# Orenda API

> One API for onboarding, accounts, cards, payments, and compliance.

## Get started

- [Orenda API](https://api-docs.orenda-apps.com/introduction/): One API for onboarding, accounts, cards, payments, and compliance.
- [Apply for API access](https://api-docs.orenda-apps.com/contact/): Tell us about your business and the API access you need, and our team will be in touch.
- [Integration order for a self-serve user](https://api-docs.orenda-apps.com/guides/self-serve-user-integration-order/): The sequence to build for a brand-new, self-serve user: sign up, verify, then move money.
- [Integration order for an invited user](https://api-docs.orenda-apps.com/guides/invited-user-integration-order/): The sequence to build for a user your program invited: sign in, finish onboarding, then move money.
- [Program capabilities](https://api-docs.orenda-apps.com/capabilities/): What your program can do, and how to find out — without caring how it's powered.
- [Idempotency](https://api-docs.orenda-apps.com/idempotency/): Send an Idempotency-Key so a retry can never create a duplicate payment, payee, or card.

## Authentication

- [Authentication overview](https://api-docs.orenda-apps.com/auth/overview/): Register, log in, and use your authentication tokens.
- [Complete security setup](https://api-docs.orenda-apps.com/auth/security-setup/overview/): What to do after you get a SECURITY_SETUP_REQUIRED challenge.

## Single sign-on (SSO)

- [Single sign-on (SSO)](https://api-docs.orenda-apps.com/auth/sso/overview/): Let your users sign in with your own identity provider instead of an Orenda password.
- [SSO tokens](https://api-docs.orenda-apps.com/auth/sso/tokens/): Exchange an authorization code for tokens, and refresh them before they expire.
- [Passkey step-up for SSO](https://api-docs.orenda-apps.com/auth/sso/passkey-step-up/): Sensitive operations on an SSO session require a passkey. How to enrol users and confirm.

## Onboarding

- [Onboarding overview](https://api-docs.orenda-apps.com/onboarding/overview/): Create an application, then poll its status and render each step.
- [Sandbox KYC / KYB testing](https://api-docs.orenda-apps.com/onboarding/sandbox-kyc/): Test files and application details for passing KYC and KYB in sandbox.
- [Invite a sub-user or corporate manager](https://api-docs.orenda-apps.com/onboarding/invite-sub-user/): Invite a sub-user funded from one of your accounts, or a corporate manager who operates your company.
- [Create an application](https://api-docs.orenda-apps.com/onboarding/create/): Start onboarding for the signed-in user.
- [Get the current application](https://api-docs.orenda-apps.com/onboarding/status/): Poll the application and render its current step.
- [Get the KYC form schema](https://api-docs.orenda-apps.com/onboarding/kyc-schema/): Fetch the form to render for the current KYC/KYB step.
- [Submit KYC data](https://api-docs.orenda-apps.com/onboarding/kyc-submit/): Send the answers for a KYC/KYB step.
- [Document presign URL](https://api-docs.orenda-apps.com/onboarding/document-presign/): Upload or download verification documents via short-lived URLs.
- [Submit KYB data](https://api-docs.orenda-apps.com/onboarding/kyb-submit/): Send the answers for a company (KYB) step.
- [UBO actions](https://api-docs.orenda-apps.com/onboarding/ubo-actions/): Send verification emails to UBOs, or reset their verification.
- [Verification status](https://api-docs.orenda-apps.com/onboarding/verification-status/): Per-step review status for the application (and its UBOs).
- [Get a Sumsub SDK token](https://api-docs.orenda-apps.com/onboarding/sumsub-token/): Get a token to run the Sumsub identity check.
- [Accept legal agreements](https://api-docs.orenda-apps.com/onboarding/accept-legals/): Accept the program's terms to finish onboarding.

## Guides

- [Accounts overview](https://api-docs.orenda-apps.com/accounts/overview/): The customer's bank accounts: balances, bank details, limits, and status.
- [Beneficiaries overview](https://api-docs.orenda-apps.com/beneficiaries/overview/): The payees a customer can send money to.
- [Transactions overview](https://api-docs.orenda-apps.com/transactions/overview/): Settled activity on the customer's accounts, and statements built from it.
- [Fees and limits overview](https://api-docs.orenda-apps.com/fees/overview/): The fee schedule and published limits, ready to render in-app.

## Cards

- [Cards overview](https://api-docs.orenda-apps.com/cards/overview/): Issue and manage cards on an account.
- [Card limits walkthrough](https://api-docs.orenda-apps.com/cards/update-card-policy/): Tighten a card: block merchant categories or countries, switch off transaction types, lower spending limits.
- [Cardholders](https://api-docs.orenda-apps.com/cards/cardholders/): Let someone hold a card on an account they don't own.

## Payments

- [Payments overview](https://api-docs.orenda-apps.com/payments/overview/): Send money from an account: now, later, abroad, or many at once.
- [Batch payments](https://api-docs.orenda-apps.com/payments/batch/overview/): Send many payments at once: verify the items, then authorise and pay.

## Real-time

- [Real-time (WebSockets)](https://api-docs.orenda-apps.com/websockets/overview/): A persistent connection for server-pushed events. No polling.
- [3DS events](https://api-docs.orenda-apps.com/websockets/three-ds/): Approve or reject a card payment in real time over the WebSocket.

## API reference

- `POST /v1/auth/login`: Log in
- `POST /v1/auth/verify-2fa`: Complete 2FA
- `POST /v1/auth/refresh`: Refresh tokens
- `POST /v1/auth/logout`: Log out
- `POST /v1/auth/register`: Register
- `POST /v1/auth/register/confirm`: Confirm registration
- `POST /v1/auth/register/resend-confirmation`: Resend confirmation code
- `POST /v1/auth/forgot-password`: Start a password reset
- `POST /v1/auth/forgot-password/confirm`: Finish a password reset
- `POST /v1/auth/change-password`: Change a temporary password
- `POST /v1/auth/mfa/setup`: Start 2FA setup
- `POST /v1/auth/mfa/confirm`: Confirm 2FA setup
- `POST /v1/auth/passkey/register/start`: Start adding a passkey
- `POST /v1/auth/passkey/register/complete`: Finish adding a passkey
- `POST /v1/auth/passkey/login`: Start a passkey login
- `POST /v1/auth/passkey/verify`: Finish a passkey login
- `POST /v1/auth/passkey/challenge`: Step-up passkey challenge
- `GET /v1/auth/passkey/credentials`: List passkeys
- `PATCH /v1/auth/passkey/credentials/{id}`: Rename a passkey
- `DELETE /v1/auth/passkey/credentials/{id}`: Delete a passkey
- `POST /v1/auth/security-setup/mfa/setup`: Set up 2FA (start)
- `POST /v1/auth/security-setup/mfa/confirm`: Set up 2FA (confirm)
- `POST /v1/auth/security-setup/passkey/register/start`: Set up a passkey (start)
- `POST /v1/auth/security-setup/passkey/register/complete`: Set up a passkey (finish)
- `POST /v1/auth/security-setup/email/verify/confirm`: Confirm email during security setup
- `POST /v1/auth/security-setup/complete`: Finish security setup
- `GET /v1/capabilities`: Get program capabilities
- `GET /v1/applications`: Get the current application
- `POST /v1/applications`: Create an application
- `GET /v2/applications`: Get the current application (v2)
- `POST /v2/applications`: Create an application (v2)
- `GET /v2/applications/{applicationId}`: Get an application by id (v2)
- `GET /v1/applications/{applicationId}/kyc/schema`: Get the KYC form schema
- `POST /v1/applications/{applicationId}/kyc`: Submit KYC data
- `POST /v1/applications/kyb`: Submit KYB data
- `GET /v1/applications/{applicationId}/webtoken/sumsub`: Get a Sumsub SDK token
- `GET /v1/applications/{applicationId}/documents/legal`: Get legal documents
- `POST /v1/applications/{applicationId}/documents/legal/accept`: Accept legal documents
- `POST /v1/applications/{applicationId}/ubos/actions`: UBO actions
- `GET /v1/applications/{applicationId}/verification/status`: Get verification status
- `POST /v1/customers/{customerId}/documents/presign`: Get a document presign URL
- `POST /v1/access-management/customer-invites`: Invite a sub-user or corporate manager
- `GET /v1/customers/{customerId}/accounts`: List accounts
- `POST /v1/customers/{customerId}/accounts`: Open an additional account
- `GET /v1/customers/{customerId}/accounts/{accountId}/limits`: Get account limits
- `POST /v1/customers/{customerId}/accounts/{accountId}/limits`: Update account limits
- `POST /v1/customers/{customerId}/accounts/{accountId}/block`: Block an account
- `POST /v1/customers/{customerId}/accounts/{accountId}/unblock`: Unblock an account
- `POST /v1/customers/{customerId}/accounts/{accountId}/close`: Close an account
- `POST /v1/customers/{customerId}/accounts/{accountId}/confirmation/send`: Account confirmation letter
- `GET /v1/customers/{customerId}/beneficiaries`: List beneficiaries
- `POST /v1/customers/{customerId}/beneficiaries`: Create a beneficiary
- `GET /v1/customers/{customerId}/beneficiaries/{beneficiaryId}`: Get a beneficiary
- `DELETE /v1/customers/{customerId}/beneficiaries/{beneficiaryId}`: Delete a beneficiary
- `POST /v1/beneficiaries/verify`: Verify a payee's name
- `POST /v1/customers/{customerId}/accounts/{accountId}/beneficiaries/international`: Create an international beneficiary
- `POST /v1/customers/{customerId}/beneficiaries/pin`: Request a security PIN
- `GET /v1/customers/{customerId}/cards/{cardId}/policy`: Get this card's policy
- `PATCH /v1/customers/{customerId}/cards/{cardId}/policy`: Update this card's policy
- `GET /v1/customers/{customerId}/cards/policy/options`: Options a cardholder may choose from
- `GET /v1/customers/{customerId}/accounts/{accountId}/cards`: Get cards
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards`: Create a card
- `GET /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}`: Get card details
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/activate`: Activate a card
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/block`: Block a card
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/unblock`: Unblock a card
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/cancel`: Cancel a card
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/pin/reset`: Reset card PIN
- `PATCH /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/limits`: Update card limit group
- `GET /v1/customers/{customerId}/accounts/{accountId}/secure-key`: Get secure key
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/secure/passkey-challenge`: Secure details passkey challenge
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/secure`: Get secure card details
- `GET /v1/customers/{customerId}/3ds`: Get recent 3DS notifications
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/3ds/confirm`: Confirm a 3DS challenge
- `GET /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/transactions`: List card transactions
- `GET /v1/customers/{customerId}/accounts/{accountId}/cards/options`: Get card options
- `POST /v1/customers/{customerId}/accounts/{accountId}/cardholders`: Create a cardholder
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/invite`: Invite a cardholder to a card
- `GET /v1/customers/{customerId}/accounts/{accountId}/cards/invites`: List card invites
- `DELETE /v1/customers/{customerId}/accounts/{accountId}/cards/invites/{invitedCustomerId}`: Revoke a card invite
- `POST /v1/customers/{customerId}/accounts/{accountId}/cards/auth/confirm`: Confirm a holder authentication
- `POST /v1/customers/{customerId}/accounts/{accountId}/payments`: Create a payment
- `POST /v1/customers/{customerId}/accounts/{accountId}/payments/international`: Create an international (FX) transfer
- `GET /v1/accounts/{accountId}/fx/quote`: Get an FX quote
- `GET /v1/payments/currencies`: List supported currencies
- `GET /v1/customers/{customerId}/accounts/{accountId}/payments/fee`: Calculate the fee for a payment
- `GET /v1/customers/{customerId}/accounts/{accountId}/scheduled-payments`: List scheduled payments
- `DELETE /v1/customers/{customerId}/accounts/{accountId}/scheduled-payments/{scheduleId}`: Delete a scheduled payment
- `GET /v1/customers/{customerId}/accounts/{accountId}/payments/requests`: List payment requests
- `POST /v1/customers/{customerId}/accounts/{accountId}/payments/requests/{paymentRequestId}/cancel-direct-debit`: Cancel direct debit collection
- `GET /v1/customers/{customerId}/transactions`: List transactions
- `GET /v1/customers/{customerId}/accounts/{accountId}/statements`: Generate a statement
- `POST /v1/customers/{customerId}/batch-payments`: Batch action (verify / initiate / submit)
- `GET /v1/batch-payments/verify/{requestId}`: Get verify status
- `GET /v1/batch-payments`: List batches
- `POST /v1/batch-payments`: Multi-customer batch payments
- `POST /v1/customers/{customerId}/batch-payments/verify`: Verify a batch (single customer)
- `POST /v1/batch-payments/verify`: Verify a batch (multi-customer)
- `POST /v1/customers/{customerId}/batch-payments/submit`: Pay a batch (single customer)
- `POST /v1/batch-payments/submit`: Pay a batch (multi-customer)
- `GET /v1/batch-payments/{batchId}`: Get a batch
- `DELETE /v1/batch-payments/{batchId}`: Delete a draft
- `GET /v1/customers/{customerId}/fees`: Get customer fees
- `GET /v1/customers/{customerId}/limits`: Get customer limits
- `GET /v1/customers/{customerId}/accounts/{accountId}/fee-reports`: Get a fee document
- `GET /v1/programs/{programId}/legal-documents`: Get program legal documents

## Full text

- [Complete documentation](https://api-docs.orenda-apps.com/llms-full.txt): every page as plain text