulk-create virtual accounts and later perform a one-time update to assign them to real end-customers.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"callbackUrl": "https://my-callback-url.com",
"customHeaders": {
"X-Custom-Header-1": "Custom Value 1",
"X-Custom-Header-2": "Custom Value 2"
},
"items": [
{
"currency": "USD",
"accountHolderName": null,
"accountName": null,
"clientReference": "BATCH-UNALLOC-001",
"dateOfBirth": null,
"nativeLanguageName": null,
"unallocated": true
},
{
"currency": "USD",
"accountHolderName": "Test Company Ltd",
"accountName": "Test Virtual Account 001",
"clientReference": "BATCH-REF-001",
"dateOfBirth": "1990-01-01T00:00:00.0000000",
"nativeLanguageName": "Native Name",
"unallocated": false
},
{
"currency": "USD",
"accountHolderName": "Test Company Ltd",
"accountName": "Test Virtual Account 002",
"clientReference": "BATCH-REF-002",
"dateOfBirth": null,
"nativeLanguageName": null,
"unallocated": false
},
{
"currency": "USD",
"accountHolderName": "Test Company Ltd",
"accountName": "Test Virtual Account 003",
"clientReference": "BATCH-REF-003",
"dateOfBirth": null,
"nativeLanguageName": null,
"unallocated": false
}
]
}'{ "jobId": "550e8400-e29b-41d4-a716-446655440001", "status": "Pending", "statusUrl": "https://api.bcb.bm/v1/jobs/550e8400-e29b-41d4-a716-446655440001", "resultUrl": "https://api.bcb.bm/v1/jobs/550e8400-e29b-41d4-a716-446655440001/results" }
Request
Retrieves all virtual accounts for the authenticated corporate client. This endpoint:
- Returns a paginated list of virtual accounts for the client
- Response contains the client’s real (non-virtual) accounts as well:
- Settlement Account – the primary clearing account used for cash movements. Account category: "CMS Settlement".
- Parent Account – the parent account under which all virtual accounts are organised. Account category: "CMS Parent Cate".
- Virtual accounts have the category "CMS Sub Acct".
- Supports optional currency filtering to return only accounts in a specific currency
- Supports pagination for efficient handling of large account datasets
Use the optional currency query parameter to filter results:
- Must be a valid 3-letter ISO currency code (e.g., USD, BMD, EUR)
- If omitted, accounts in all currencies are returned
This endpoint uses cursor-based pagination with server-side result-set management:
- First Request: Optionally specify
pageSize(default: 100, max: 1000). The server creates a cursor and returns apageToken. - Subsequent Requests: Use the
pageTokenfrom previous responses withpageStartto navigate pages. - Page Token: Contains encoded pagination context including pageSize, so don't specify
pageSizein subsequent requests. - Total Pages: Calculate using
Math.ceil(total_size / page_size)from the response metadata.
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts
async function getAllVirtualAccounts(currency = null, pageSize = 25, pageStart = 1, pageToken = null) {
try {
// Build URL with optional parameters
let url = 'https://api.bcb.bm/v1/virtual-accounts';
const params = new URLSearchParams();
if (currency) {
params.append('currency', currency);
}
if (pageStart === 1 && !pageToken) {
// First request only: optionally specify pageSize
params.append('pageSize', pageSize.toString());
} else {
// Subsequent requests: use pageToken + pageStart and do NOT send pageSize again
params.append('pageToken', pageToken);
params.append('pageStart', pageStart.toString());
}
url += '?' + params.toString();
const response = await fetch(url, {
method: 'GET',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json'
}
});
if (!response.ok) {
const errorData = await response.json();
throw new Error(`Virtual accounts retrieval failed: ${JSON.stringify(errorData)}`);
}
// Parse JSON response
const result = await response.json();
// Access pagination info
const pagination = result.meta.pagination;
console.log(`Page: ${pagination.page_start}, Size: ${pagination.page_size}, Total: ${pagination.total_size}`);
// Process virtual accounts
result.data.forEach((account, index) => {
console.log(`Account ${index + 1}:`);
console.log(` Virtual Account Number: ${account.virtualAccountNumber}`);
console.log(` BIC: ${account.bicCode}`);
console.log(` Account Holder: ${account.accountHolderName}`);
console.log(` Account Name: ${account.accountName}`);
console.log(` Currency: ${account.currency}`);
console.log(` Balance: ${account.balance ? account.balance.amount + ' ' + account.balance.currency : 'N/A'}`);
console.log(` Category: ${account.category}`);
if (account.clientReference) {
console.log(` Client Reference: ${account.clientReference}`);
}
if (account.effectiveDate) {
console.log(` Effective Date: ${account.effectiveDate}`);
}
if (account.createdAt) {
console.log(` Created At: ${account.createdAt}`);
}
// Log parent/settlement account relationships
if (account.parentAccount) {
console.log(` Parent Account: ${account.parentAccount.accountNumber} (${account.parentAccount.accountName})`);
}
if (account.settlementAccount) {
console.log(` Settlement Account: ${account.settlementAccount.accountNumber} (${account.settlementAccount.accountName})`);
}
console.log('---');
});
return result;
} catch (error) {
console.error('Failed to retrieve virtual accounts:', error.message);
throw error;
}
}
// Example usage:
// Get all virtual accounts
getAllVirtualAccounts();
// Get only USD virtual accounts
getAllVirtualAccounts('USD');
// Get first 10 virtual accounts
getAllVirtualAccounts(null, 10);Required Permission: get-virtual-accounts
This endpoint requires the permission claim get-virtual-accounts to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Optional. The currency of the virtual accounts to filter by. If not specified, all virtual accounts will be returned.
Optional. Unique cursor ID received from previous response for subsequent requests. Contains encoded pagination context including page_size.
Optional. The record from which the response should be displayed (default: 1).
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts?currency=str&pageToken=string&pageStart=0&pageSize=0' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>'{ "meta": { "pagination": { … } }, "data": [ { … }, { … }, { … }, { … }, { … }, { … }, { … } ] }
Request
Updates an existing virtual (sub) account for a corporate client. Only the fields provided in the request body will be updated.
Updateable Properties
- accountHolderName: Human-readable label for the virtual account. Immutable after first update – can only be changed once from the "UNALLOCATED" state.
- accountName: Official account title that will appear on statements. Immutable after first update – can only be changed once from the "UNALLOCATED" state.
- dob: Date of birth of the account holder. Immutable after first update – can only be set once.
- nativeLanguageName: Native name of the account holder's language (max 255 characters). Immutable after first update – can only be set once.
- clientReference: External reference provided by the client to aid reconciliation (max 35 characters). This field can be updated multiple times.
For virtual accounts created with unallocated: true, use this endpoint to perform a one-time assignment to a real end-customer:
- Update
accountHolderName,accountName,dob, andnativeLanguageNamefrom their initial/placeholder values to the actual customer details - Important: This is a one-time operation. Once these fields are set, they become immutable:
accountHolderNameandaccountNamecan only be changed from "UNALLOCATED" statedobandnativeLanguageNamecan only be set once (if not provided during creation)
- Attempting to update immutable fields after the first update will result in a
409 Conflicterror with codeACCOUNT_NAMES_IMMUTABLE - Only
clientReferencecan be updated after allocation
Clients must use the HTTP Accept header to indicate the desired response format:
- Set
Accept: application/jsonfor JSON responses (default) - Set
Accept: text/csvfor CSV responses If the Accept header is omitted,application/jsonis assumed.
All API requests use the versioned base URL:
https://api.bcb.bm/v1/virtual-accounts
The API supports idempotency through the optional Idempotency-Key header:
- If no idempotency key is provided, the request is processed normally (duplicates are possible)
- If a valid UUID idempotency key is provided for a new transaction, the system stores the key and associates it with the transaction results
- If the same idempotency key is received again for the same endpoint/action, the system returns the previously stored response
- Idempotency keys are user-specific - different users with the same keys don't share cached responses
- The idempotency key must be a valid UUID format (e.g., "123e4567-e89b-12d3-a456-426614174000").
async function updateVirtualAccount(virtualAccountNumber) {
try {
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${virtualAccountNumber}`, {
method: 'PATCH',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json'
},
body: JSON.stringify({
// Note: Only clientReference can be updated after first allocation
// accountHolderName, accountName, dob, and nativeLanguageName are immutable after first update
clientReference: 'updated-reference-123'
})
});
if (!response.ok) {
const errorData = await response.json();
// Handle immutable field error
if (response.status === 409 && errorData.code === 'ACCOUNT_NAMES_IMMUTABLE') {
console.error('Cannot update immutable fields - already set after first update');
return;
}
throw new Error(`Virtual account update failed: ${JSON.stringify(errorData)}`);
}
// Parse JSON response
const result = await response.json();
const virtualAccount = result.data;
// Log updated details
console.log('Virtual Account Updated Successfully:');
console.log(` Account Number: ${virtualAccount.virtualAccountNumber}`);
console.log(` Account Holder: ${virtualAccount.accountHolderName}`);
console.log(` Account Name: ${virtualAccount.accountName}`);
console.log(` Currency: ${virtualAccount.currency}`);
console.log(` Category: ${virtualAccount.category}`);
if (virtualAccount.balance) {
console.log(` Balance: ${virtualAccount.balance.amount} ${virtualAccount.balance.currency}`);
}
if (virtualAccount.clientReference) {
console.log(` Client Reference: ${virtualAccount.clientReference}`);
}
console.log(` Effective Date: ${virtualAccount.effectiveDate}`);
console.log(` Created: ${virtualAccount.createdAt}`);
// Log parent/settlement account info
if (virtualAccount.parentAccount) {
console.log(` Parent Account: ${virtualAccount.parentAccount.accountNumber} (${virtualAccount.parentAccount.accountSubType})`);
}
if (virtualAccount.settlementAccount) {
console.log(` Settlement Account: ${virtualAccount.settlementAccount.accountNumber} (${virtualAccount.settlementAccount.accountSubType})`);
}
return result;
} catch (err) {
console.error('Error updating virtual account:', err);
throw err;
}
}
// Example usage:
updateVirtualAccount('1000327642');
// Example: Allocating an unallocated account to a customer (ONE-TIME OPERATION)
async function allocateUnallocatedAccount(virtualAccountNumber, customerName, accountTitle, dob, nativeLanguageName) {
try {
const response = await fetch(`https://api.bcb.bm/v1/virtual-accounts/${virtualAccountNumber}`, {
method: 'PATCH',
headers: {
'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
'Content-Type': 'application/json',
'Accept': 'application/json'
},
body: JSON.stringify({
// All these fields are immutable after this update!
accountHolderName: customerName,
accountName: accountTitle,
dob: dob, // Optional - immutable after set
nativeLanguageName: nativeLanguageName // Optional - immutable after set
})
});
if (!response.ok) {
const errorData = await response.json();
// Handle case where account was already allocated
if (response.status === 409 && errorData.code === 'ACCOUNT_NAMES_IMMUTABLE') {
throw new Error('Account has already been allocated. Immutable fields cannot be changed after first update.');
}
throw new Error(`Account allocation failed: ${JSON.stringify(errorData)}`);
}
const result = await response.json();
console.log('Account successfully allocated to:', customerName);
return result;
} catch (err) {
console.error('Error allocating account:', err);
throw err;
}
}
// Allocate a pre-created unallocated account (can only be done once!)
allocateUnallocatedAccount('1000327650', 'Acme Corporation', 'Acme Trading Account', '1990-05-15', 'John Smith');Required Permission: update-virtual-account
This endpoint requires the permission claim update-virtual-account to be present in the JWT token. These permissions are embedded in the token during the authentication process and cannot be modified afterward. The token must be obtained with the appropriate permissions to access this endpoint.
Payload containing virtual account fields to update
Virtual account name Used for display purposes and client identification.
Official account title as it will appear on statements and official documents. This is the formal name of the virtual account.
Client-provided reference identifier for tracking and identification purposes. This reference should be unique within the client's system for easier reconciliation.
- Mock serverhttps://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}
- UAT Environment - Used for testing and integration purposeshttps://api-uat.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}
- Production Environment - Live environment for production usehttps://api.bcb.bm/v1/virtual-accounts/{virtualAccountNumber}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X PATCH \
'https://developers.bcb.bm/_mock/apis/open-banking-api/open-banking-api/v1/virtual-accounts/{virtualAccountNumber}' \
-H 'Authorization: Bearer <YOUR_jwt_HERE>' \
-H 'Content-Type: application/json' \
-d '{
"accountHolderName": "Updated Project Alpha Escrow",
"accountName": "Updated Project Alpha Virtual Account",
"clientReference": "ref-1234567890",
"dateOfBirth": "1990-05-15T00:00:00.0000000",
"nativeLanguageName": "Native Name"
}'{ "effectiveDate": "2025-06-20", "createdAt": "2025-07-25T08:23:00.0000000Z", "parentAccount": { "accountId": "1000326956-2000365", "cif": 2000365, "currency": "USD", "accountSubType": "CMS Parent Cate", "accountNumber": 1000326956, "status": "AUTH", "availableBalance": { … }, "accountType": null, "nickname": null, "owners": [ … ], "accountAttributes": [] }, "settlementAccount": { "accountId": "1000326948-2000365", "cif": 2000365, "currency": "USD", "accountSubType": "CMS Settlement", "accountNumber": 1000326948, "status": "AUTH", "availableBalance": { … }, "accountType": null, "nickname": null, "owners": [ … ], "accountAttributes": [] }, "virtualAccountNumber": 1000327642, "bicCode": "BPBKBMHMXXX", "accountHolderName": "T1 Project Alpha Escrow", "accountName": "New Title T2", "currency": "USD", "balance": { "currency": "USD", "amount": 0 }, "category": "CMS Sub Acct", "clientReference": "T12cc62d3fb446e7950ffd0797d0a6f41", "dateOfBirth": "1990-05-15T00:00:00.0000000", "nativeLanguageName": "Native Name", "unallocated": false }