VR SecureGo plus SCA data API

Atruvia AG · Identity

VR SecureGo plus is Atruvia AG's Android strong-customer-authentication companion for customers of Germany's Volksbanken Raiffeisenbanken. Version 4.4.2 (vr flavour) is the pushTAN-style approval app that sits beside the VR Banking App: after the customer types an activation code, the handset becomes the device that confirms online-banking payments, debit- and credit-card charges, Wero (EPI) consents and Mastercard checkout deep links, using an approval password or the phone's biometrics. Users scan a QR code for Comfort-Login, start video identification with IDnow or German eID (online Ausweisfunktion over NFC via Authada), move the registered device to a new phone with a transfer code, and reset the approval password against linked bank accounts. It is Germany-only, issued by the local Volksbank or Raiffeisenbank rather than as a standalone bank, and sits against Sparkasse S-pushTAN, Commerzbank photoTAN and Deutsche Bank authenticator apps in the German SCA-companion category.

Linked cooperative-bank devices list iban, bankAccountName, accountAddress, tenant and bankName on each accountDevices row, with temporary marking a not-yet-fully-authorized binding. TAN history stamps authStatus, mappedTransactionType and preContext, and types the payload as amount/currency or ibanUnformatted.

VR-NetKey rows expose wire-name benutzerkennung plus alias and status (AUSGEGEBEN versus GESPERRT). New-customer cases post vertriebskundenId, markenId and customerEmail and receive identCode; IDnow then returns firstName, lastName and processType. Bank-ops inventories, PSD2 audit desks and eKYC routers consume those fields; openData Studio turns them into callable open data.

Screenshots

API surface

The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.

Issue management token
POST /v1/device-sessions osint
Starts a management session for the enrolled authentication medium identified by authMediumID and returns status used before account, card and transaction calls.
Auth: Unauthenticated bootstrap. JSON body carries authMediumID of the enrolled SCA medium. The returned token is sent as the Authorization header on later private calls.
- authMediumID
- status
```
POST /v1/device-sessions HTTP/1.1
Content-Type: application/json
Accept-Language: de

{
  "authMediumID": "am-7f21c0"
}
```
```
{
  "status": "OK"
}
```
Issue app token
POST /v1/device-sessions/app-grant osint
Mints the appToken bound to this authentication medium for QR Comfort-Login, identverfahren initiation and VR-NetKey lookup.
Auth: Unauthenticated bootstrap. JSON body carries authMediumID. Response appToken is sent as the appToken header on QR login, new-customer ident and VR-NetKey calls.
- authMediumID
- appToken
```
POST /v1/device-sessions/app-grant HTTP/1.1
Content-Type: application/json

{
  "authMediumID": "am-7f21c0"
}
```
```
{
  "appToken": "at-9c2e1a44"
}
```
Register authentication medium
POST /v1/enrollments osint
Registers this Android handset as an SCA medium and returns activationCode plus authMediumID used by later token and activation calls.
Auth: Optional Authorization management token when adding a medium to an existing session; first-time enrollment posts deviceName and appID with no Authorization.
- deviceName
- appID
- activationCode
- authMediumID
```
POST /v1/enrollments HTTP/1.1
Content-Type: application/json
Authorization: <management-token>

{
  "deviceName": "Pixel 8",
  "appID": "<app-id>"
}
```
```
{
  "activationCode": "SG-AKT-440192",
  "authMediumID": "am-7f21c0"
}
```
Activate account on device
POST /v1/bindings/activate openbanking
Binds a cooperative-bank account to this device from the activationCode and returns bankName plus the temporary (not-fully-authorized) and isDPKAccountDevice flags.
Auth: Authorization management token. Body activationCode prefix selects the data-centre region that serves the account.
- activationCode
- temporary
- bankName
- isDPKAccountDevice
```
POST /v1/bindings/activate HTTP/1.1
Authorization: <management-token>
Content-Type: application/json
appVersion: 4.4.2

{
  "activationCode": "SG-AKT-440192"
}
```
```
{
  "temporary": false,
  "bankName": "Volksbank Musterstadt eG",
  "isDPKAccountDevice": true
}
```

List device bank accounts

GET /v1/bindings/accounts openbanking

Returns every cooperative-bank account bound to this SCA device, including iban, tenant, bankName and the temporary / hasOnlineBanking flags.

Auth: Authorization management token issued by the device-session bootstrap.

accountDevices
bankAccountName
accountAddress
iban
bankName
tenant
dataCenter
temporary
hasOnlineBanking
isDPKAccessible

GET /v1/bindings/accounts HTTP/1.1
Authorization: <management-token>
Accept-Language: de
appVersion: 4.4.2

{
  "accountDevices": [
    {
      "bankAccountName": "Girokonto",
      "accountAddress": "DE89370400440532013000",
      "iban": "DE89370400440532013000",
      "bankName": "Volksbank Musterstadt eG",
      "tenant": "GENODEF1MUSTER",
      "dataCenter": "DATA_CENTER_1",
      "temporary": false,
      "hasOnlineBanking": true,
      "isDPKAccessible": true
    }
  ]
}

TAN approval history

GET /v1/approvals/history openfinance

Lists SCA approvals this device has confirmed or rejected, with authStatus, mappedTransactionType and typed payloads (amount/currency, ibanUnformatted).

Auth: Authorization management token plus appVersion header (4.4.2).

transactions
id
appId
authMethod
authStatus
phoneModel
preContext
transactionDataElements
metadata
time
mappedTransactionType
accountType
amount
currency
ibanUnformatted
code
message

GET /v1/approvals/history HTTP/1.1
Authorization: <management-token>
appVersion: 4.4.2
Accept-Language: de

{
  "transactions": [
    {
      "id": "tx-4401",
      "appId": "<app-id>",
      "authMethod": "pushTAN",
      "authStatus": "AUTH_CONFIRMED",
      "phoneModel": "Pixel 8",
      "preContext": "<p>Überweisung an Muster GmbH</p>",
      "transactionDataElements": [
        {
          "type": "AMOUNT",
          "groupId": "amt",
          "de": {"title": "Betrag", "value": "250,00 EUR"},
          "en": {"title": "Amount", "value": "250.00 EUR"},
          "generalAmount": {"amount": 250.0, "currency": "EUR", "important": true}
        },
        {
          "type": "IBAN",
          "groupId": "iban",
          "generalIban": {"ibanUnformatted": "DE89370400440532013000"}
        }
      ],
      "metadata": [],
      "time": "2026-10-18T09:14:22Z",
      "mappedTransactionType": "ONLINE_BANKING",
      "accountType": "BANKING"
    }
  ],
  "code": "OK",
  "message": ""
}

List credit and debit cards

GET /v1/payment-cards openfinance

Returns CREDITCARD and DEBITCARD accounts bound to the device, each with masked number, issuer and optional display name.

Auth: Authorization management token.

cardAccounts
type
address
cards
number
issuer
name

GET /v1/payment-cards?types=CREDITCARD,DEBITCARD HTTP/1.1
Authorization: <management-token>
Accept-Language: de

{
  "cardAccounts": [
    {
      "type": "CREDITCARD",
      "address": "cc-addr-19",
      "cards": [
        {
          "number": "************4242",
          "issuer": "Mastercard",
          "name": "VR Gold"
        }
      ]
    }
  ]
}

List VR-NetKey aliases
GET /v1/login-identities osint
Returns VR-NetKey access identifiers (wire name benutzerkennung) with alias and status (ERFASST/BESTAETIGT/BESTELLT/AUSGEGEBEN/GESPERRT/GELOESCHT) for QR Comfort-Login.
Auth: Authorization management token or appToken header, plus qrCodeToken header from the scanned login QR.
- tenant
- vrNetKeys
- benutzerkennung
- alias
- status
- dataCenter
- errorMessage
```
GET /v1/login-identities HTTP/1.1
Authorization: <management-token>
qrCodeToken: qr-8e21c0
```
```
{
  "tenant": "GENODEF1MUSTER",
  "vrNetKeys": [
    {
      "benutzerkennung": "VR1234567890",
      "alias": "Online-Banking",
      "status": "AUSGEGEBEN",
      "tenant": "GENODEF1MUSTER",
      "dataCenter": "DATA_CENTER_1"
    }
  ],
  "errorMessage": null
}
```
QR Comfort-Login authenticate
POST /v1/login-sessions/qr osint
Completes QR Comfort-Login for the chosen VR-NetKey and returns isFirstLogin for the banking session.
Auth: appToken header from the app-token grant call. Body vrNetKey plus tenant from the VR-NetKey list.
- vrNetKey
- tenant
- isFirstLogin
```
POST /v1/login-sessions/qr HTTP/1.1
appToken: at-9c2e1a44
Content-Type: application/json

{
  "vrNetKey": "VR1234567890",
  "tenant": "GENODEF1MUSTER"
}
```
```
{
  "isFirstLogin": false
}
```
Authentication-medium status
GET /v1/enrollments/{enrollmentId}/state opendata
Reads pending-transaction and update flags for the SCA medium and the FeatureToggle that gates eidentification, videoIdentification and showTransactionHistory.
Auth: Accept-Language header. Path enrollmentId comes from the registration result. No Authorization on this call.
- isTransactionPending
- shouldUpdate
- updateMessage
- updateTarget
- infoMessage
- infoButtonText
- pendingEnrollment
- reenrollmentPending
- features
- appRating
- bankingAppAd
- useBluetoothForDeviceTransfer
- showTransactionHistory
- showResetApprovalCode
- eidentification
- videoIdentification
```
GET /v1/enrollments/am-7f21c0/state HTTP/1.1
Accept-Language: de
```
```
{
  "isTransactionPending": false,
  "shouldUpdate": "NO",
  "updateMessage": null,
  "updateTarget": null,
  "infoMessage": null,
  "infoButtonText": null,
  "pendingEnrollment": false,
  "reenrollmentPending": false,
  "features": {
    "appRating": true,
    "bankingAppAd": false,
    "useBluetoothForDeviceTransfer": true,
    "showTransactionHistory": true,
    "showResetApprovalCode": true,
    "eidentification": true,
    "videoIdentification": true
  }
}
```
Request device-transfer code
POST /v1/handover/codes osint
Issues a transferCode so the enrolled SCA medium, linked accounts and payment means can be moved to a replacement phone.
Auth: Authorization management token on the source device.
- transferCode
```
POST /v1/handover/codes HTTP/1.1
Authorization: <management-token>
Content-Type: application/json
```
```
{
  "transferCode": "TR-19c4-8e21"
}
```
Initiate identverfahren
POST /v1/onboarding/identifications osint
Starts a new-customer VIDEOIDENT or ONLINE_AUSWEISFUNKTION case and returns the identCode scanned or typed into IDnow / eID.
Auth: appToken header. Body type is VIDEOIDENT or ONLINE_AUSWEISFUNKTION plus tenant, markenId, vertriebskundenId and customer contact fields.
- type
- vertriebskundenId
- tenant
- markenId
- customerEmail
- customerMobile
- produktbezeichnung
- callerId
- identCode
```
POST /v1/onboarding/identifications HTTP/1.1
appToken: at-9c2e1a44
Content-Type: application/json

{
  "type": "VIDEOIDENT",
  "vertriebskundenId": "vk-4401",
  "tenant": "GENODEF1MUSTER",
  "markenId": "vr",
  "customerEmail": "[email protected]",
  "customerMobile": "+4915112345678",
  "produktbezeichnung": "VR-Konto",
  "callerId": "securego-plus"
}
```
```
{
  "identCode": "ABC-12DEF"
}
```
List active identverfahren
GET /v1/onboarding/tenants/{tenant}/brands/{brandId}/methods opendata
Returns the ident methods this cooperative-bank tenant currently offers (VIDEOIDENT and/or ONLINE_AUSWEISFUNKTION).
Auth: appToken header. Path tenant and brandId (markenId) come from the bound bank account.
- tenant
- markenId
- activeIdentverfahren
```
GET /v1/onboarding/tenants/GENODEF1MUSTER/brands/vr/methods HTTP/1.1
appToken: at-9c2e1a44
```
```
{
  "activeIdentverfahren": [
    "VIDEOIDENT",
    "ONLINE_AUSWEISFUNKTION"
  ]
}
```
Video-identification customer record
GET /v1/video-ident/{partnerCode}/cases/{caseToken} osint
Loads the IDnow videoIdent customer record for this identCode: names, email, mobile, processType and status used by the in-app video session.
Auth: Path partnerCode plus caseToken (the identCode). No account credentials; the case token itself scopes access to the single video-identification session.
- token
- internalToken
- status
- email
- mobile
- firstName
- lastName
- processType
- preferredLang
- redirectUrl
- remainingInternalTokenRetries
- waitingListEnrolled
- waitingListNotified
```
GET /v1/video-ident/vr-banking/cases/ABC-12DEF HTTP/1.1
Accept: application/json
```
```
{
  "token": "ABC-12DEF",
  "internalToken": "it-9f31",
  "status": "PENDING",
  "email": "[email protected]",
  "mobile": "+4915112345678",
  "firstName": "Erika",
  "lastName": "Mustermann",
  "processType": "VIDEO_IDENT",
  "preferredLang": "de",
  "redirectUrl": "https://ident.example.com/cases/ABC-12DEF",
  "remainingInternalTokenRetries": 3,
  "waitingListEnrolled": false,
  "waitingListNotified": false
}
```

Data categories

SCA devices
bank accounts
TAN approvals
payment cards
VR-NetKey
video identification
German eID

Where teams use this data

Cooperative-bank IBAN inventory
A bank-ops desk pulls accountDevices for each enrolled SCA phone and reconciles iban, tenant and bankName against the core-banking CIF so dormant or temporary (not-fully-authorized) devices can be retired.
TAN approval audit trail
Compliance stores HistoricalTransaction rows keyed by id and time, with authStatus, mappedTransactionType and ibanUnformatted / amount / currency payloads, to evidence PSD2 SCA for online-banking and card payments.
VR-NetKey access-id sync
Online-banking IAM copies benutzerkennung, alias and status from the login-identity list so Comfort-Login QR scans only offer AUSGEGEBEN keys for the matching tenant.
New-customer ident routing
Onboarding reads activeIdentverfahren for the tenant/markenId, then opens a VIDEOIDENT or ONLINE_AUSWEISFUNKTION case and hands identCode to IDnow or Authada eID without a second capture of customerEmail and customerMobile.

Frequently asked questions

What account data does VR SecureGo plus expose?

Each enrolled device returns accountDevices with iban, bankAccountName, accountAddress, tenant, bankName, dataCenter and flags temporary, hasOnlineBanking and isDPKAccessible. Credit and debit cards arrive as cardAccounts with masked number, issuer and name.

Can I read TAN approvals and payment details?

Yes. The approval-history call lists processed approval rows with authStatus (AUTH_CONFIRMED or AUTH_REJECTED), mappedTransactionType (ONLINE_BANKING, CREDITCARDPAYMENT, EPI_CONSENT, QR_CODE_AUTH and others), preContext, time, and typed transactionDataElements for amount/currency and ibanUnformatted.

How does VR SecureGo plus authenticate these calls?

A bootstrap call exchanges the authMediumID of the enrolled device for a management token, sent as the Authorization header on account, card and history calls. A second call mints an appToken used for QR login, VR-NetKey and new-customer ident calls. Production traffic is split across two data-centre regions (DATA_CENTER_1 and DATA_CENTER_2), chosen by the activation code prefix.

Is this a public developer API?

No. These are first-party endpoints the Android SCA companion uses after device enrollment. They are documented here as data sources, not as an open partner programme.

Apps similar to VR SecureGo plus

S-pushTAN — Star Finanz's Sparkasse companion shows order details on the phone so the customer can approve transfers, standing orders and securities orders after the savings bank has registered them for pushTAN.
Commerzbank photoTAN — Commerzbank photoTAN lets customers scan a mosaic graphic from online banking to generate a TAN, then check the order details in the app before entering that TAN on the computer.
Deutsche Bank photoTAN — Deutsche Bank photoTAN is the bank's German companion for approving transfers in online and mobile banking, either by scanning a graphic for a TAN or by confirming the order with photoTAN push.
DB Secure Authenticator — DB Secure Authenticator is Deutsche Bank's two-factor app that scans a QR code, generates a one-time password, or answers a challenge so customers can log in and authorise transactions.
Postbank BestSign — Postbank BestSign is a standalone app for authorising online-banking orders with the BestSign procedure, using a password or biometrics when the customer banks mainly on a computer.
comdirect photoTAN App — The comdirect photoTAN app receives a notification when a transaction is placed on another device, then lets the customer review it and authorise the TAN, with a graphic-scan fallback when the phone is offline.
SpardaSecureGo+ — SpardaSecureGo+ is the Sparda-Banken authorisation app for credit-card payments and online-banking transactions, confirming them on the phone instead of typing a TAN, on up to three devices.

More Identity apps

Topics

VR SecureGo plus API
Volksbanken Raiffeisenbanken TAN
VR-NetKey
pushTAN Germany
IDnow videoIdent
German eID Ausweisfunktion
Wero EPI consent
Atruvia SCA

Need this app's data API integrated?

We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.

NDA + SOW on every engagement
Delivery in 3–7 days
Payment only after acceptance
Work scoped to authorized use

Get a quote

VR SecureGo plus SCA data API

Screenshots

API surface

Issue management token

Issue app token

Register authentication medium

Activate account on device

List device bank accounts

TAN approval history

List credit and debit cards

List VR-NetKey aliases

QR Comfort-Login authenticate

Authentication-medium status

Request device-transfer code

Initiate identverfahren

List active identverfahren

Video-identification customer record

Data categories

Where teams use this data

Cooperative-bank IBAN inventory

TAN approval audit trail

VR-NetKey access-id sync

New-customer ident routing

Frequently asked questions

Apps similar to VR SecureGo plus

More Identity apps

Duo Mobile

GOSI

IDnow Online Ident

Microsoft Authenticator

Topics

Need this app's data API integrated?

VR SecureGo plus SCA data API

Screenshots

API surface

Issue management token

Issue app token

Register authentication medium

Activate account on device

List device bank accounts

TAN approval history

List credit and debit cards

List VR-NetKey aliases

QR Comfort-Login authenticate

Authentication-medium status

Request device-transfer code

Initiate identverfahren

List active identverfahren

Video-identification customer record

Data categories

Where teams use this data

Cooperative-bank IBAN inventory

TAN approval audit trail

VR-NetKey access-id sync

New-customer ident routing

Frequently asked questions

Related apps

Apps similar to VR SecureGo plus

More Identity apps

Duo Mobile

GOSI

IDnow Online Ident

Microsoft Authenticator

Topics

Need this app's data API integrated?