Capital One UK Data API

Capital One (Europe) plc · Banking

Capital One UK is the official Android app from Capital One (Europe) plc — FCA-authorised under the Payment Services Regulations, registered in England and Wales (company 3879023) at Trent House, Station Street, Nottingham NG2 3HX — for UK credit-card customers. After username, passcode or biometric sign-in (and optional PAN-based card linking when a second plastic is added), the home dashboard shows each card's last four digits, current balance, credit limit and available credit, with a servicing-mode at-a-glance screen when the full experience is unavailable. Cardholders make a payment via Open Banking or Global Payments, view a PIN, start a balance transfer, manage a Direct Debit, complete in-app KYC with a driving licence or passport plus selfie, and open in-app chat. The app is UK-only and sits against Barclays, HSBC, Lloyds, NatWest and American Express for everyday sterling card servicing.

Sterling ledger rows pair balance.current.value with credit.available.value and credit.limit.value on each plastic, next to obfuscatedNumber, plasticId and viewPinEligibility. Open Banking packets add consentId, thirdPartyName, permission clusters and a decision write that returns redirectLocation.

PFM and collections tools reconcile those sterling ticks and watch pastDueStatus; card-ops stacks consume encryptedPinBlock and poll KYC identityCheckState. openData Studio turns the same fields into callable open data.

Screenshots

API surface

The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.

Gateway access token
POST /v1/cardholder-gateway/access-token openbanking
Exchanges the mobile authorization code for a gateway access_token used on accounts-summary, consent, view-PIN and KYC calls.
Auth: OAuth 2 authorization-code + PKCE (S256). Form body grant_type=authorization_code with the app's public client_id and a code_verifier; an identity-provider header selects the login realm. The returned access_token is sent as a Bearer token on later private calls.
- access_token
- expires_in
- grant_type
- client_id
```
POST /v1/cardholder-gateway/access-token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json
X-Identity-Provider: <idp>

grant_type=authorization_code&code=AUTH_CODE&code_verifier=PKCE_VERIFIER&client_id=<client_id>&redirect_uri=https://app.example/callback
```
```
{
  "access_token": "<access_token_jwt>",
  "expires_in": 600
}
```

Identity authenticate

POST /v1/sessions/authenticate osint

Advances the UK identity login transaction and returns iid plus an access_token/tokenId once the stage completes.

Auth: Credential-type and operation headers plus Accept: application/json. Stages the multi-step login (passcode, OTP, biometrics) before the gateway token exchange.

authId
template
stage
header
iid
access_token
tokenId
callbacks

POST /v1/sessions/authenticate HTTP/1.1
Accept: application/json
X-Credential-Type: PASSCODE
X-Auth-Operation: LOGIN
Content-Type: application/json

{
  "authId": "auth-7c21",
  "template": "login",
  "stage": "passcode",
  "iid": "IID-440192"
}

{
  "authId": "auth-7c21",
  "template": "login",
  "stage": "success",
  "header": "session",
  "iid": "IID-440192",
  "access_token": "<access_token_jwt>",
  "tokenId": "tid-9f21"
}

PAN authenticator
POST /v1/cards/link/authenticate osint
Authenticates a UK card by PAN through the card-authenticator edge so a plastic can be linked without a username.
Auth: Accept: application/json. Used when the customer signs in or links a card with a PAN (field-level-protected) instead of a username.
- authId
- template
- stage
- iid
- tokenId
```
POST /v1/cards/link/authenticate HTTP/1.1
Accept: application/json
Content-Type: application/json

{
  "authId": "auth-pan-12",
  "template": "pan",
  "stage": "cardDetails",
  "iid": "IID-440192"
}
```
```
{
  "authId": "auth-pan-12",
  "template": "pan",
  "stage": "success",
  "iid": "IID-440192",
  "tokenId": "tid-pan-88"
}
```

Accounts summary

GET /v1/customers/{customerId}/cards openbanking

Loads every card on the customer: sterling current/previous balance, available credit and limit, masked PAN, plasticId, and servicing flags such as viewPinEligibility and pastDueStatus.

Auth: Bearer access_token from POST /v1/cardholder-gateway/access-token. The path customer identifier is the unique customer id on the signed-in primary authentication account.

accounts
accountUniqueId
productSelector
productType
productStatus
balance.current.value
balance.current.currency
credit.available.value
credit.limit.value
obfuscatedNumber
accountOpenDate
partnerId
plasticId
viewPinEligibility
pastDueStatus
spendSuspension
cardActivationState

GET /v1/customers/CUST-1849203/cards HTTP/1.1
Authorization: Bearer <access_token>
Accept: application/json

{
  "accounts": [
    {
      "accountUniqueId": "ACC-9f21c4",
      "productSelector": "PLATINUM",
      "productType": "CREDIT_CARD",
      "productStatus": "OPEN",
      "accountDetails": {
        "account": {
          "balance": {
            "current": {"value": "412.50", "currency": "GBP"},
            "previous": {"value": "388.10", "currency": "GBP"}
          },
          "credit": {
            "available": {"value": "1587.50", "currency": "GBP"},
            "limit": {"value": "2000.00", "currency": "GBP"}
          },
          "card": {
            "obfuscatedNumber": "************4412",
            "accountOpenDate": "2019-03-14",
            "partnerId": "C1UK",
            "plasticId": "PL-7781",
            "productTypes": ["CREDIT_CARD"]
          }
        },
        "accountStatuses": {
          "cardActivationState": "ACTIVATED",
          "cardState": "NORMAL",
          "eligibleForInAppSupport": true,
          "paymentPlanEligibilityStatus": true,
          "pushTransactionEligibility": "ELIGIBLE",
          "viewPinEligibility": "ELIGIBLE",
          "pastDueStatus": "CURRENT",
          "spendSuspension": []
        }
      }
    }
  ]
}

Open Banking consent information

GET /v1/data-sharing/consent-requests openbanking

Reads the Open Banking AIS/PIS consent a TPP requested: thirdPartyName, permission clusters, date window and the Capital One productNumber the customer may select.

Auth: Bearer access_token. Version header selects the consent schema. Query identifies the TPP consent the customer is asked to approve.

consentId
thirdPartyName
onBehalfOf
consentStartDate
consentExpiryDate
consentStatus
consentType
clusters
permissions
transactionStartDate
transactionEndDate
productNumber

GET /v1/data-sharing/consent-requests?consentId=ob-consent-88 HTTP/1.1
Authorization: Bearer <access_token>
Accept: application/json;v=2

{
  "consentId": "ob-consent-88",
  "thirdPartyName": "Money Dashboard",
  "onBehalfOf": "Money Dashboard Ltd",
  "consentStartDate": "2026-10-20T09:14:00Z",
  "consentExpiryDate": "2027-10-20T09:14:00Z",
  "statusUpdatedDate": "2026-10-20T09:14:00Z",
  "consentStatus": "AwaitingAuthorisation",
  "consentType": "AccountInformation",
  "clusters": [
    {
      "name": "Transactions",
      "transactionStartDate": "2025-10-20",
      "transactionEndDate": "2026-10-20",
      "permissions": ["ReadTransactionsDetail", "ReadBalances"]
    }
  ],
  "products": [
    {"productNumber": "4412"}
  ]
}

Open Banking consent decision
POST /v1/data-sharing/consent-decisions openbanking
Records Authorise or Reject for an Open Banking consent and returns redirectLocation so the TPP can complete the OAuth redirect.
Auth: Bearer access_token. Version header selects the consent schema. Body is the customer's Authorise/Reject decision plus selectedAccounts.
- decision
- selectedAccounts
- productNumber
- redirectLocation
```
POST /v1/data-sharing/consent-decisions HTTP/1.1
Authorization: Bearer <access_token>
Accept: application/json;v=2
Content-Type: application/json

{
  "decision": "Authorise",
  "selectedAccounts": [{"productNumber": "4412"}]
}
```
```
{
  "redirectLocation": "https://tpp.example/ob/callback?code=AUTH_CODE&state=xyz"
}
```
Open Banking authorize
GET /v1/data-sharing/authorization openbanking
Opens the Open Banking authorization transaction that later feeds GET consent requests and the Authorise/Reject write.
Auth: Identity session cookie plus Accept: application/json. Starts the Open Banking consent authorization after the customer is signed in.
- authId
- stage
- template
- response_type
- scope
```
GET /v1/data-sharing/authorization?response_type=code&scope=openid HTTP/1.1
Accept: application/json
Cookie: session=<idp-cookie>
X-Identity-Provider: <idp>
```
```
{
  "authId": "ob-auth-22",
  "stage": "consent",
  "template": "open-banking"
}
```
View-PIN JWKS
GET /v1/cards/pin/keys openfinance
Returns the RSA public keys (kty, n, e, kid) the app uses to wrap the view-PIN session-key before posting transportPan.
Auth: Bearer access_token. Accept: application/json. The returned RSA JWK encrypts the session-key used on the PIN call.
- keys
- kty
- e
- use
- kid
- alg
- n
```
GET /v1/cards/pin/keys HTTP/1.1
Authorization: Bearer <access_token>
Accept: application/json
```
```
{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "use": "enc",
      "kid": "pin-key-2026-10",
      "alg": "RSA-OAEP",
      "n": "<base64url-modulus>"
    }
  ]
}
```
Encrypted view-PIN
POST /v1/cards/pin/reveal openfinance
Returns an encryptedPinBlock for an eligible card so the app can decrypt the PIN locally with the session-key.
Auth: Bearer access_token. Accept: application/json. Body carries an RSA-wrapped session-key and a field-level-protected transportPan; only eligible plastics (viewPinEligibility) succeed.
- session-key
- transportPan
- encryptedPinBlock
```
POST /v1/cards/pin/reveal HTTP/1.1
Authorization: Bearer <access_token>
Accept: application/json
Content-Type: application/json

{
  "session-key": "<wrapped-aes-key>",
  "transportPan": "<wrapped-pan>"
}
```
```
{
  "encryptedPinBlock": "<wrapped-pin-block>"
}
```
KYC identity check
POST /v1/verification/identity-checks osint
Submits selfie and identity-document images and returns identityCheckState (NOT_STARTED, IN_PROGRESS, SUCCESS, FAILED, BLOCKED).
Auth: Bearer access_token. Uploads a selfie plus driving licence or passport images captured in the in-app camera flow.
- selfie
- selfieMetadata
- identityDocuments
- drivingLicence
- passport
- identityCheckState
```
POST /v1/verification/identity-checks HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "selfie": "<base64-jpeg>",
  "selfieMetadata": {"captureTimestamp": "2026-10-20T09:20:00Z"},
  "identityDocuments": {
    "drivingLicence": "<base64-jpeg>",
    "passport": null
  }
}
```
```
{
  "identityCheckState": "IN_PROGRESS"
}
```
KYC identity-check state
GET /v1/verification/identity-checks/status osint
Polls the KYC job until identityCheckState is SUCCESS, FAILED or BLOCKED.
Auth: Bearer access_token. Polled after the identity-check POST until identityCheckState leaves IN_PROGRESS.
- identityCheckState
```
GET /v1/verification/identity-checks/status HTTP/1.1
Authorization: Bearer <access_token>
Accept: application/json
```
```
{
  "identityCheckState": "SUCCESS"
}
```
Biometrics opt-in
POST /v1/devices/biometrics osint
Opts the signed-in iid into device biometrics by storing deviceId and publicKey for later passwordless unlock.
Auth: Bearer access_token with an API version header. Registers this device's publicKey against the customer's iid.
- iid
- deviceId
- publicKey
```
POST /v1/devices/biometrics HTTP/1.1
Authorization: Bearer <access_token>
Version: v1
Content-Type: application/json

{
  "iid": "IID-440192",
  "deviceId": "android-9f21c4",
  "publicKey": "<base64-public-key>"
}
```
```
{}
```
Start card-link profile merge
POST /v1/profiles/{secondaryId}/links osint
Starts linking a second card profile (secondaryUci) onto primaryUci and returns mergeId for the commit step.
Auth: Bearer access_token. Channel header MOBILE and an API version header. Body names the primaryUci that will own both plastics.
- primaryUci
- secondaryUci
- mergeId
```
POST /v1/profiles/SECONDARY-ID/links HTTP/1.1
Authorization: Bearer <access_token>
X-Channel-Type: MOBILE
Content-Type: application/json
Version: v1

{
  "primaryUci": "UCI-1849203"
}
```
```
{
  "mergeId": "merge-55ab"
}
```
Commit card-link profile merge
POST /v1/profiles/{primaryId}/links/{linkId}/confirm osint
Commits the profile merge so both plastics appear under the primary customer's accounts summary.
Auth: Bearer access_token. Channel header MOBILE and an API version header. Completes the merge started on the secondary profile.
- primaryUci
- mergeId
- secondaryId
```
POST /v1/profiles/PRIMARY-ID/links/merge-55ab/confirm HTTP/1.1
Authorization: Bearer <access_token>
X-Channel-Type: MOBILE
Version: v1
```
```
{
  "secondaryId": "UCI-SECONDARY"
}
```
Hydrate dynamic experience
POST /v1/screens/{experienceId}/render opendata
Hydrates a server-driven UI experience (home, payments, servicing) as id, version, initialState and states.
Auth: Bearer access_token. Body is a JSON context used to personalise home, payments and servicing screens.
- id
- version
- initialState
- initialContext
- states
- experienceId
```
POST /v1/screens/customer-home/render HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "uci": "UCI-1849203",
  "accountUniqueId": "ACC-9f21c4"
}
```
```
{
  "id": "customer-home",
  "version": "2026.10",
  "initialState": "AtAGlance",
  "initialContext": {},
  "states": {
    "AtAGlance": {}
  }
}
```

Feature-flag decide variation

POST /v1/flags/evaluate opendata

Resolves per-flag variationKey and isFeatureFlagEnabled so servicing mode, view-PIN and Open Banking pay can be gated per customer.

Auth: Unauthenticated or Bearer depending on channel. Body lists decisionFlagKeys and entityAttributes for the device/customer.

decideOptions
entityAttributes
decisionFlagKeys
flagKey
isFeatureFlagEnabled
variationKey
featureFlagVariables

POST /v1/flags/evaluate HTTP/1.1
Content-Type: application/json

{
  "decideOptions": ["enabled"],
  "entityAttributes": {"platform": "android", "appVersion": "10.3.0"},
  "decisionFlagKeys": ["servicingMode", "viewPin", "openBankingPay"]
}

[
  {
    "flagKey": "servicingMode",
    "isFeatureFlagEnabled": false,
    "variationKey": "off",
    "featureFlagVariables": {}
  },
  {
    "flagKey": "viewPin",
    "isFeatureFlagEnabled": true,
    "variationKey": "on"
  }
]

Data categories

balances
credit-limits
open-banking-consents
card-pin
kyc
identity
feature-flags

Where teams use this data

Sterling balance and available-credit feed
A UK PFM or collections stack pulls each plastic's balance.current.value, credit.available.value and credit.limit.value nightly, keyed by accountUniqueId and obfuscatedNumber, and alerts when pastDueStatus or spendSuspension flips.
Open Banking TPP consent desk
An AIS/PIS aggregator reads consentId, thirdPartyName, permission clusters and productNumber, then posts decision=Authorise with selectedAccounts and follows redirectLocation back to its own callback.
Card-ops PIN and KYC status
A servicing bot checks viewPinEligibility, wraps a session-key against the view-PIN JWKS, and stores encryptedPinBlock only in the cardholder session; the same bot polls identityCheckState after a driving-licence or passport upload.
Multi-card household merge
A household onboarding flow starts a merge of secondaryUci onto primaryUci, commits mergeId, then reloads accounts-summary so both plastics share one iid and one dashboard.

Frequently asked questions

Which card fields does the account overview return?

Each account carries accountUniqueId, productType and productStatus, sterling balance.current / balance.previous, credit.available and credit.limit (value + currency), masked obfuscatedNumber, plasticId, partnerId, accountOpenDate, plus flags such as viewPinEligibility, pastDueStatus, cardActivationState and spendSuspension.

How does Open Banking consent work in the app?

After gateway access_token sign-in, the app loads consentId, thirdPartyName, consentType and permission clusters, then posts decision (Authorise or Reject) with selectedAccounts.productNumber. The response redirectLocation sends the TPP back to its OAuth callback.

How is a card PIN retrieved?

Only plastics with viewPinEligibility set are eligible. The app fetches RSA JWKS (kty, n, e, kid), wraps a session-key, posts session-key plus transportPan, and decrypts the returned encryptedPinBlock locally.

How does the app authenticate customers?

UK identity login stages a passcode/OTP/biometric transaction (authId, stage, iid), optionally authenticates a PAN, then exchanges an authorization_code (PKCE S256) for access_token / expires_in. Later private calls send that Bearer token; biometrics opt-in stores deviceId and publicKey against iid.

Apps similar to Capital One UK

Barclaycard — Barclaycard is Barclays' UK credit-card brand, with purchase, balance-transfer, rewards and credit-builder cards that customers manage in the Barclaycard app to check balances, view transactions and make monthly payments.
HSBC UK Credit Cards — HSBC UK issues balance-transfer, purchase, rewards and credit-builder cards, including a balance-transfer card with up to 36 months interest-free (3.09% fee), and lets customers check eligibility and manage the card in its app.
NatWest Credit Cards — NatWest offers UK credit cards spanning 0% purchase and balance-transfer deals, travel and supermarket rewards, and a credit-builder card, with applications completed online in under ten minutes.
Lloyds Bank Credit Cards — Lloyds Bank offers UK credit cards including 0% purchase periods of up to 25 months and the Lloyds Ultra card, which pays cashback and has fee-free foreign spending.
American Express — American Express UK credit cards include Cashback Everyday, which pays introductory cashback then 0.5% on the first £10,000 of spend, and Preferred Rewards Gold with Membership Rewards points and airport-lounge visits.
Tesco Bank Credit Cards — Tesco Bank Clubcard credit cards collect Clubcard points on Tesco and other spend and include 0% balance-transfer and purchase deals, with the mobile banking app used to track transactions, pay by bank and report a lost card.
Aqua — Aqua issues UK credit-builder cards such as Aqua Classic and a balance-transfer card, with starting limits from £250 to £1,500, Apple Pay and Google Pay, and a SafeCheck eligibility check that does not affect the credit score.
Vanquis — Vanquis Bank issues UK credit-builder, balance-transfer and purchase credit cards (representative 37.9% APR variable on the Credit Builder Card) alongside savings and loans for UK residents aged 18 and over.

More Banking apps

Topics

Capital One UK API
Capital One UK credit card balance
Open Banking consent Capital One
view PIN Capital One UK
Capital One Europe plc
UK credit card available credit
Capital One KYC identity check
sterling card data API

Need this app's data API integrated?

We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.

NDA + SOW on every engagement
Delivery in 3–7 days
Payment only after acceptance
Work scoped to authorized use

Get a quote

Capital One UK Data API

Screenshots

API surface

Gateway access token

Identity authenticate

PAN authenticator

Accounts summary

Open Banking consent information

Open Banking consent decision

Open Banking authorize

View-PIN JWKS

Encrypted view-PIN

KYC identity check

KYC identity-check state

Biometrics opt-in

Start card-link profile merge

Commit card-link profile merge

Hydrate dynamic experience

Feature-flag decide variation

Data categories

Where teams use this data

Sterling balance and available-credit feed

Open Banking TPP consent desk

Card-ops PIN and KYC status

Multi-card household merge

Frequently asked questions

Apps similar to Capital One UK

More Banking apps

5paisa: Demat, Stocks & IPO

AndroMoney

Angel One: Stocks, Mutual Fund

Bibit- Reksadana & Obligasi

Topics

Need this app's data API integrated?

Capital One UK Data API

Screenshots

API surface

Gateway access token

Identity authenticate

PAN authenticator

Accounts summary

Open Banking consent information

Open Banking consent decision

Open Banking authorize

View-PIN JWKS

Encrypted view-PIN

KYC identity check

KYC identity-check state

Biometrics opt-in

Start card-link profile merge

Commit card-link profile merge

Hydrate dynamic experience

Feature-flag decide variation

Data categories

Where teams use this data

Sterling balance and available-credit feed

Open Banking TPP consent desk

Card-ops PIN and KYC status

Multi-card household merge

Frequently asked questions

Related apps

Apps similar to Capital One UK

More Banking apps

5paisa: Demat, Stocks & IPO

AndroMoney

Angel One: Stocks, Mutual Fund

Bibit- Reksadana & Obligasi

Topics

Need this app's data API integrated?