Open Banking Prerequisites
Some products require Open Banking inputs (e.g., FinancialInstitutionId, AccountsLinkId). Use this page to gather those once, then reuse them across products.
Applies to every Open Banking product: Single API, Income Verification, E-Statement, Average Balance, Account Insights, Credit Profiling and Cash Flow.
Request the product's own scope when generating the token — for example e_statement. You can put more than one scope in the same token by separating them with spaces, for example e_statement single_api, as long as your app is subscribed to each product. The same scopes work in Production; only the base URL changes.
List Financial Institutions (Sandbox)
You must be subscribed to the Financial Institutions product before calling this endpoint.
https://test.api.neotek.sa/financial-institutions-information/v1/financial-institutionsSandbox URL · in Production call https://api.neotek.sa
Use this to discover banks and supported security profiles / data groups
curl -L "https://test.api.neotek.sa/financial-institutions-information/v1/financial-institutions" \ -H "Authorization: Bearer <ACCESS_TOKEN>"Response (trimmed to one institution)
{ "Data": { "FinancialInstitution": [ { "FinancialInstitutionId": "BSFRSARI", "FinancialInstitutionName": { "NameEn": "Banque Saudi Fransi", "NameAr": "البنك السعودي الفرنسي" }, "Logo": "https://api.public.neotek.sa/assets-neotek/financial-institutions/BSFRSARI.png", "SecurityProfiles": [ "Redirection" ], "IsActive": true } ] }}Use the FinancialInstitutionId when creating an accounts link, and check SecurityProfiles for the profile that bank supports.
Create an Accounts Link
You must be subscribed to the Accounts Links product before calling this endpoint.
https://test.api.neotek.sa/accounts-information/v1/accounts-linksSandbox URL · in Production call https://api.neotek.sa
Body (minimum): all four go inside Data, and all four are required.
FinancialInstitutionId– the bank's BIC, taken from the List Financial Institutions response aboveSecurityProfile–RedirectionDataGroups– the data being requested, e.g.AccountDetails,AccountTransactionsPSUId– the id you use for this customer in your own system. Keep it consistent: every product call resolves the customer's consented accounts from it
Testing? Use "FinancialInstitutionId": "SAIBCSARI".
SAIBCSARI is the BIC of The Saudi Investment Bank, the Sandbox institution —
it is the value every example on this page sends for that field. Its consent
journey opens the Model Bank, so you can complete a
link end to end without a real bank.
curl -X POST 'https://test.api.neotek.sa/accounts-information/v1/accounts-links' \ -H 'Authorization: Bearer <ACCESS_TOKEN>' \ -H 'Content-Type: application/json' \ -d '{ "Data": { "PSUId": "PTP100", "FinancialInstitutionId": "SAIBCSARI", "SecurityProfile": "Redirection", "DataGroups": [ { "DataGroupId": "AccountDetails", "Permissions": ["ReadAccountsBasic"] } ] }}'Response
{ "Data": { "AccountsLinkId": "2586", "RedirectionURL": "https://developer-portal.neotek.sa/ob/initiate-consent?..." }}Model Bank (Sandbox)
The RedirectionURL in that response is where the customer gives consent. In
production it takes them to their own bank; in Sandbox it takes them to the
Model Bank, a simulated bank that stands in for every institution so you can
walk the journey end to end without a real bank connection.
https://developer-portal.neotek.sa/ob/initiate-consent?...The URL is returned per accounts link and carries that link's own reference in its query string — take it from the response you just received. Do not hardcode the example above, and do not reuse a URL from an earlier link.
What the customer does there
- Opens the
RedirectionURL. On mobile this is their bank's app; in Sandbox it is the Model Bank in the browser. - Signs in at the bank.
- Chooses which accounts to share. The Model Bank lists the consented customer's accounts with a checkbox each, plus a select-all.
- Reviews the permissions the link asked for, and approves.
Consent is given at the bank, not through this API — nothing you call moves the link forward on its own.
What happens next
In Sandbox the link is Active as soon as they approve — you can call the
product endpoints straight away, with the same AccountsLinkId you created.
If you want to confirm it programmatically before calling, fetch the link and
read its Status — see Check link status
below.
Check link status (until Active)
You can list or fetch the link to see its status. The API supports filtering by PSUId, FinancialInstitutionId, Status, etc.
curl --location 'https://test.api.neotek.sa/accounts-information/v1/accounts-links?PSUId=PTP100' \--header 'Authorization: Bearer <ACCESS_TOKEN>'Response (key fields)
{ "Data": { "AccountsLinks": [ { "AccountsLinkId": "2594", "PSUId": "PTP100", "FinancialInstitution": { "FinancialInstitutionId": "SAIBCSARI", "NameEn": "The Saudi Investment Bank" }, "Status": "Active", "CreationDateTime": "2026-07-28T12:07:28Z", "ExpirationDateTime": "2027-07-28T12:07:28Z", "SecurityProfile": "Redirection" } ] }}Status codes: Active, Pending, Rejected, Revoked, Expired. Only
an Active link returns product data.
When Active, use AccountsLinkId with the target product (e.g., E-Statement).
Reusing the link across products
Once you have an Active AccountsLinkId, you can call supported Open Banking products without repeating the bank login. Keep your PSUId consistent across calls. (See each product page for exact payloads.)