Api on Nullbyte blog

Swedbank API

Mon, 04 Jun 2012 20:34:00 -0400

The newly released (2012-06-04) Swedbank mobile application is now a real android application and no longer just a website wrapper. What follows is a short documentation of the JSON API used by the app.
The API is located at https://auth.api.swedbank.se/ and all requests and responses are JSON objects.

POST /TDE_DAP_Portal_REST_WEB/api/v1/identification/personalcode?dsid=Zf0wGfKF HTTP/1.1
Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5
Content-Type: application/json; charset=UTF-8
Content-Length: 43
Host: auth.api.swedbank.se
Connection: Keep-Alive
User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus
Cookie: dsid=Zf0wGfKF
Cookie2: $Version=1

{"password":"123abc","userId":"8105280000"}

Nothing unusual about this request except for the dsid and Authorization header. During my short period of testing the Authorization header maintained the same value for all requests, the dsid on the other hand changes with every request and there’s no way of telling what the dsid for the next request should be just by looking at the API response. A bit deeper digging will be required to find out how it’s generated.

HTTP/1.1 201 Created
Server: FSB
Date: Mon, 04 Jun 2012 23:21:26 GMT
Cache-control: no-cache
Transfer-encoding: chunked
Content-type: application/json; charset=UTF-8
Pragma: no-cache
Cache-control: no-cache, no-store, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-language: sv-SE
Set-Cookie: mobilsession=1016992778.47873.0000; expires=Mon, 04-Jun-2012 23:41:26 GMT; path=/

{
    "personalCodeChangeRequired": false,
    "links": {
        "next": {
            "method": "GET",
            "uri": "/v1/profile/"
        }
    },
    "serverTime": "20120605 01:21"
}

Not a lot of interesting information here. We’ve got a URL for our next request so let’s continue.

Profile request

POST /TDE_DAP_Portal_REST_WEB/api/v1/profile/private/08999?dsid=6hl9Isv6 HTTP/1.1
Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5
Content-Type: application/json; charset=UTF-8
Content-Length: 0
Host: auth.api.swedbank.se
Connection: Keep-Alive
User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus
Cookie: JSESSIONID=0000XRefgtdh63YPHmwNuITrMTg:16t5rmrdr; SWBTC=gi35jCq1KpGexTaK8FLZIEgVIKk=:LTFhNTQxZDhmOjEzN2I3ODllYTIxOmQyYw==:odwhiQ==; mobilsession=1016992778.47873.0000; dsid=6hl9Isv6
Cookie2: $Version=1

Profile response

{
    "hasSwedbankProfile": true,
    "hasSavingbankProfile": false,
    "selectedProfile": {
        "customerName": "Firstname Lastname",
        "customerNumber": "username/personnr"
    },
"menuStructure": {
        "menuGroups": [{
            "name": ["/v1/sign"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/sign/securitytoken/{signId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }, {
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/sign/securitytoken/{signId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }, {
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/sign/bankid/mobile/{signId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }, {
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/sign/bankid/mobile/verify/{signId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/identification"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/identification/personalcode"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/identification"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/identification/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/identification"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/identification/logout"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/identification"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/identification/touch"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/transfer/baseinfo"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/transfer/registered"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/transfer/registered"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/transfer/{transferId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/transfer/{transferId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/transfer/confirmed/{signId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/transfer/confirmed"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/transfer/recipient"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/transfer/recipient/confirmed/{signId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/transfer"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/transfer/{transferId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/profile"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/profile/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/profile"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/profile/{profileId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/profile"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/profile/private/{bankId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/payment/baseinfo"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/payment/registered"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/payment/registered"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/payment/{paymentId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/payment/{paymentId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/payment/confirmed/{signId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/payment/confirmed"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/payment/{paymentId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/payment/einvoice/{einvoiceId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/payment/payee"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/payment/payee/confirmed/{signId}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/payment/payee/{type}/{accountNumber}"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/payment"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/payment/rejected"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/search"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/search/location"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/search"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/search/location"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/marketinfo/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/multimarketinfo/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/marketinfo/{selection}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/securitylist/{listid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/securitylist/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/securities/userlist/{listid}/{instrumenttype}/{instrumentid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/securities/userlist/{listid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/securities/userlist/{listid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/securities/userlist/{listid}/{instrumenttype}/{instrumentid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/userlist/{listid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/userlist"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/securities/userlist/{listid}/{name}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/securities/userlist/{name}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/securities/quickuserlist/{vpsubscriptionid}/{instrumenttype}/{instrumentid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/quickuserlist/{vpsubscriptionid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/securities/quickuserlist/{vpsubscriptionid}/{instrumenttype}/{instrumentid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["PUT"],
                "serviceURIs": ["/v1/securities/subscription/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/securities/subscription/{vpsubscriptionid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/option/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/engagement"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/engagement/overview"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/engagement"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/engagement/transactions/{accountId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/engagement"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/engagement/loandetail/{loanId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/quickbalance"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/quickbalance/subscription/{accountId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/quickbalance"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/quickbalance/subscription/{subscriptionId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/quickbalance"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/quickbalance/{subscriptionId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/quickbalance"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/quickbalance/accounts"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/loan"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/loan/rates/private/{bankid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/v1/loan"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/loan/rates/mortgage/{bankid}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/loan"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/loan/calculation/housingmortgage"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/loan"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/loan/calculation/private"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/v1/prepaidcard"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/prepaidcard/reload"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/prepaidcard"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/prepaidcard/reload"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/custodies"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": false
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/custody"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": false
            }]
        }, {
            "name": ["/v1/securities"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/securities/selectcustody"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": false
            }]
        }, {
            "name": ["/v1/securities/order"],
            "items": [{
                "requestMethods": ["POST"],
                "serviceURIs": ["/v1/securities/order/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/order"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/order/estimation"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/order"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/order/validation"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/order"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/securities/order/{orderId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/trigger"],
            "items": [{
                "requestMethods": ["DELETE"],
                "serviceURIs": ["/v1/securities/trigger/{triggerId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/orders"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/issues"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/triggers"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/trades"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/orders/{orderId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/trades/{tradeId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/issues/{issueId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/triggers/{triggerId}"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/securities/orderstatus"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/securities/orderstatus/activity"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/einvoice"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/einvoice/incoming"],
                "authorized": false,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/message"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/message/reminders"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/currency"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/currency/exchangerates"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/currency"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/currency/conversion"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }, {
            "name": ["/v1/identification/device"],
            "items": [{
                "requestMethods": ["GET"],
                "serviceURIs": ["/v1/identification/device/"],
                "authorized": true,
                "authorizedIfAuthMethodUpgrade": true
            }]
        }]
    }
}

We’ve got the user’s name and username/personnr, but that’s not the most interesting part! The menuStructure object seems to contain all the URIs for this API. As you might imagine this will come in handy later.

Let’s continue with the accounts/engagements request.

Accounts and engagements

GET /TDE_DAP_Portal_REST_WEB/api/v1/engagement/overview?dsid=gNBHkcQm HTTP/1.1
Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5
Content-Type: application/json; charset=UTF-8
Host: auth.api.swedbank.se
Connection: Keep-Alive
User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus
Cookie: JSESSIONID=0000XRefgtPh6dYPHmwNuITrMTg:16t5rmrdr; SWBTC=gi35jCq1KpGexTaK8FLZIEgVIKk=:LTFhNTQxZDhmOjEzN2I3ODllYTIxOmQyYw==:odwhiQ==; mobilsession=1076992778.47873.0000; dsid=gNBHkcQm
Cookie2: $Version=1

Accounts response

HTTP/1.1 200 OK
Server: FSB
Date: Mon, 04 Jun 2012 23:21:27 GMT
Cache-control: no-cache
Transfer-encoding: chunked
Content-type: application/json; charset=UTF-8
Pragma: no-cache
Cache-control: no-cache, no-store, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-language: sv-SE
Set-Cookie: mobilsession=1076992778.47873.0000; expires=Mon, 04-Jun-2012 23:41:27 GMT; path=/

{
    "transactionAccounts": [{
        "selectedForQuickbalance": false,
        "links": {
            "next": {
                "method": "GET",
                "uri": "/v1/engagement/transactions/befef7059a0a16d6c40fcf70a0bc3f22e422617a"
            }
        },
        "name": "Privatkonto",
        "id": "befef7059a0a16d6c40fcf70a0bc3f22e422617a",
        "currency": "SEK",
        "accountNumber": "903 000 000-0",
        "clearingNumber": "8327-9",
        "balance": "12 345,67",
        "fullyFormattedNumber": "8327-9,903 000 000-0"
    }],
    "transactionDisposalAccounts": [],
    "loanAccounts": [],
    "savingAccounts": [{
        "selectedForQuickbalance": false,
        "links": {
            "next": {
                "method": "GET",
                "uri": "/v1/engagement/transactions/3cee0aaad3896cd72210a15142b158d1c51a2c12"
            }
        },
        "name": "e-sparkonto",
        "id": "3cee0aaad3896cd72210a15142b158d1c51a2c12",
        "currency": "SEK",
        "accountNumber": "913 000 000-0",
        "clearingNumber": "8327-9",
        "balance": "123 456,78",
        "fullyFormattedNumber": "8327-9,913 000 000-0"
    }],
    "cardAccounts": [],
    "cardCredit": {}
}

Transaction accounts, saving accounts, loan accounts, card accounts and card credit. That’s a lot of useful info with just one request!
The last example will be a request for a list of transactions for an account.

Transactions for “Privatkonto”

GET /TDE_DAP_Portal_REST_WEB/api/v1/engagement/transactions/befef7059a0a16d6c40fcf70a0bc3f22e422617a?dsid=MAccCv1G HTTP/1.1
Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5
Content-Type: application/json; charset=UTF-8
Host: auth.api.swedbank.se
Connection: Keep-Alive
User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus
Cookie: JSESSIONID=0000ioFdEvbn3ZpzdjzB3BeGFXvr:16t5rmpto; SWBTC=PWrrZq5yzmlcxYgT+LFMjtDQ+0o=:NTllODMzMGE6MTM3Yjc3OWFjM2Y6MjFmNQ==:ETAIkA==; mobilsession=1026661130.47873.0000; dsid=MAccCv1G
Cookie2: $Version=1

Transactions response

HTTP/1.1 200 OK
Server: FSB
Date: Tue, 05 Jun 2012 00:17:16 GMT
Cache-control: no-cache
Transfer-encoding: chunked
Content-type: application/json; charset=UTF-8
Pragma: no-cache
Cache-control: no-cache, no-store, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-language: sv-SE
Set-Cookie: mobilsession=1026661130.47873.0000; expires=Tue, 05-Jun-2012 00:37:16 GMT; path=/

{
    "transactions": [{
        "date": "2012-06-04",
        "description": "CLAS OHLSON",
        "currency": "SEK",
        "amount": "-49,00"
    }, {
        "date": "2012-06-04",
        "description": "KONTANTEN DIREKT",
        "currency": "SEK",
        "amount": "-500,00"
    }, {
        "date": "2012-06-03",
        "description": "CYKLOTEKET",
        "currency": "SEK",
        "amount": "-480,00"
    }, ... ],
    "account": {
        "availableAmount": "12 345,67",
        "creditGranted": "0,00",
        "quickbalanceSubscription": {
            "id": "3a249d57ed7263318be7dd0267b073b42e0efd6a",
            "active": false,
            "links": {
                "next": {
                    "method": "POST",
                    "uri": "/v1/quickbalance/subscription/3a249d57ed7263318be7dd0267b073b42e0efd6a"
                }
            }
        },
        "name": "Privatkonto",
        "id": "befef7059a0a16d6c40fcf70a0bc3f22e422617a",
        "currency": "SEK",
        "accountNumber": "903 000 000-0",
        "clearingNumber": "8327-9",
        "balance": "12 345,67",
        "fullyFormattedNumber": "8327-9,903 000 000-0"
    },
    "numberOfTransactions": 100,
    "reservedTransactions": [{
        "date": "20120604",
        "description": "SKYDDAT BELOPP",
        "currency": "SEK",
        "amount": "-140,10"
    }, {
        "date": "20120604",
        "description": "SKYDDAT BELOPP",
        "currency": "SEK",
        "amount": "-600,00"
    }, ... ],
    "numberOfReservedTransactions": 4,
    "moreTransactionsAvailable": true,
    "links": {
        "next": {
            "method": "GET",
            "uri": "/v1/engagement/transactions/befef7059a0a16d6c40fcf70a0bc3f22e422617a?transactionsPerPage=100&page=2"
        }
    }
}

Not much to explain here. We’ve got a list of the last 100 transactions and another list with all the reserved transactions.

That’s all I had time for today. I might update this post with additional information about how the dsid is generated and… other stuff.

The new Handelsbanken API

Sat, 25 Feb 2012 15:47:00 -0500

The updated Handelsbanken app for Android and iPhone uses a new API with a new login method. The login method attempts to increase security by obfuscating some of the data. The custom keyboard matrix for example is sent as an image instead of clear text.
This might make things appear more secure to the end user but doesn’t provide any significant technical security benefits.
The following example will demonstrate how the new login method works.

Request to get the custom keyboard

GET /app/init-matrix-xml?height=600&width=628 HTTP/1.1
Cache-Control: no-transform
X-SHB-DEVICE-CLASS: app
User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.2; sv-; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
X-SHB-DEVICE-MODEL: AND-4.0.2, 2.0.2, Galaxy Nexus
X-SHB-MCC: 240
X-SHB-MNC: 02
X-SHB-LC:
X-SHB-APP-VERSION: 2.0
X-SHB-DEVICE-ID: 123456789012345
Host: m2.handelsbanken.se
Connection: Keep-Alive

This is the first request that is sent to SHB when a user attempts to login. The height and width parameters define the desired size of the keyboard image returned in the response.

All headers starting with X-SHB are sent with every request and mostly contain information about the device that performs the request.

The keyboard matrix response

HTTP/1.1 200 OK
Date: Sat, 25 Feb 2012 20:56:29 GMT
Server: Apache
Cache-Control: private, proxy-revalidate
Content-Language: en-US
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 10517


    <response code="000" label="OK" >
        <matrix>
            <matrixId>009013526matrixId>
            <matrixMetaData>0,5,7,11,13,14matrixMetaData>
            <image type="png">
                
            image>
        matrix>
    response>

What we’re looking for in the response is the matrixId tag (we’ll need to send it back to the api when we’re logging in) and the image tag.

matrixMetaData tells the Android/iPhone app which buttons on the custom keyboard to make clickable. Not very interesting to us so we’ll disregard it.

Mapping a password to matrix positions

The image tag contains a base64 encoded transparent png image and looks something like this:

The image represents a 44 matrix where the numbers 0 to 9 have been placed randomly, the remaining 6 positions are empty.
When a user enters a password their real password isn’t sent to the api, instead the indices of the selected numbers (in a transposed 44 matrix) are sent as a concatenated string.
Let’s say the users password is 1234 and we’ve extracted the following matrix from the image:

968 40 7 52 31

Now the only thing that remains to do is to pick out the corresponding index for every number from the matrix below and send it to the api together with the username and matrixId.

04812 15913 261014 371115

The user enters the password 1234 and we get the positions 11,14,3,1.

GET /bb/glss/servlet/ssco_auth4?deviceid=123456789012345&username=8001010000&matrixPos=11,14,3,1&matrixId=009013526&entryId=privpnrpinse&appAction=doAuthentication&JSP_PATH=ssse&language=sv&country=SE&deviceClass=app HTTP/1.1
Cache-Control: no-transform
X-SHB-DEVICE-CLASS: app
User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.2; sv-; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
X-SHB-DEVICE-MODEL: AND-4.0.2, 2.0.2, Galaxy Nexus
X-SHB-MCC: 240
X-SHB-MNC: 02
X-SHB-LC:
X-SHB-APP-VERSION: 2.0
X-SHB-DEVICE-ID: 123456789012345
Host: m2.handelsbanken.se
Connection: Keep-Alive

We’re almost there! But first a short description of some of the parameters:
deviceid - the device id from your Android/iPhone. Should be the same as the one in the header.
username - the users’ social security number in the format YYMMDDXXXX.
matrixPos - the positions of the numbers we calculated earlier.
matrixId - the same id that we got from our first request to the api.

HTTP/1.1 200 Document follows
Date: Sat, 25 Feb 2012 20:58:41 GMT
Server: Apache
Cache-Control: private, proxy-revalidate, no-cache="set-cookie, set-cookie2"
Accept-Ranges: bytes
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Language: en-US
Set-Cookie: JSESSIONID=0000Y4saPX4Aq_tCypur61bkzki:C4F1745366942536000007A8000098D000000000; Path=/
Content-Length: 226
Last-Modified: Sat, 25 Feb 2012 20:58:40 GMT
Connection: close
Content-Type: text/xml;charset=UTF-8

 code="X8005" label="Kontrollera dina uppgifter. Efter tre felaktiga kodförsök spärras koden. I Internettjänsten kan du byta din kod om den har blivit spärrad. Alternativt kan du kontakta närmaste bankkontor."/>

Yea… well I don’t have a SHB account (yet) so I couldn’t get any further than this. I’ll update this post with more information about the API when I get my login credentials from SHB.