Bibit Data API: Endpoints & Fields

PT. Bibit Tumbuh Bersama - Reksadana Online · Banking 4.8 ★

Bibit- Reksadana & Obligasi is the Android investing client of PT. Bibit Tumbuh Bersama, the Stockbit-group mutual-fund agent (APERD) that sells reksadana and government bonds (SBN/obligasi) to Indonesian retail savers. After opening an account, users browse the fund catalog, run a robo allocation, set automatic SIPs, buy or sell units, link a Bank Jago pocket for instant top-up and redemption, invite family into a Bibit Bareng shared portfolio, and sign in with Google or device biometrics. Face liveness, e-KTP capture, LinkAja checkout and GoPay Tabungan-by-Jago onboarding sit around that order pad. The app is Indonesia-only — OJK-licensed, rated 4.8 from about 303,000 Play reviews, competing with Ajaib, Bareksa, Tanamduit and Stockbit’s own fund shelf.

Jago linking returns linkStatus plus a bank webViewUrl, while instant-redemption pockets mint an authId for the cash-out handshake. Bibit Bareng membership lists joinedMembers with per-row fullName, phone, isAdmin and invitationId. KYC liveness answers isLive against a remaining remain quota, and document intake issues signedUrl / fileUrl pairs with an OCR jobId. Family-office dashboards, APERD reconcilers and onboarding-risk tools consume those fields; openData Studio turns them into callable open data.

Screenshots

API surface

The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.

Register Bank Jago link
POST /v1/bank-links/initiate openbanking
Starts Bank Jago account linking from the in-app bank module and returns registration status, linkStatus and the webViewUrl used to finish the bank handshake.
Auth: Bearer accessToken from the signed-in session (Authorization header).
- status
- webViewUrl
- linkStatus
- message
- error
- data
- type
- version
```
POST /v1/bank-links/initiate HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{}
```
```
{
  "message": "ok",
  "error": null,
  "data": {
    "status": "PENDING",
    "webViewUrl": "https://partner-bank.example/onboarding",
    "linkStatus": "NOT_LINKED"
  },
  "type": "success",
  "version": "1"
}
```
Jago instant-redemption pocket
POST /v1/bank-links/cash-out-pockets openbanking
Requests a Bank Jago instant-redemption pocket and returns the authId plus webViewUrl that drive the cash-out / pocket-auth screen.
Auth: Bearer accessToken from the signed-in session (Authorization header).
- authId
- webViewUrl
- message
- error
- data
- type
- version
```
POST /v1/bank-links/cash-out-pockets HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{}
```
```
{
  "message": "ok",
  "error": null,
  "data": {
    "authId": "bank-auth-9f2c1a",
    "webViewUrl": "https://partner-bank.example/pocket"
  },
  "type": "success",
  "version": "1"
}
```
Buy mutual-fund order
POST /v1/orders/purchase openfinance
Places a mutual-fund buy from the in-app order pad; the order screen forwards a JSON body (including paymentMethod) to the order service.
Auth: Bearer accessToken from the signed-in session (Authorization header).
- paymentMethod
- message
- error
- data
- type
- version
```
POST /v1/orders/purchase HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "paymentMethod": "JAGO"
}
```
```
{
  "message": "ok",
  "error": null,
  "data": {},
  "type": "success",
  "version": "1"
}
```
Sell mutual-fund order
POST /v1/orders/redemptions openfinance
Submits a fund sell (redemption) order; the client attaches the device secure_key from the JSON body to the request.
Auth: Bearer accessToken from the signed-in session (Authorization header).
- secure_key
- message
- error
- data
- type
- version
```
POST /v1/orders/redemptions HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "secure_key": "<device-secure-key>"
}
```
```
{
  "message": "ok",
  "error": null,
  "data": {},
  "type": "success",
  "version": "1"
}
```
Robo portfolio top-up
POST /v1/allocations/top-ups openfinance
Tops up a robo-advisor allocation using the chosen paymentMethod from the in-app bank module.
Auth: Bearer accessToken from the signed-in session (Authorization header).
- paymentMethod
- message
- error
- data
- type
- version
```
POST /v1/allocations/top-ups HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "paymentMethod": "JAGO"
}
```
```
{
  "message": "ok",
  "error": null,
  "data": {},
  "type": "success",
  "version": "1"
}
```
Create recurring SIP
POST /v1/investment-plans openfinance
Creates an automatic SIP / recurring purchase; the client attaches the device secure_key from the JSON body.
Auth: Bearer accessToken from the signed-in session (Authorization header).
- secure_key
- message
- error
- data
- type
- version
```
POST /v1/investment-plans HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "secure_key": "<device-secure-key>"
}
```
```
{
  "message": "ok",
  "error": null,
  "data": {},
  "type": "success",
  "version": "1"
}
```
Continue order payment
POST /v1/invoices/{invoiceId}/channels/{channel}/pay openfinance
Resumes a pending buy/top-up invoice: the client sends invoiceId and channel, then receives the webviewUrl for the payment sheet.
Auth: Bearer accessToken from the signed-in session (Authorization header).
- invoiceId
- channel
- webviewUrl
- message
- error
- data
- type
- version
```
POST /v1/invoices/INV-2401-8831/channels/JAGO/pay HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "invoiceId": "INV-2401-8831",
  "channel": "JAGO"
}
```
```
{
  "message": "ok",
  "error": null,
  "data": {
    "webviewUrl": "https://pay.example/session/INV-2401-8831"
  },
  "type": "success",
  "version": "1"
}
```

Shared portfolio members

GET /v1/shared-goals/{groupId}/participants opendata

Lists Bibit Bareng members on a shared portfolio: joinedMembers, sharedAt, and per-member fullName, phone, isAdmin, invitationId, memberId and status.

Auth: Bearer accessToken from the signed-in session (Authorization header).

joinedMembers
sharedAt
members
fullName
invitationId
isAdmin
memberId
phone
status
message
error
data
type
version

GET /v1/shared-goals/grp-88421/participants HTTP/1.1
Authorization: Bearer <access_token>

{
  "message": "ok",
  "error": null,
  "data": {
    "joinedMembers": 3,
    "sharedAt": "2026-03-12T09:14:00+07:00",
    "members": [
      {
        "fullName": "Sari Wulandari",
        "invitationId": 90112,
        "isAdmin": 1,
        "memberId": 4401,
        "phone": "081234567890",
        "status": "JOINED"
      }
    ]
  },
  "type": "success",
  "version": "1"
}

Google SSO sign-in

POST /v1/sessions/federated osint

Exchanges a Google SSO token (plus FCM pushToken) for a Bibit session.

Auth: None. Google ID token is the first factor; the response mints the session accessToken.

token
provider
pushToken
pushTokenType
accessToken
message
error
data
type
version

POST /v1/sessions/federated HTTP/1.1
Content-Type: application/json

{
  "token": "<google-id-token>",
  "provider": "google",
  "pushToken": "<fcm-token>",
  "pushTokenType": "fcm"
}

{
  "message": "ok",
  "error": null,
  "data": {
    "accessToken": "<session-token>"
  },
  "type": "success",
  "version": "1"
}

Biometric challenge key
POST /v1/sessions/device-challenges osint
Issues a biometric challengeKey for the enrolled deviceToken so the client can sign it locally and complete passwordless login.
Auth: None for the challenge itself; deviceToken identifies the enrolled device.
- deviceToken
- challengeKey
- message
- error
- data
- type
- version
```
POST /v1/sessions/device-challenges HTTP/1.1
Content-Type: application/json

{
  "deviceToken": "dev-88c1-android"
}
```
```
{
  "message": "ok",
  "error": null,
  "data": {
    "challengeKey": "chg-0a91ee"
  },
  "type": "success",
  "version": "1"
}
```

Enroll biometric login

POST /v1/devices/credentials osint

Registers this device for biometric login by uploading deviceId, Firebase installationId and the local publicKey.

Auth: Bearer accessToken from the signed-in session (Authorization header).

deviceId
installationId
publicKey
message
error
data
type
version

POST /v1/devices/credentials HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "deviceId": "android-id-4f22",
  "installationId": "fid-9aa1",
  "publicKey": "<device-public-key>"
}

{
  "message": "ok",
  "error": null,
  "data": {},
  "type": "success",
  "version": "1"
}

Face liveness result

POST /v1/verifications/face-checks/result osint

Reads the individual KYC liveness verdict for a livenessId: isLive plus remaining/usage quota for retries.

Auth: Bearer accessToken from the signed-in session (Authorization header).

livenessId
isLive
quota
remain
usage
message
error
data
type
version

POST /v1/verifications/face-checks/result HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "livenessId": "liv-77c0"
}

{
  "message": "ok",
  "error": null,
  "data": {
    "isLive": true,
    "quota": {
      "remain": 4,
      "usage": 1
    }
  },
  "type": "success",
  "version": "1"
}

Presigned KYC upload URL

POST /v1/documents/upload-urls opendata

Mints a time-limited signedUrl so the client can upload an e-KTP or supporting image, returning fileUrl, fileName, contentType and validUntil.

Auth: Bearer accessToken from the signed-in session (Authorization header).

contentLength
name
type
contentType
fileName
fileUrl
signedUrl
validUntil
message
error
data
version

POST /v1/documents/upload-urls HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "contentLength": 245760,
  "name": "id-front.jpg",
  "type": "image/jpeg"
}

{
  "message": "ok",
  "error": null,
  "data": {
    "contentLength": 245760,
    "contentType": "image/jpeg",
    "fileName": "id-front.jpg",
    "fileUrl": "https://files.example.com/kyc/id-front.jpg",
    "signedUrl": "https://storage.example.com/kyc/id-front.jpg?signature=<signature>",
    "validUntil": "2026-10-20T10:20:00+07:00"
  },
  "type": "success",
  "version": "1"
}

Trigger document OCR

POST /v1/documents/extractions opendata

Starts OCR on an uploaded KYC fileUrl and returns the async jobId used to attach extracted identity fields to the application.

Auth: Bearer accessToken from the signed-in session (Authorization header).

fileUrl
jobId
message
error
data
type
version

POST /v1/documents/extractions HTTP/1.1
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "fileUrl": "https://files.example.com/kyc/id-front.jpg"
}

{
  "message": "ok",
  "error": null,
  "data": {
    "fileUrl": "https://files.example.com/kyc/id-front.jpg",
    "jobId": "ocr-12ab9c"
  },
  "type": "success",
  "version": "1"
}

Data categories

investments
balances
identity
kyc
orders

Where teams use this data

Shared-portfolio household roster
A family-office or household-budget app pulls joinedMembers, fullName, phone, isAdmin and invitationId for each Bibit Bareng portfolio so admins can see who is on a goal without scraping the invite sheet.
Jago redemption and order recon
An APERD operations bot matches Jago pocket authId / linkStatus with buy, sell, robo top-up and invoiceId+channel charge rows so instant redemptions and SIPs land on the same cash ledger.
Onboarding liveness and document intake
A KYC desk queues isLive plus remain/usage quota next to each signedUrl/fileUrl upload and OCR jobId, flagging retries before the e-KTP pack is sent to the registrar.
Passwordless session analytics
Security engineering tracks Google SSO (provider, pushTokenType) against biometric enrollments (deviceId, installationId, publicKey) and challengeKey issuance to spot devices that never complete verify.

Frequently asked questions

What investment order data does the Bibit client expose?

Order calls cover mutual-fund buy, sell (redemption), robo top-up and recurring SIP creation after login. Sell and SIP requests attach a device secure_key; continued payments return a webviewUrl for a given invoiceId and channel.

How does Bank Jago show up in the data?

Jago registration returns status, webViewUrl and linkStatus. Instant-redemption pocket requests return an authId plus webViewUrl used to finish the bank handshake from the Jago module.

Can I read who is on a Bibit Bareng portfolio?

Yes. The shared-members call returns joinedMembers, sharedAt and a members list with fullName, phone, isAdmin, invitationId, memberId and status.

How do sign-in and KYC authenticate?

Google SSO posts token, provider and pushToken. Biometric login enrolls deviceId, installationId and publicKey, then fetches a challengeKey for the deviceToken. Later calls send Authorization: Bearer with the session accessToken. Liveness posts a livenessId and reads isLive plus quota.

Apps similar to Bibit- Reksadana & Obligasi

Ajaib — Ajaib is an Indonesian all-in-one investing app for IDX stocks, mutual funds (reksadana), crypto and US stocks.
Bareksa — Bareksa is an OJK-licensed Indonesian investment super app for stocks, mutual funds, government bonds (SBN) and gold, with a robo advisor on the same client.
tanamduit — tanamduit is an OJK-licensed Indonesian app for mutual funds from Rp10,000, retail government bonds (SBN Ritel) and 24K gold, with goal-based Tanam Mimpi plans.
Stockbit — Stockbit is the IDX stock-trading app of PT Stockbit Sekuritas Digital, which acquired Bibit, where users discuss, analyse and trade Indonesian shares.
Pluang — Pluang is an Indonesian investing and trading app for IDX stocks, US stocks, crypto and digital gold, with group companies licensed under OJK, Bappebti and/or Bank Indonesia.
IPOT — IPOT is PT Indo Premier Sekuritas’s Android client for investing and trading Indonesian stocks, from a brokerage registered with and supervised by OJK.
Growin' — Growin’ is Mandiri Sekuritas’s investing app for Indonesian stocks, mutual funds (money-market, fixed-income, equity, balanced, index/ETF and sharia) and bonds.

More Banking apps

Topics

bibit api
bibit reksadana data
jago pocket authId
bibit bareng members
reksadana sip recurring
bibit liveness isLive
indonesia mutual fund api

Need this app's data API integrated?

We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.

NDA + SOW on every engagement
Delivery in 3–7 days
Payment only after acceptance
Work scoped to authorized use

Get a quote

Bibit Data API: Endpoints & Fields

Screenshots

API surface

Register Bank Jago link

Jago instant-redemption pocket

Buy mutual-fund order

Sell mutual-fund order

Robo portfolio top-up

Create recurring SIP

Continue order payment

Shared portfolio members

Google SSO sign-in

Biometric challenge key

Enroll biometric login

Face liveness result

Presigned KYC upload URL

Trigger document OCR

Data categories

Where teams use this data

Shared-portfolio household roster

Jago redemption and order recon

Onboarding liveness and document intake

Passwordless session analytics

Frequently asked questions

Apps similar to Bibit- Reksadana & Obligasi

More Banking apps

5paisa: Demat, Stocks & IPO

AndroMoney

Angel One: Stocks, Mutual Fund

Capital One UK

Topics

Need this app's data API integrated?

Bibit Data API: Endpoints & Fields

Screenshots

API surface

Register Bank Jago link

Jago instant-redemption pocket

Buy mutual-fund order

Sell mutual-fund order

Robo portfolio top-up

Create recurring SIP

Continue order payment

Shared portfolio members

Google SSO sign-in

Biometric challenge key

Enroll biometric login

Face liveness result

Presigned KYC upload URL

Trigger document OCR

Data categories

Where teams use this data

Shared-portfolio household roster

Jago redemption and order recon

Onboarding liveness and document intake

Passwordless session analytics

Frequently asked questions

Related apps

Apps similar to Bibit- Reksadana & Obligasi

More Banking apps

5paisa: Demat, Stocks & IPO

AndroMoney

Angel One: Stocks, Mutual Fund

Capital One UK

Topics

Need this app's data API integrated?