Apps and their data APIs in Canada
Canada's consumer credit-card market: Capital One Canada's CAD card servicing, Interac payments, and the data APIs behind them.
The Canada hub covers the Capital One Canada credit-card client. Capital One Canada is Capital One Bank (Canada Branch)'s OSFI-regulated Schedule III app for Canadian cardholders: encryptedUsername login (password or Touch ID) issues a session plus appAuthenticationToken, then credit-cards-information nests lastFourCardNumber, currentBalance, creditLimit, availableCredit, statementBalance and minimumPaymentDueDate under accountReferenceId.
The same session hydrates STANDARD_ACTIVITY purchase lines — merchantName, transactionAmount, transactionDate and transactionPostedDate — plus Interac-capable payment accounts carrying paymentAccountReferenceId, lastFourDdaNumber and paymentAccountType, posted paymentAmount / paymentReferenceId rows, cardLock on cardReferenceId, and rewards redemptions with redemptionAmount, redemptionCategoryCode and redemptionOrderStatus. Those are the endpoints behind every balance, payment, lock, PIN and miles screen in the app.
Frequently asked questions
Which analyzed apps operate in Canada?
The Canada hub covers Capital One Canada, Capital One Bank (Canada Branch)'s CAD credit-card client, documenting the API behind its balance, Interac payment, card-lock, PIN and rewards screens.
What cardholder data does the Capital One Canada API expose?
Signed-in calls return currentBalance, creditLimit, availableCredit, statementBalance, minimumPaymentDueDate and lastFourCardNumber; Interac funding sources with paymentAccountReferenceId and lastFourDdaNumber; posted paymentAmount rows; cardLock; and rewards redemptionAmount with redemptionOrderStatus.
How does the Capital One Canada app authenticate?
POST /service/login sends encryptedUsername with encryptedPassword, or Touch ID with touchIdAccessToken. Later first-party calls reuse the login session cookies plus appAuthenticationToken from POST /service/mobile/generate-app-authentication-token. There is no public developer key for these endpoints.
