Endpoint
POST /v3/statements
Authentication and target
Use an account credential for its bound account, or a user credential with bothX-ISPB and X-Account-Number. If an account credential sends those headers, both must be present and must match its bound account. Platform credentials are not accepted. All requests require the standard HMAC-SHA256 headers.
The curl example below uses an ACCOUNT credential bound to the operated account, so it omits X-ISPB and X-Account-Number. If X-Client-ID identifies a USER credential, add both target headers and include their exact trimmed values in the canonical header set before calculating X-Signature.
Request body
Success data
statements[] with IDs, decimal-string amount, memo, numeric times/payment/status/type fields, is_credit, parties, and parent references; plus numeric snapshot_timestamp and cursor. The generated page field is not populated by this mapper.
Behavior and validation
Results are requested in descending order.is_credit compares the transaction payee document to the selected account document. Party documents can be masked by merchant setting.
Errors
Every call can fail for missing or invalid signature headers, an expired timestamp, nonce replay, an invalid body hash or signature, insufficient permission, or a downstream service error. Endpoint-specific errors include:4001invalid dates or page size;4003008missing account context.501transaction-list RPC failure and mapped upstream errors.