Frequently Asked Questions

APIs (Application Programming Interfaces) allow systems and apps to share information with each other.

BMO APIs let you connect your accounting, treasury management and other financial systems to your Online Banking for Business accounts. That connection gives you access to your real-time banking activity in the programs you use every day – without having to export data, upload files, or sign in to Online Banking for Business. You can also use our APIs to build your own apps. Our APIs make your banking data work for you

BMO APIs let you access and use your account data however and wherever you want. Clients like you are using our APIs to:

• See real-time balances for all accounts
• Retrieve day-end, month-end and year-end balances for all accounts
• Pull transaction histories
• Review transactions based on a specific set of criteria
• Replace BAI files and other settlement reports and processes
• Retrieve images of deposited cheques and other items

Once you create an account on the BMO Developer Portal, you can access our sandbox. Our sandbox is a secure environment where you can test our APIs. You can also get secure sandbox credentials so you can test safely in your own environment.

If you're an Online Banking for Business customer, you can use our APIs to connect your accounts to your accounting, treasury management and other financial systems.

You can safely experiment with our APIs and test your code in our sandbox at no cost. When you’re ready to launch your app, please contact us to discuss pricing.

To access the Sandbox, you’ll need to apply for an organization account on the BMO Developer Portal. Just fill out the application form. Once we’ve reviewed and approved it, we’ll send you an email with details on how to set up your account.

When you apply and are approved for an organization account, we'll send you two emails: one with setup details and one with a link to create a password. If you don't see these emails, please check your spam folder. If you still can't find them, please contact us.

To start testing in your own app, you’ll first need to generate an API key. This key, along with the Client ID and Client Secret displayed under My Apps, can be used directly in your app. It will let your app communicate with our servers just as if it were live. The only difference is that we’ll send you dummy data instead of real account information.

This option is closest to a real-life test but requires you to register your app with us. Here’s how:

1. In the BMO Developer Portal, select your username and choose My Apps from the dropdown.
2. Select the Register New App button.
3. Fill in the details and select Register New App.

Once you have your key, go to our sandbox and generate an Access Token. You can use this token to test any of your registered apps.

Your API Key is a credential we assign to you. It lets us verify your identity and see which test app you're using to request information. You'll use it, along with your Access Token and the Client ID and Client Secret, to test our APIs in your own systems.

All our APIs use the standard OAuth 2.0 framework.

To get authorized to make calls, please check our Authorize documentation. It contains all the information you’ll need to implement a two-legged or three-legged OAuth flow.

You need to generate and use an Access Token in our sandbox to authorize test calls against our demo server. You can see our sample requests and responses in the BMO Developer Portal.

You can also use an Access Token to make authorized calls directly from your in-house development applications.

What sign in credentials you use depends on whether you’re testing in the sandbox or launching your app.

Because they are for a mock scenario, all sign in credentials are pre-filled for you in the sandbox.

When you’re ready to launch your app and grant access to your accounts, use your existing Online Banking for Business credentials.

When you make a GET call to our system, specifically Search for Accounts, you'll be returned a list of authorized accounts. For security reasons, these accounts will be identified with a unique account ID that is different from the account number.

To see which account is associated with the account ID returned, check the account_number field in the body of the return.

When you connect an application in production, you’ll be able to see the same accounts you’re entitled to in Online Banking for Business.

As part of the authorization flow, you’ll be able to choose which accounts you’d like to grant access to.

Apart from the Authorize API to give your application secure access to our servers, you’ll only need the Image Retrieval API to retrieve deposit images.

Once your application has been authenticated using the Authorize API, you can start your search for deposit images. Here's how it works:

• Get a list of your authorized Online Banking for Business accounts.
• Specify the account number, date range and item type. You can also add other search criteria.
• From the index of available images, choose the ones you want to retrieve.

The process is the same for Canadian and U.S. items.

You can request images of deposited items as far back as 7 years. To retain them even longer, you can use the API to automatically download and store them in your own archive.

Apart from the Account Validation API to verify account ownership, you’ll also need the Authorize API to give your account secure access to our servers and the Encryption API to protect sensitive information from end-to-end.

Currently, this API only supports U.S. savings and deposit accounts.

Each call can validate up to 100 accounts. There’s no limit for the calls you submit.

You can choose if you want to check account ownership, risk level or both. Simply submit the details you want us to check.