Integrate Swippee with production-grade confidence.

https://api.swippee.com/v1

For local development: http://localhost:3000/api/v1

All requests require a Bearer token. Get one from the dashboard.

Authorization: Bearer swippee_sk_live_xxxxxxxxxxxxxxxx

Keys are shown exactly once at creation. We only keep a SHA-256 hash — lost keys must be revoked and replaced. Issue read-only keys for backend services that only need to fetch existing reports.

Upload a bank statement. Returns a full StatementReport.

Request

curl -X POST https://api.swippee.com/v1/parse \
  -H "Authorization: Bearer $SWIPPEE_API_KEY" \
  -F "file=@statement.pdf" \
  -F "bank=auto"

Fields

Response (200)

{
  "report_id": "cl_abc123",
  "status": "complete",
  "statement": {
    "bank": "Nabil Bank",
    "bank_code": "NABIL",
    "currency": "NPR",
    "period": { "from": "2025-11-01", "to": "2026-04-30" },
    "opening_balance": 5028.73,
    "closing_balance": 5062.93,
    "total_transactions": 114
  },
  "signals": { /* … */ },
  "monthly_summary": [ /* … */ ],
  "categories": { /* … */ },
  "merchant_categories": { "groceries": { "count": 12, "total": 8420 }, /* … */ },
  "transactions": [
    {
      "date": "2026-04-12",
      "description": "MPAY 2222020006840462,492738040,MOB",
      "debit": 540, "credit": null, "balance": 4820.5,
      "category": "merchant_payment",
      "merchant": "Santosh Babu Store",
      "merchantTerminal": "2222020006840462",
      "mcc": "5411",
      "merchantCategory": "groceries"
    }
    /* … */
  ]
}

Transaction object

Once a report is complete, each product is a focused GET on it. All take a Bearer key and return JSON shaped for that one product — call only what you need, billed as one parse regardless of how many you read.

# fetch just the income view of a completed report
curl https://api.swippee.com/v1/reports/cl_abc123/income \
  -H "Authorization: Bearer swippee_sk_live_xxx"

enrich is a transform endpoint (POST /v1/enrich) — send raw transactions, get merchant/MCC/category tags back. connect is the hosted upload flow (see the Connect product page).

The categorized transaction list, with query filters so you don't always need the full set.

# only dining spend, debits, in April
curl "https://api.swippee.com/v1/reports/cl_abc123/transactions\
?merchant_category=dining&direction=debit&since=2026-04-01&until=2026-04-30&limit=100" \
  -H "Authorization: Bearer swippee_sk_live_xxx"

Filters: category, merchant_category, direction (credit|debit), since, until (ISO dates), limit (default 500, max 1000). Filters combine (AND).

Fetch a past report by its ID.

curl https://api.swippee.com/v1/reports/cl_abc123 \
  -H "Authorization: Bearer swippee_sk_live_xxx"

List your recent reports.

curl 'https://api.swippee.com/v1/reports?limit=20&status=complete' \
  -H "Authorization: Bearer swippee_sk_live_xxx"

List supported banks. No auth required.

curl https://api.swippee.com/v1/banks

Check your quota and usage for the current month.

{
  "plan": "sandbox",
  "quota": 100,
  "used": 23,
  "remaining": 77,
  "period": "2026-05",
  "resets_at": "2026-06-01T00:00:00.000Z"
}

Swippee Connect is the hosted consent flow: the consumer signs into their Swippee Vault, approves which scopes you get, and you receive a public_token — your app never sees their statement or login. Three steps:

1. Your backend creates a request

curl -X POST https://api.swippee.com/v1/connect/request \
  -H "Authorization: Bearer swippee_sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "scopes": ["identity","income"], "redirect_uri": "https://yourapp.com/cb" }'

# → { "request_token": "swln_…", "connect_url": "https://swippee.com/connect?token=swln_…" }

2. Open the flow in the browser

Script-tag drop-in (any site). The script is first-party — for extra safety you can pin it with integrity/crossorigin.

<script src="https://swippee.com/connect.js"></script>
<script>
  SwippeeConnect.open({
    connectUrl,                       // from step 1 (via your backend)
    onSuccess: ({ public_token }) => exchangeOnYourServer(public_token),
    onExit:    () => {},
  });
</script>

React drop-in:

<SwippeeConnect
  mode="hosted"
  createRequest={() => fetch("/api/connect-request").then(r => r.json())}
  onHostedSuccess={({ publicToken }) => exchangeOnYourServer(publicToken)}
/>

3. Exchange + read the granted data (server)

curl -X POST https://api.swippee.com/v1/connect/exchange \
  -H "Authorization: Bearer swippee_sk_live_xxx" \
  -d '{ "public_token": "swln_…" }'
# → { "access_token": "swac_…", "grant_id": "...", "scopes": [...] }

# read only the granted views (token in a header, never the URL):
curl https://api.swippee.com/v1/grants/GRANT_ID/data \
  -H "Authorization: Bearer swippee_sk_live_xxx" \
  -H "X-Swippee-Access-Token: swac_…"
# → { "scopes": [...], "data": { "identity": {...}, "income": {...} } }

The consumer manages and revokes every connection from my Vault; a revoke kills the access token immediately.

Let the statement owner share a parsed report with a third party (a lender, CA, or landlord) without handing over an API key. You grant a scoped, expiring consent; the grantee redeems an opaque token and sees only the views you allowed. Every read is audit-logged, and you can revoke at any time.

Create a consent

curl -X POST https://api.swippee.com/v1/consents \
  -H "Authorization: Bearer swippee_sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "report_id": "cl_abc123",
    "scopes": ["identity", "income", "verify"],
    "grantee_label": "Nabil Bank loan desk",
    "expires_in_days": 7
  }'

# → { "id": "...", "token": "swcon_…", "data_url": "…/v1/consents/:id/data?token=…",
#     "scopes": [...], "expires_at": "..." }

Valid scopes: identity, income, liabilities, verify, transactions. Expiry defaults to 30 days (max 365).

Redeem (grantee — token only, no API key)

curl 'https://api.swippee.com/v1/consents/:id/data?token=swcon_…'
# → { "scopes": [...], "data": { "identity": {...}, "income": {...} } }

List & revoke (owner)

curl https://api.swippee.com/v1/consents \
  -H "Authorization: Bearer swippee_sk_live_xxx"

curl -X POST https://api.swippee.com/v1/consents/:id/revoke \
  -H "Authorization: Bearer swippee_sk_live_xxx"
# after revoke, redeem returns 403 consent_inactive

When a report completes (sync or async), Swippee POSTs the result to every active webhook endpoint on your org. The payload is signed with X-Swippee-Signature: t=<unix>,v1=<hex> (HMAC-SHA256 signature). Failed deliveries retry with exponential backoff up to 24h.

{
  "event": "parse.complete",
  "report_id": "cl_abc123",
  "timestamp": "2026-05-27T10:23:41Z",
  "result": { /* StatementReport */ }
}

All errors return JSON of the form { "error": { "code": "...", "message": "..." } }.

Read-only access to Nepal's public-sector financial data, parsed from NRB's releases. These endpoints are unauthenticated and free to try (rate-limited per IP). Every response is wrapped in a { data, meta } envelope — meta carries the source, publication date and an attribution string you must surface when republishing.

Endpoints

Example

curl https://api.swippee.com/v1/data/nrb/interest-rates/latest

{
  "data": [
    { "metric": "base-rate", "label": "Base Rate", "value": 5.0, "unit": "percent", "sheet": "C23" },
    { "metric": "wavg-deposit", "label": "Weighted Avg. Deposit Rate", "value": 3.4, "unit": "percent", "sheet": "C20" }
  ],
  "meta": {
    "source": "Nepal Rastra Bank",
    "source_url": "https://www.nrb.org.np/contents/uploads/.../Chaitra_2082_Publish.xlsx",
    "attribution": "Source: Nepal Rastra Bank — Monthly Banking & Financial Statistics. Republished by Swippee Data with attribution.",
    "as_of": "2026-04-15"
  }
}

Browse every dataset and its cadence at /products/data. Macro figures additionally include a source_quote field — the verbatim sentence each number was verified against.