---
openapi: 3.0.1
info:
  x-api-id: 042d9789-15fb-44d4-ac60-6a9df5405d38
  x-audience: company-internal
  x-bmo-api-type: internal-api
  x-bmo-api-provider-id: 26777
  x-bmoservicedomain-name: Commercial_sb
  x-api-specification-compliant: true
  title: XMLDationManagmentAPI
  description: |-
    ## Endpoints for Connectivity
    Mainly meant to be used to confirm connectivity.

    ## Endpoints for Registration
    Mainly meant to be used from BMO Onboarding Application

    ### Registration use cases:
    - Onboarding a new client (POST)
    - Updating an existing client (GET/PUT)
    - Offboarding a client (DELETE)


    ## Endpoints for Management

    Mainly meant to be used from BMO Dev Portal

    ### Management use cases:
    - Get sandbox details
      - BMO Client accounts (same as Account Information Reporting API accounts)
      - Sandbox accounts/objects (test cases)
    - Update BMO Client accounts balance
    - Get Sandbox documentation
      - Provides listing of payment rail and consent/entitlement based data for test cases
      - Filters to retrieve only specific payment rail data for ease of use
  contact:
    email: support@xmldation.com
  version: 1.1.0
  x-ibm-name: xmldationmanagmentapi
  x-ibm-summary: ""
servers:
- url: https://sandbox-open-api.bmo.com/open-banking/commercial-sb
tags:
- name: Connectivity
  description: Connectivity Hello endpoints
- name: Registration
  description: Registration endpoints
- name: Management
  description: Management endpoints
paths:
  /sys-xmldation/systems-operations/hello:
    get:
      x-dataclassification-code: Confidential
      tags:
      - Connectivity
      summary: Hello endpoint for connectivity testing
      operationId: getHello
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: string
                example: GET Hello from BMO Sandbox!
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - SandboxDataManagement
    post:
      x-dataclassification-code: Confidential
      tags:
      - Connectivity
      summary: Hello endpoint for connectivity testing
      operationId: postHello
      requestBody:
        description: An empty request body JSON Object should be used (future proofing).
        content:
          application/json:
            schema:
              type: object
        required: false
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: string
                example: POST Hello from BMO Sandbox!
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - SandboxDataManagement
    put:
      x-dataclassification-code: Confidential
      tags:
      - Connectivity
      summary: Hello endpoint for connectivity testing
      operationId: putHello
      requestBody:
        description: An empty request body JSON Object should be used (future proofing).
        content:
          application/json:
            schema:
              type: object
        required: false
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: string
                example: PUT Hello from BMO Sandbox!
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - SandboxDataManagement
    delete:
      x-dataclassification-code: Confidential
      tags:
      - Connectivity
      summary: Hello endpoint for connectivity testing
      operationId: deleteHello
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: string
                example: DELETE Hello from BMO Sandbox!
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - SandboxDataManagement
  /sys-xmldation/customer-access-entitlement/registration:
    get:
      x-dataclassification-code: Confidential
      tags:
      - Registration
      summary: Retrieves all existing registrations
      operationId: getRegistrations
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Registration'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.customer-access-entitlement.read
    post:
      x-dataclassification-code: Confidential
      tags:
      - Registration
      summary: Register a new client Sandbox
      description: Creates a new sandbox instance with the requested client details.
      operationId: postRegistration
      requestBody:
        description: Details for the new sandbox instance
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Registration'
        required: true
      responses:
        200:
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Registration'
        400:
          description: Invalid input
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.customer-access-entitlement.create
  /sys-xmldation/customer-access-entitlement/registration/{sandboxId}:
    get:
      x-dataclassification-code: Confidential
      parameters:
      - in: path
        name: sandboxId
        description: The sandboxId provided in POST /registration body payload to
          identify sandbox registration.
        required: true
        schema:
          type: string
      tags:
      - Registration
      summary: Retrieves an existing registration
      operationId: getRegistration
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Registration'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.customer-access-entitlement.read
    put:
      x-dataclassification-code: Confidential
      tags:
      - Registration
      parameters:
      - in: path
        name: sandboxId
        description: The sandboxId provided in POST /registration body payload to
          identify sandbox registration.
        required: true
        schema:
          type: string
      summary: Update an existing client Sandbox
      description: Updates an existing sandbox instance with the requested client
        details.
      operationId: putRegistration
      requestBody:
        description: Details for the new sandbox instance
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Registration'
        required: true
      responses:
        200:
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Registration'
        400:
          description: Invalid input
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.customer-access-entitlement.update
    delete:
      x-dataclassification-code: Confidential
      tags:
      - Registration
      parameters:
      - in: path
        name: sandboxId
        description: The sandboxId provided in POST /registration body payload to
          identify sandbox registration.
        required: true
        schema:
          type: string
      summary: Delete a client Sandbox
      description: Deletes a sandbox instance with completely and wipes the stored
        data.
      operationId: deleteRegistration
      responses:
        200:
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Registration'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.customer-access-entitlement.delete
  /sys-xmldation/systems-operations/management/baselines:
    post:
      x-dataclassification-code: Confidential
      tags:
      - Management
      summary: Saves the current state of the sandbox as a new baseline
      description: Client is identified via the Sandbox ID provided in the headers.
        The Sandbox ID is defined in the registration endpoints.
      operationId: postSandboxBaselines
      parameters:
      - in: header
        name: x-client-id
        description: This exact header field name still to be decided. Defines which
          sandbox instance the client is connecting to. Must match the sandboxId from
          registration call.
        required: true
        schema:
          type: string
      requestBody:
        description: Name and description for the new sandbox baseline
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  example: Initial State
                description:
                  type: string
                  example: Status of the sandbox at the initial registration
        required: true
      responses:
        200:
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Baseline'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.legal-entity-directory.create
    get:
      x-dataclassification-code: Confidential
      tags:
      - Management
      summary: Retrieves the saved sandbox states available
      description: Client is identified via the Sandbox ID provided in the headers.
        The Sandbox ID is defined in the registration endpoints.
      operationId: getSandboxBaselines
      parameters:
      - in: header
        name: x-client-id
        description: This exact header field name still to be decided. Defines which
          sandbox instance the client is connecting to. Must match the sandboxId from
          registration call.
        required: true
        schema:
          type: string
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/SandboxBaselines'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.legal-entity-directory.read
  /sys-xmldation/systems-operations/management/baselines/{baselineId}/rollback:
    put:
      x-dataclassification-code: Confidential
      tags:
      - Management
      summary: Rolls back the sandbox to a baselined version
      description: Client is identified via the Sandbox ID provided in the headers.
        The Sandbox ID is defined in the registration endpoints.
      operationId: rollbackSandboxBaseline
      parameters:
      - in: header
        name: x-client-id
        description: This exact header field name still to be decided. Defines which
          sandbox instance the client is connecting to. Must match the sandboxId from
          registration call.
        required: true
        schema:
          type: string
      - in: path
        name: baselineId
        required: true
        schema:
          type: string
      requestBody:
        description: An empty request body JSON Object should be used (future proofing).
        content:
          application/json:
            schema:
              type: object
        required: false
      responses:
        200:
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Baseline'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.legal-entity-directory.update
  /sys-xmldation/customer-access-entitlement/management/accounts:
    get:
      x-dataclassification-code: Confidential
      tags:
      - Management
      summary: Retrieves list of all sandbox accounts
      description: Client is identified via the Sandbox ID provided in the headers.
        The Sandbox ID is defined in the registration endpoints.
      operationId: getAccounts
      parameters:
      - in: header
        name: x-client-id
        description: This exact header field name still to be decided. Defines which
          sandbox instance the client is connecting to. Must match the sandboxId from
          registration call.
        required: true
        schema:
          type: string
      - in: query
        name: paymentRail
        required: false
        schema:
          type: string
          enum:
          - INTERAC
          - ACH
          - WIRES US
          - WIRES CA
          - EFT
          description: Selection of accounts to return by payment rail.
          example: INTERAC
      - in: query
        name: type
        required: false
        schema:
          type: string
          enum:
          - ORDERING
          - BENEFICIARY
          description: |-
            ORDERING accounts are the ones the client has permission to use.
            BENEFICIARY accounts are the use case accounts the client can point transactions to in order to trigger specific behavior.
          example: BENEFICIARY
      responses:
        200:
          description: successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountResponse'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.customer-access-entitlement.read
  /sys-xmldation/customer-access-entitlement/management/accounts/{accountNumber}/balance:
    put:
      x-dataclassification-code: Confidential
      tags:
      - Management
      summary: Updates the balance of a sandbox account to the requested value
      description: Client is identified via the Sandbox ID provided in the headers.
        The Sandbox ID is defined in the registration endpoints.
      operationId: putAccountBalance
      parameters:
      - in: header
        name: x-client-id
        description: This exact header field name still to be decided. Defines which
          sandbox instance the client is connecting to. Must match the sandboxId from
          registration call.
        required: true
        schema:
          type: string
      - in: path
        name: accountNumber
        required: true
        schema:
          type: string
      requestBody:
        description: New balance for the used account
        content:
          application/json:
            schema:
              type: object
              properties:
                balance:
                  type: number
                  example: 1000
        required: true
      responses:
        200:
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Account'
        401:
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error401'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - api-key-1: []
        OAuth2:
        - bmo.devportal.customer-access-entitlement.update
components:
  schemas:
    Baseline:
      type: object
      properties:
        id:
          type: number
          example: 0
        name:
          type: string
          example: Initial State
        description:
          type: string
          example: Status of the sandbox at the initial registration
        createdAt:
          type: string
          format: date-time
          example: "2025-04-23T12:27:45.828+00:00"
    SandboxBaselines:
      type: object
      properties:
        baselines:
          type: array
          items:
            $ref: '#/components/schemas/Baseline'
    AccountResponse:
      type: object
      description: Accounts sorted by the payment rail and ordering / beneficiary
        status
      properties:
        interac:
          $ref: '#/components/schemas/OrderingAndBeneficiaryAccounts'
        ach:
          $ref: '#/components/schemas/OrderingAndBeneficiaryAccounts'
        wiresUs:
          $ref: '#/components/schemas/OrderingAndBeneficiaryAccounts'
        wiresCa:
          $ref: '#/components/schemas/OrderingAndBeneficiaryAccounts'
        eft:
          $ref: '#/components/schemas/OrderingAndBeneficiaryAccounts'
    OrderingAndBeneficiaryAccounts:
      type: object
      properties:
        ordering:
          type: array
          items:
            $ref: '#/components/schemas/AccountArray'
        beneficiary:
          type: array
          items:
            $ref: '#/components/schemas/AccountArray'
    AccountArray:
      type: array
      items:
        $ref: '#/components/schemas/Account'
    Account:
      type: object
      properties:
        accountNumber:
          type: string
          example: "123456789012"
        name:
          type: string
          example: XMLdation Test Account
        description:
          type: string
          example: Test account. Supports all default flows in all payment rails.
            More descriptions here about the specifics for usage and this payment
            rail.
        balance:
          type: number
          example: 1000
        currency:
          type: string
          enum:
          - USD
          - CAD
          - EUR
          - HKD
          example: USD
        mobileNumber:
          type: string
          example: +123-555-321
        emailAddress:
          type: string
          example: staticAccount@xmldation.com
        mmbId:
          type: string
          example: TBD
        BIC:
          type: string
          example: XMLDFIHH
        companyId:
          type: string
          example: TBD
        serviceId:
          type: string
          example: TBD
    Registration:
      required:
      - sandboxId
      - entitlements
      type: object
      properties:
        sandboxId:
          description: Unique identifier for the client sandbox used in subsequent
            registration calls in sandboxId path parameter. Also used in management
            and payment rail x-client-id header to identify which registered sandbox
            should be used.
          type: string
          example: clientIdentifier1
        entitlements:
          type: array
          items:
            $ref: '#/components/schemas/Entitlement'
        language:
          description: Language selection. Defaults to "en" english.
          type: string
          enum:
          - en
          - fr
          example: fr
        olbbId:
          description: OLBB ID defined by BMO. Does not need to be given, will always
            default to the defined value and is immutable.
          type: string
          enum:
          - TBD
          example: TBD
    Entitlement:
      type: string
      enum:
      - INTERAC
      - ACH
      - WIRES US
      - WIRES CA
      - EFT
      - ACCOUNT IR
      example: INTERAC
    Error401:
      type: object
      properties:
        timestamp:
          type: string
          example: "2025-04-23T12:27:45.828+00:00"
        status:
          type: number
          example: 401
        error:
          type: string
          example: Unauthorized
        message:
          type: string
          example: Invalid access token
        path:
          type: string
          example: /registration
    Error:
      type: object
      properties:
        type:
          type: string
          example: Unhandled exception
        title:
          type: string
          example: ""
        status:
          type: number
          example: 500
        detail:
          type: string
          example: JSON parse error
        instance:
          type: string
          example: Sandbox
  requestBodies:
    Registration:
      description: Registering new client
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Registration'
  securitySchemes:
    api-key-1:
      type: apiKey
      x-key-type: client_id
      name: x-api-key
      in: header
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://open-api.bmofg.com/open-banking/commercial-sb/oauth20/authorize
          tokenUrl: https://open-api.bmofg.com/open-banking/commercial-sb/oauth20/token
          scopes:
            SandboxDataManagement: SandboxDataManagement
            bmo.devportal.customer-access-entitlement.read: bmo.devportal.customer-access-entitlement.read
            bmo.devportal.customer-access-entitlement.create: bmo.devportal.customer-access-entitlement.create
            bmo.devportal.customer-access-entitlement.update: bmo.devportal.customer-access-entitlement.update
            bmo.devportal.customer-access-entitlement.delete: bmo.devportal.customer-access-entitlement.delete
            bmo.devportal.legal-entity-directory.create: bmo.devportal.legal-entity-directory.create
            bmo.devportal.legal-entity-directory.read: bmo.devportal.legal-entity-directory.read
            bmo.devportal.legal-entity-directory.update: bmo.devportal.legal-entity-directory.update
      x-ibm-oauth-provider: apic-oauth-ob-commercial-sb-provider
x-ibm-configuration:
  type: rest
  phase: realized
  enforced: true
  testable: true
  categories:
  - bian--bd--operationalservices
  cors:
    enabled: true
  oauth-servers:
    OAuth2:
      authorizationCode:
        tokenUrls:
        - https://open-api.bmofg.com/open-banking/commercial-sb/oauth20/token
        authorizationUrls:
        - https://open-api.bmofg.com/open-banking/commercial-sb/oauth20/authorize
        refreshUrls: []
security:
- api-key-1: []
  OAuth2:
  - SandboxDataManagement
x-ibm-endpoints:
- url: https://sandbox-open-api.bmo.com/open-banking/commercial-sb
  type:
  - production
  - development
...
